Linux kernel: keys: Check the authorization payload in process keyring searches

With the descendant paused after validation, the paths can interleave as follows:

1. 1.The descendant enters search_process_keyrings_rcu() under RCU and key_validate() succeeds.
2. 2.The helper instantiates the target, invalidates the authorization key, and exits.
3. 3.The requester resumes from UMH_WAIT_PROC, calls complete_request_key(), and revokes the authorization key. request_key_auth_revoke() sets its payload pointer to NULL.
4. 4.The descendant loads NULL and dereferences rka->cred.

This NULL dereference can oops the kernel. RCU delays payload disposal but does not prevent the pointer from being cleared.

Load the payload with dereference_key_rcu() and require a non-NULL result before validating the authorization key and searching its saved credentials. A non-NULL payload and its credentials remain alive for the caller's RCU read-side section; a cleared payload skips the fallback search and follows the existing error selection.

KASAN report as below:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] RIP: 0010:search_process_keyrings_rcu+0x32b/0x790