From nobody Sat Jul 25 19:28:28 2026 Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9AE21381B02 for ; Tue, 14 Jul 2026 11:54:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784030099; cv=none; b=g1w8GBb0RUofQPsBsbI9h7bIQAvEm8b/JaVcKSjILXdlmscCQZy0dmGVV3tNAyp0V2QPg/pR2G+cd3OAXSW5Dz9GmJ7hmiRYxnciiH9h/bF1X5U2A2rnvrTJIkGVvbNJfwuWcx+laigq1gnFZqLGwyflGlfU/zCXE2dN4HM2Dhg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784030099; c=relaxed/simple; bh=8zs0bohkqz5AHgWLOAdTFJ4eY64BQy7weh3GYB3lFvs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gcoyiZw0LJoUiuPhLyb17BVEADM5SsoOGDNso4yW4nkDO9Tzp1Y0oNYHJY9A/TnWsJUl7FudFEM/9UtHmCW1YZHs0Ez1XIkv97wzKMrA5CEjzumRMB64OpB1xVF+aJX8Nx4R2kXRFuwLHUCjWv4kvvzvK1TBR4fEIqT0ltDYiQI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=rAXfcIR2; arc=none smtp.client-ip=209.85.219.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="rAXfcIR2" Received: by mail-qv1-f49.google.com with SMTP id 6a1803df08f44-8efbafa1bacso35065136d6.1 for ; Tue, 14 Jul 2026 04:54:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784030096; x=1784634896; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=suF5ptZtpi7RCzW0/i+xzlbJ6znA4LVm3BIxn07HFo4=; b=rAXfcIR2zHh3aG5qw7wuYEVjK+UcuYnVTWmpBsZyQWU8+yhhkrSrXIJbpnTdJt2SXd 44kvuSitJ3hFdCyqc2eGnh40hdYIXQ5k2nFpTZQPQxnfiPGw0QlfLSfHZ3WTf8WpgU+m cv2aHpMRg0/1ql96evQPZYPntLmQ8YQuvNWSyWPunGX5Fu5nUdPfxzT/Hv5WJon73QpI qoXuyHdoXmn7AxYaz6buXJC61lBdMn0qD+da4sPgQQo+J/xMQB/308BFNo5H0FJoR9NZ 8zjnMwLCK0znYJzrUI7Dr4rnr8lti463QPtH6ERAi+rPc0jvCFUv3F6o+NKpd5mgNJar gkzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784030096; x=1784634896; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=suF5ptZtpi7RCzW0/i+xzlbJ6znA4LVm3BIxn07HFo4=; b=ZlfPrcYh9ubLJmDgW0L42m1Xr2Z7yYt9wUsbJHvffyPvmy+cdBQZOsRoFPbinTjunE UC5GtDnjr7DjAPSo0PaV1mX6S5ROJTqGzJXlcSkS02ZUE2DD4OOhhkuS45MBjLySqjvn aA46F856x19zEC97ZAqKg8NodxINCJ3SPMVv8Bf2Jq2yRxZ3XTBBRINx+cIswISmvksJ cjUZ+mDBCM7xj8UANU9DoQZ1+uXfEJ1Ku8L6r51xt5Sm/Rn4SbD8Rt6hyhze7u/nzR5U BtgNu6aWbjmUmzBMvo+KQbGSNjDX57+Ox9wdthqBA4iklaS5RF+Ts4WkAA9SqxJe64eI fJsA== X-Forwarded-Encrypted: i=1; AHgh+RoLygz8H5v7pp40sZsWmk/TY5I28oOFT7kb24jZ8gs/yUra3G0VPh9kwIZ68Led2tGItweZjLiCRSSxHFk=@vger.kernel.org X-Gm-Message-State: AOJu0YxhMkOIHBMnPn83G4ZzFtZhoZgxU1jEaFyLZqAOY/26lb0EnUQe Kn0aVmhVo7R1uNk88YsnadiLZRVQcIk8trfHTXnh9ET0DEYMY5INviLN X-Gm-Gg: AfdE7clOBU2GSVGIXoAeIGyuTTaY41eglrNVwy9wJy8b5FwpanUqEFa7Lro1i8kFaJg ro4IVqDLRNeMF5UMtfRSd3kg+E55d8VephGlJSXTmdDOEaJcYpR6rOCLs4i57t3UulNSQGvlyCz dj6nr9flX9uWvMa9CSSxtbhBNf3hA6ScH0IDsVsr3yULWlmMIgqMEIAG5PgU5NXpvNpPpASMy5Z Ysn6n7RFLY7YI/PXbAAFPNVcnBwtMc9YgSvCoLLYC4NwnkzNxLvO07UpQEKko2dFmLCQTfSkUV2 wcofRVWjvxlycTEhICbmA5QGAFKvsBkVj0oXo1yu9MmzVDJbwbvCZRdbyrci+0b1lVimT6UYnRY 690dXPGKYsiDn7o3/Wv4DqDYRFGr1MQV8o2fcnTg24Zd0nbCgPubrzJ+oXjL4YFZJQzLYrj9XdO 0NYURWII7fgkiCrIAgB2F5AIe6ZR2Mu2ZpyxfDL2MSe5r13oR1aeNnAx/5A/zcrVK1wCl4fjQ3y 0mVFHFwPQ== X-Received: by 2002:a05:6214:2b8c:b0:8ed:a980:6b29 with SMTP id 6a1803df08f44-90403a6103amr144551036d6.32.1784030096456; Tue, 14 Jul 2026 04:54:56 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8ffd80fd492sm185100576d6.34.2026.07.14.04.54.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 04:54:56 -0700 (PDT) From: Michael Bommarito To: David Howells , Jarkko Sakkinen Cc: Andrew Morton , Paul Moore , James Morris , "Serge E . Hallyn" , keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/3] keys: fix out-of-bounds read in keyring_get_key_chunk() Date: Tue, 14 Jul 2026 07:54:49 -0400 Message-ID: <20260714115451.3773164-2-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260714115451.3773164-1-michael.bommarito@gmail.com> References: <20260714115451.3773164-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading. The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read. Fixes: f771fde82051 ("keys: Simplify key description management") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito --- security/keys/keyring.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) KASAN, x86_64: add_key(2) of a crafted hash-colliding "user"-key pair (~63-byte descriptions) reports BUG: KASAN: slab-out-of-bounds in keyring_get_key_chunk keyring_get_key_chunk <- assoc_array_insert <- __key_link_begin <- __do_sys_add_key reading one byte past the description allocation; the same trigger is KASAN-clean with this patch. On a kernel built without init-on-alloc, reading the colliding keyring back with KEYCTL_READ returns uninitialized slab until patches 2 and 3 are applied too. Trigger available off-list. diff --git a/security/keys/keyring.c b/security/keys/keyring.c index 7a2ee0ded7c93..1739373172ad5 100644 --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -270,7 +270,7 @@ static unsigned long keyring_get_key_chunk(const void *= data, int level) const struct keyring_index_key *index_key =3D data; unsigned long chunk =3D 0; const u8 *d; - int desc_len =3D index_key->desc_len, n =3D sizeof(chunk); + int desc_len =3D index_key->desc_len, n =3D sizeof(chunk), offset; =20 level /=3D ASSOC_ARRAY_KEY_CHUNK_SIZE; switch (level) { @@ -284,12 +284,12 @@ static unsigned long keyring_get_key_chunk(const void= *data, int level) return (unsigned long)index_key->domain_tag; default: level -=3D 4; - if (desc_len <=3D sizeof(index_key->desc)) + offset =3D sizeof(index_key->desc) + level * sizeof(long); + if (desc_len <=3D offset) return 0; =20 - d =3D index_key->description + sizeof(index_key->desc); - d +=3D level * sizeof(long); - desc_len -=3D sizeof(index_key->desc); + d =3D index_key->description + offset; + desc_len -=3D offset; if (desc_len > n) desc_len =3D n; do { --=20 2.53.0 From nobody Sat Jul 25 19:28:28 2026 Received: from mail-qv1-f50.google.com (mail-qv1-f50.google.com [209.85.219.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4F673876C6 for ; Tue, 14 Jul 2026 11:54:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784030100; cv=none; b=rBOZU5sQJes3NXU0YAQKF7mq1kZOXONNYw6a6aoKnckHnEGugjv0iVcpBi4aCC1gW0M6hOC3PPClF7QXh+0BxOb9uLHeYeZOLLZAMiHYyIRfYov5ZOipS64hU+QImV85/y9Y/CT/rofNjNy/vvUDGEfXYgG7UeNPBarReomkke8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784030100; c=relaxed/simple; bh=9RRZcFgrtBWsMm88TekPA+n+ES8ipoI28R2xVaJ1owk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YtOgphM0K6LAcaYqJcxlCTxFaKkbfzGBljxQG+dgZehslLTVIgQHQXVjPOCxV9wBUShFrcwKuZ2EaCdWYRIzIhgpNsZ+n2wi4tHrOhoQ1X2ln+dfMciGaElaV9EyoqQGRN06R118CDsdKPwyJ7RNRoE696rpPYmfRruLQlLxb7U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gpClXGEf; arc=none smtp.client-ip=209.85.219.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gpClXGEf" Received: by mail-qv1-f50.google.com with SMTP id 6a1803df08f44-8f29ec73064so36830016d6.1 for ; Tue, 14 Jul 2026 04:54:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784030097; x=1784634897; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qTYC4WZ/uNDWSHxkWtJkYAaxtQ+BheOgFcuFhfNnJxk=; b=gpClXGEfxfL7j2nFBXqFrw0r99d9aHViGFW9h2OF+0ObBXOMJrajp0tORuZ34Q2iJq l6/G99oDTrxrphhEYPQm5kFN8odf8T/9xttT7kjhrqbLqbL/sIQZaK/+gLbYCnCpaQRg 209Di8tAmiouJhVJBhMzDNGgyaHsXapJ/tuThpLX3QpjJTYZew1vAImSNuyKC9iqf7Ok lZt2zoHLiWmZ8YDKbZ8AohszsxwSybYtQQXVVNfeGYUNfOBhXPz9ZGvNhRztkuij5k0U y86KLuMhrutMFql276OFQ50pssoM7SLeZG9ndO6TFFQ/qITo7WzPLTHdeSywor7W7n88 AGLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784030097; x=1784634897; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=qTYC4WZ/uNDWSHxkWtJkYAaxtQ+BheOgFcuFhfNnJxk=; b=ZqFT9f0uKnr/peFJ3hd20Iz1zyuLaDL5PeyJPSjXae7QGP89rjV6qzC+BQiOS6gXES N9lXr/ZdugI+pfIDhRWUGDLSXKneb5zVG5M43t2/oeTDNmp/EfM2fqV6UfqTsG2CE1hq tmwQ9RaydTe6D8E5tcgkgFszUmYmZ8/Hpn2KC6OYNLSwc8PqHlZOZEbG544HPYRmFPP5 rqDJttwUy/Fr7bbPYVq0bi5iAtCYR6LywZsXT92T1h76nn0W/Ie1q2zgQCodiEtIrLB6 NYz4A75+TjdgIzQlq3snx1FL7H3n5zRJKycjlzTEMPF+eDQNXCz0WITSdXX8A4BejuCz x1Nw== X-Forwarded-Encrypted: i=1; AHgh+RpuUQ2rhrSsJPU8ryax1OA6DNNQbDkU3Pe4lJ9QIBg4X8Ghjc7DP72TZjIC7FLvmfuFRygfy6aEhuPu4Ro=@vger.kernel.org X-Gm-Message-State: AOJu0YxxJS1yYjCb/Fl4kB99lYWpXw4crS5fKphqUaFiomRHZg2GVjl6 J9qesvlrgp3yiW73dofxSf5izHTDcz6sxyE2/5q2PUX2IcY+CVfUzP76 X-Gm-Gg: AfdE7cm8LRVZN/MEAPLeiBUXn+xs+pgjdillRUVXTu8Uc8D1ugDQe6J4WCk1FBINGKf RnoKM6KTr0y485VZg8hPMClekGc/PXn1ri+PJytbuO/xkJIgvGdJApts5LM+UL83X8SryUZ/5Tq qqHKoHKdyVG3qrdSzPboYGZSiWzEGrZvqD9AOj7U2Uf0N1QTH79RQVCjp1TvmGBOZlL56I1uvLZ zYu7U253yx7uRxuI1PaRKO5vWVSXe22YIBV5YUFuIkchRT9Ah7wUtC1L/4kaaD7US+xLoytQMhL oSlXHf9nr6t2SeaLEmXhmQdoaHNN7HIIc+wWhKPdP1skvEa3YJIAIGlC85vnJZKN2yQit394JuB G3NlBzab//RSAzHd8AP9YvAkZpKx9JPXwCoQJxz1uEoyxd4bW6nGKa5kZqvw8aansqzq95DgSwp H99V7QmfBStY12I81J4pi5au+YATkB2mcmqM96QCGEsfS6lpRhfQQkRzFipvmNpMXacM0SHWBmS U/Oz96HyQ== X-Received: by 2002:a05:6214:21e7:b0:8fd:6de3:dd7d with SMTP id 6a1803df08f44-9074c8b3fbdmr17351196d6.63.1784030097559; Tue, 14 Jul 2026 04:54:57 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8ffd80fd492sm185100576d6.34.2026.07.14.04.54.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 04:54:57 -0700 (PDT) From: Michael Bommarito To: David Howells , Jarkko Sakkinen Cc: Andrew Morton , Paul Moore , James Morris , "Serge E . Hallyn" , keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/3] keys: make keyring key-chunk byte order agree with keyring_diff_objects() Date: Tue, 14 Jul 2026 07:54:50 -0400 Message-ID: <20260714115451.3773164-3-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260714115451.3773164-1-michael.bommarito@gmail.com> References: <20260714115451.3773164-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" keyring_get_key_chunk() loads description bytes into the index chunk low address first, while keyring_diff_objects() numbers the first differing bit from the low end and folds the absolute byte index into the level without removing the inline-prefix offset the level already carries. The two disagree on byte order and bit position, so the array can be told two keys first differ at a bit that does not differ in the chunk the walker uses, letting crafted descriptions collide into one node. Load the chunk in the order keyring_diff_objects() assumes and drop the inline-prefix length when folding the byte index into the level. This only changes the in-memory ordering used to place keys within a keyring; add, search and read of non-colliding keys are unaffected. Fixes: f771fde82051 ("keys: Simplify key description management") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Jarkko Sakkinen --- security/keys/keyring.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/security/keys/keyring.c b/security/keys/keyring.c index 1739373172ad5..e7066893e6ffc 100644 --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -292,9 +292,10 @@ static unsigned long keyring_get_key_chunk(const void = *data, int level) desc_len -=3D offset; if (desc_len > n) desc_len =3D n; + d +=3D desc_len; do { chunk <<=3D 8; - chunk |=3D *d++; + chunk |=3D *--d; } while (--desc_len > 0); return chunk; } @@ -375,7 +376,7 @@ static int keyring_diff_objects(const void *object, con= st void *data) return -1; =20 differ_plus_i: - level +=3D i; + level +=3D i - (int)sizeof(a->desc); differ: i =3D level * 8 + __ffs(seg_a ^ seg_b); return i; --=20 2.53.0 From nobody Sat Jul 25 19:28:28 2026 Received: from mail-qv1-f48.google.com (mail-qv1-f48.google.com [209.85.219.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C995D38B7B6 for ; Tue, 14 Jul 2026 11:54:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784030101; cv=none; b=E8nkzQxUwwOrv+ssrlY9ldfB4wKr5oleiVCoFqYl/jb0iMgutOqAE/VvoX4uVKGp1Is/Gn+3f3KTAz/OHsJFSIkyTD6kf2GIBFzs9xrOel8ct55VempLaoUYQaI+60THVCToOAxlb3eNDUP0su2QrUS2zFs0MrsIpFPcqzeHN1Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784030101; c=relaxed/simple; bh=UHv1T3fOghMVYFifd053Xj7nHxiOMCVDbE/j9zIifYE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SRX4h/jAqJrSLwQ2pj/n/LHQDa/AQJZvEmCfNvRlFAItgZNfumegMr4v1WYypBEhRwnnYaoVNf2vsJrrY0vf7cx09WOUljpOoaDM4rtPyGuNIG5IMQrm2glQH0Omz8uXg8C3cdVUz1QXddPXhVee8V5APwiZGnt3EKVuP6bwRgQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=g+KwXu9m; arc=none smtp.client-ip=209.85.219.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="g+KwXu9m" Received: by mail-qv1-f48.google.com with SMTP id 6a1803df08f44-8ef7b7651ecso7279726d6.1 for ; Tue, 14 Jul 2026 04:54:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784030098; x=1784634898; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Vn9mpDo3PjDMuGJGUk3sc9YpQTuMN47dq6Ned6oNhVo=; b=g+KwXu9mLrVue1LvNa/U7KpkwXgik8sQ1yu7xyyUWS5baaMo3+v2qUn2G9L6i4Uehf MMdfnMn7LcDzDONhRoIytX0RMfuyimN1lQ7VA0NT0myW3iViRACxTRCWMSx4RwCBDcGf QAeS9PHT5d6fD79sqzvvyZjxuD9MyXwRoyW84RCpGrVrlJwbriWowBzWt8bDUW79cihS e27uHbZ/2/G/6QoTfxCptX089r3sHiWDmazUpTgbCuhqDcxMwmxaEGg6AjXNbtq3M8Gq V1flFNnqgxZm3ihrFbbYTIyTQiHVtW25sdphOudXUnMrBJTEx3U2zw+5OGU/9Pi+ghIX C9QA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784030098; x=1784634898; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Vn9mpDo3PjDMuGJGUk3sc9YpQTuMN47dq6Ned6oNhVo=; b=PC+f+HcDiw0Z4VM1sRBcDl6yZGl+jSPtJNyzJQGX/v/LnjldjFLoiRVcrbGGxwHyeS 5NavAenUarxJilSRKm2OPPadcJbwCJdSYlUrm+NNSIDgovaGswOkuSpjs9c3dH5LAXNk OcGHNyIspfy4IEpbSH8J4J+nDPwEY5cP/xFFjw8VRd657sj+MLZ5Eq6lqreH1dLSndTj ybEVjvfaq1jZ/m4PZnCDhtYyBua22IHdByABYwSnRMT+IPr5tV3vF5QWm4tFrQipX17v WJF8rQ0uLrClcmTQmKMXdRezax7fcnSxnQVeSXzbgvXznq/iSSUEg2oQFl+4koYWBm3T cBvw== X-Forwarded-Encrypted: i=1; AHgh+Rqx1R+ndLl87/3yMq7HdUCSCf5NdsL3xtGh3yIxGyOb5zkUKwvqUMeYet+g90dIb954PCUin+hmqTPgUPg=@vger.kernel.org X-Gm-Message-State: AOJu0YympaZV3tyVkLglIY4PKxHyENMQ6+/02dQJtZEI+PV8V6hMQ9Cv uFr7FCZJ/d3ulGo6mMuENByrGjiOn25x9vWeZr2Kr4462FmaV95nZITR X-Gm-Gg: AfdE7cl1s+WeGoOa/zysqO1F71wCvJ3hGcDsm84ThsGAwyUamFLfPctE/rhzJZHsJBY NlKqi3MsJciIvQ9nEp0ksHmUHfQVciIy/ByqJI/PPC+OpsTI61bZid3qUmn8vKFYpbNELRTTJcR +pa9VOblTjW6CNUlHKV+jwGPTU8+YFM18rNgJA5kJulC6162lHFZa6sUAGWrsT3yd8A14ll+yQM WDkj38bbJHw5AJiUhNDkKULOXHYYmhoUm2DYGrwy4tXJ6pqoWP1Y8EARN4qKoNapMRqRmhnxrCE U4X+DxDKSy+hynkmK8O863N2th7W7uxj/n4wt0gixviq3+vZDWVXe4DwaAInB42hB+906Zyk2h3 0vchdUpIvu5mX0rQ4oui+TdHJEXH61gvC6RYG1pIgNXUwihilTZN+Ecx756RdmvrSZKFsRsyNz4 W/pSG8rNsYJxpzGnIcwzm4gIcI9JObYx9QQWmRTTvOmq4mfEv2WPaZ8zlwe/hJGeYZ5N4vLsyWi MXoBrG41w== X-Received: by 2002:a05:6214:2583:b0:8fd:6e22:6634 with SMTP id 6a1803df08f44-904172f8cf4mr150704096d6.32.1784030098556; Tue, 14 Jul 2026 04:54:58 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8ffd80fd492sm185100576d6.34.2026.07.14.04.54.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 04:54:58 -0700 (PDT) From: Michael Bommarito To: David Howells , Jarkko Sakkinen Cc: Andrew Morton , Paul Moore , James Morris , "Serge E . Hallyn" , keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 3/3] assoc_array: trim the final shortcut word using the current chunk end Date: Tue, 14 Jul 2026 07:54:51 -0400 Message-ID: <20260714115451.3773164-4-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260714115451.3773164-1-michael.bommarito@gmail.com> References: <20260714115451.3773164-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" assoc_array_walk() masks off the bits past shortcut->skip_to_level in the word that contains skip_to_level, gated on round_up(sc_level, ASSOC_ARRAY_KEY_CHUNK_SIZE) > skip_to_level. That guard is wrong in two opposite ways: - When sc_level is word-aligned (every word after the first) round_up() is a no-op, so the guard is sc_level > skip_to_level and never fires for the word that holds skip_to_level. A shortcut that spans more than one word and ends in the middle of its last word leaves that word untrimmed, and its stale high bits leak into the dissimilarity word and can steer the walk down the wrong descendant. - When sc_level is unaligned (the first word) and skip_to_level sits on the next chunk boundary, sc_level + CHUNK would exceed skip_to_level and fire the trim with shift =3D skip_to_level & CHUNK_MASK =3D=3D 0, which = clears the whole dissimilarity word and makes a differing shortcut compare equal. Use the end of the chunk that contains sc_level instead: skip_to_level < round_down(sc_level, CHUNK) + CHUNK For an aligned sc_level whose word holds skip_to_level this now fires (the first bug); for an unaligned sc_level with skip_to_level on the following boundary it does not, so shift is never 0 when the branch runs and the trim never clears the whole word. Fixes: 3cb989501c26 ("Add a generic associative array implementation.") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Jarkko Sakkinen --- lib/assoc_array.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/assoc_array.c b/lib/assoc_array.c index bcc6e0a013eb8..b6c9723e12ced 100644 --- a/lib/assoc_array.c +++ b/lib/assoc_array.c @@ -255,7 +255,8 @@ assoc_array_walk(const struct assoc_array *array, sc_segments =3D shortcut->index_key[sc_level >> ASSOC_ARRAY_KEY_CHUNK_SH= IFT]; dissimilarity =3D segments ^ sc_segments; =20 - if (round_up(sc_level, ASSOC_ARRAY_KEY_CHUNK_SIZE) > shortcut->skip_to_l= evel) { + if (shortcut->skip_to_level < round_down(sc_level, + ASSOC_ARRAY_KEY_CHUNK_SIZE) + ASSOC_ARRAY_KEY_CHUNK_SIZE) { /* Trim segments that are beyond the shortcut */ int shift =3D shortcut->skip_to_level & ASSOC_ARRAY_KEY_CHUNK_MASK; dissimilarity &=3D ~(ULONG_MAX << shift); --=20 2.53.0