Re: [PATCH] keys: Check the authorization payload in process keyring searches

[Jarkko Sakkinen]

On Fri, Oct 09, 2026 at 01:52:16PM +0800, Cen Zhang wrote:
> An authorization payload and its saved credentials must remain valid
> while search_process_keyrings_rcu() searches the requestor's keyrings.
> The function validates the authorization key, then separately loads
> payload.data[0] and unconditionally reads rka->cred. Validation does
> not prevent request_key_auth_revoke() from clearing the payload.
> 
> A request-key helper can assume authority and fork a descendant that
> inherits the authorization key. If the descendant misses in its own
> keyrings, it falls back to the saved requestor credentials. Successful
> target instantiation invalidates the authorization key without clearing
> the payload. After the helper exits, UMH_WAIT_PROC returns to the
> requester, which calls complete_request_key() and revokes that key.
> 
> With the descendant paused after validation, the paths can interleave
> as follows:
> 
>   1. The descendant enters search_process_keyrings_rcu() under RCU and
>      key_validate() succeeds.
>   2. The helper instantiates the target, invalidates the authorization
>      key, and exits.
>   3. The requester resumes from UMH_WAIT_PROC, calls
>      complete_request_key(), and revokes the authorization key.
>      request_key_auth_revoke() sets its payload pointer to NULL.
>   4. The descendant loads NULL and dereferences rka->cred.
> 
> This NULL dereference can oops the kernel. RCU delays payload disposal
> but does not prevent the pointer from being cleared.
> 
> Load the payload with dereference_key_rcu() and require a non-NULL
> result before validating the authorization key and searching its saved
> credentials. A non-NULL payload and its credentials remain alive for
> the caller's RCU read-side section; a cleared payload skips the fallback
> search and follows the existing error selection.
> 
> KASAN report as below:
> 
>     Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI
>     KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
>     RIP: 0010:search_process_keyrings_rcu+0x32b/0x790
> 
> Fixes: e59428f721ee ("keys: Move the RCU locks outwards from the keyring search functions")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>
> ---
> 
> diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
> index a63c46bb2d148080add6a194579f7b1093c04d82..76da13fa07fab70115966e9ea8360af66390dd85 100644
> --- a/security/keys/process_keys.c
> +++ b/security/keys/process_keys.c
> @@ -556,9 +556,8 @@ key_ref_t search_process_keyrings_rcu(struct keyring_search_context *ctx)
>  	    ) {
>  		const struct cred *cred = ctx->cred;
>  
> -		if (key_validate(cred->request_key_auth) == 0) {
> -			rka = ctx->cred->request_key_auth->payload.data[0];
> -
> +		rka = dereference_key_rcu(cred->request_key_auth);
> +		if (rka && key_validate(cred->request_key_auth) == 0) {
>  			//// was search_process_keyrings() [ie. recursive]
>  			ctx->cred = rka->cred;
>  			key_ref = search_cred_keyrings_rcu(ctx);

Thanks.


Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>


Br, Jarkko