Re: [PATCH] assoc_array: Preserve full words when splitting shortcuts

[Andrew Morton]

On Tue,  6 Oct 2026 15:06:38 -0700 Kyle Zeng <kylebot@xxxxxxxxxx> wrote:

> assoc_array_insert_mid_shortcut() copies enough index-key words for the
> new pre-shortcut, then masks off the unused bits in its last word.  If
> diff is word-aligned, the shift is zero and the mask clears that entire
> word, even though all of it belongs to the required prefix.  The new
> shortcut no longer matches the objects behind it, so lookups can fail
> for both the existing objects and the new one.
> 
> For example, inserting a user key with a different description length
> into a keyring containing enough full-hash collisions can split a
> shortcut at bit 64 and erase its hash word.  The resulting search
> failure can also expose the pointer-dependent keyring hash as a KASLR
> oracle.
> 
> Only trim the last word when diff ends inside it.  This mirrors
> commit bb2ba2d75a2d ("assoc_array: Fix shortcut creation"), which fixed
> the terminal-node case, and leaves non-word-aligned splits unchanged.

Thanks.

When fixing a bug please clearly describe the userspace-visible runtime
effects of that bug.  Including how-to-hit-it, reproducer, user reports, etc.

> Fixes: 3cb989501c26 ("Add a generic associative array implementation.")
> Cc: stable@xxxxxxxxxxxxxxx

Especially when proposing a backport. 
Documentation/process/stable-kernel-rules.rst provides guidelines.

> Assisted-by: Codex:gpt-6-astra
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> ---
>  lib/assoc_array.c | 8 +++++---

get_maintainer coverage is poor.  Please use git-show also:
hp2:/usr/src/mm> git show -s --format="%an <%ae> - %s" 3cb989501c26
David Howells <dhowells@xxxxxxxxxx> - Add a generic associative array implementation.

Also, as this affects keyrings, grep -i keyrings MAINTAINERS shows the
mailing list.