Re: [PATCH v2 0/6] KEYS: From assoc_array to rhashtable migration

[Jarkko Sakkinen]

On Fri, Oct 23, 2026 at 03:09:20PM +0300, Jarkko Sakkinen wrote:
> The keyring subsystem depends on assoc_array for searching keys by their
> description, type and domain. It is the sole user of this data structure,
> which has during the age of LLMs transformed into a maintenance nightmare.
> 
> assoc_array needs to be replaced with a data structure meeting the
> following criteria:
> 
> 1. Must be suitable for a sparse key-value store.
> 2. Must have multiple in-kernel users.
> 3. Would be nice if it had dedicated maintainers.
> 
> rhashtable is likely the best pick from the available options as it is
> designed for a sparse key space, has dedicated maintainers, and multiple
> in-kernel users.
> 
> CHANGES
> =======
> 
> v2:
> - Tried to address all the issues pointed out by David and Eric. Tell me
>   if something was ignored, as that would be an unintentional mishap.
> - Updated and trimmed the source code comments.
> - For assoc_array_edit I decided to go with two-element pointer array,
>   which shifts a bit what David suggested.
> - Dropped is_keyring flag. It was so obvious call so I mention it here
>   just in case because too obvious maxes out my self-doubt ;-)
> - Used cleanup.h primitives where I possibly could especially in order
>   to make fallible initializations more bug-resistant.
> - The already-ack'd bug fixes are included but will be dropped as soon
>   as I've sent them over to Linus.
> 
> VERSIONS
> ========
> 
> - v2:
>   https://lore.kernel.org/keyrings/20261016215326.4110064-1-jarkko@xxxxxxxxxx/`
> 
> Jarkko Sakkinen (6):
>   KEYS: Expand key->{datalen,quotalen} to unsigned int
>   KEYS: Reject descriptions larger than KEY_MAX_DESC_SIZE
>   KEYS: Verify the key identity in __key_unlink_begin
>   KEYS: Introduce keyring_is_empty()
>   KEYS: Replace assoc_array with rhashtable
>   lib: Remove assoc_array
> 
>  Documentation/core-api/assoc_array.rst        |  564 ------
>  Documentation/core-api/index.rst              |    1 -
>  .../zh_CN/core-api/assoc_array.rst            |  473 -----
>  .../translations/zh_CN/core-api/index.rst     |    1 -
>  drivers/md/dm-verity-verify-sig.c             |    2 +-
>  fs/smb/client/cifsacl.c                       |    6 +-
>  fs/verity/signature.c                         |    2 +-
>  include/keys/keyring-type.h                   |    1 -
>  include/linux/assoc_array.h                   |   88 -
>  include/linux/assoc_array_priv.h              |  178 --
>  include/linux/key.h                           |   27 +-
>  lib/Kconfig                                   |   14 -
>  lib/Makefile                                  |    1 -
>  lib/assoc_array.c                             | 1724 -----------------
>  security/keys/Kconfig                         |    1 -
>  security/keys/internal.h                      |    9 +-
>  security/keys/key.c                           |   30 +-
>  security/keys/keyctl.c                        |    2 -
>  security/keys/keyring.c                       |  871 ++++-----
>  security/keys/request_key.c                   |   24 +-
>  .../dm-verity/test-dm-verity-keyring.sh       |    2 +-
>  21 files changed, 457 insertions(+), 3564 deletions(-)
>  delete mode 100644 Documentation/core-api/assoc_array.rst
>  delete mode 100644 Documentation/translations/zh_CN/core-api/assoc_array.rst
>  delete mode 100644 include/linux/assoc_array.h
>  delete mode 100644 include/linux/assoc_array_priv.h
>  delete mode 100644 lib/assoc_array.c
> 
> --
> 2.47.3
> 

I must have typoed my send-email command-line as Eric was supposed to be
Cc'do to the whole thread, duh. Will be addressed next round, apologies.

Br, Jarkko