KEYS: changes for v7.4-rc3-2

The following changes since commit 7e1392a42ea288d70a266f6553fe06f57f8647ea:

Merge tag 'net-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-11-12 12:26:14 -0800)

are available in the Git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git tags/keys-v7.4-rc3-2

for you to fetch changes up to bab48a1044475f62d6e910c6d7267ce4bae847f9:

KEYS: Protect pkey method checks against type removal (2026-11-13 06:28:55 +0200)

----------------------------------------------------------------
[GIT PULL] KEYS: changes for v7.4-rc3-2

This second PR for v7.4-rc3 bundles two bug fixes:

1. Invoke the match callback before the state checks in keyring_search_iterator(), so that a non-matching revoked, expired or invalidated key cannot decide the search result.
2. Take key->sem for reading around the ->asym_*() method calls in the keyctl pkey operations, as a key reference does not pin the module providing the key type.

I decided to send this in order to get the remaining key type fixes off the way.

As said earlier this week, I have made a patch set, making the life-time of a key type dependent of the keys that use it at the kernel module level. My goal is to land both rhashtable changes and key type changes to v7.5, as that would provide a nice baseline to further improving keyrings (and IMHO best picks as starting points overall).

----------------------------------------------------------------
Guixiong Wei (1):
KEYS: do not let an unmatched key decide the search result

Yuansheng Yang (1):
KEYS: Protect pkey method checks against type removal

 security/keys/keyctl_pkey.c | 100 +++++++++++++++++++++++++++++++++-----------
 security/keys/keyring.c     |  12 +++---
 2 files changed, 82 insertions(+), 30 deletions(-)