Re: [PATCH net v7 00/11] rxrpc: Fix CHALLENGE packet handling

[David Howells]

David Howells <dhowells@xxxxxxxxxx> wrote:

> 
>  (2) I should probably require READ permission on the key holding the appdata
>      provided by usespace through RXRPC_RESPONSE_APPDATA rather than SEARCH
>      permission to prevent this being used to pull the data out of keys that
>      can't otherwise read directly with keyctl().
> 
> I can fix both of these with follow-up single line fix patches or (2) could
> be fixed in place at the point of application:
> 
> --- a/net/rxrpc/sendmsg.c
> +++ b/net/rxrpc/sendmsg.c
> @@ -640,7 +640,7 @@ static int rxrpc_sendmsg_cmsg(struct msghdr *msg, struct rxrpc_send_params *p)
>  			if (p->call.app_data)
>  				return -EINVAL;
>  			key_id = *(key_serial_t *)CMSG_DATA(cmsg);
> -			key = lookup_user_key(key_id, 0, KEY_NEED_SEARCH);
> +			key = lookup_user_key(key_id, 0, KEY_NEED_READ);
>  			if (IS_ERR(key))
>  				return PTR_ERR(key);
>  			if (key_ref_to_ptr(key)->type != &key_type_user &&

Actually, there's a better way to do this, and that's to check the prefix on
the key description.  See attached patch.

David
---
commit 6d456b373d5c7cf2c1c9f5ead0e563c75e739442
Author: David Howells <dhowells@xxxxxxxxxx>
Date:   Tue Aug 18 14:30:37 2026 +0100

    rxrpc: Fix user appdata key check
    
    The check made by rxrpc_sendmsg_cmsg() for RXRPC_RESPONSE_APPDATA on the
    key it retrieves allows keys to be accessed by generating
    CHALLENGE/RESPONSE exchange.  Currently, any user or logon key can be
    accessed in this manner.  Fix this by restricting the patch description to
    require a prefix of "rxrpc-appdata:".
    
    Fixes: xxxxxxxxxxxx ("rxrpc: Fix CHALLENGE packet overqueuing and simplify RESPONSE generation")
    Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260812110129.979970-6-dhowells@xxxxxxxxxx
    Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
    cc: Marc Dionne <marc.dionne@xxxxxxxxxxxx>
    cc: Jeffrey Altman <jaltman@xxxxxxxxxxxx>
    cc: Eric Dumazet <edumazet@xxxxxxxxxx>
    cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
    cc: Jakub Kicinski <kuba@xxxxxxxxxx>
    cc: Paolo Abeni <pabeni@xxxxxxxxxx>
    cc: Simon Horman <horms@xxxxxxxxxx>
    cc: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
    cc: linux-afs@xxxxxxxxxxxxxxxxxxx
    cc: keyrings@xxxxxxxxxxxxxxx
    cc: stable@xxxxxxxxxx

diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 4755fc76d8f3..eb3dc352684e 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -648,6 +648,13 @@ static int rxrpc_sendmsg_cmsg(struct msghdr *msg, struct rxrpc_send_params *p)
 				key_ref_put(key);
 				return -EINVAL;
 			}
+			if (!key_ref_to_ptr(key)->description ||
+			    strncmp(key_ref_to_ptr(key)->description,
+				    "rxrpc-appdata:", 14) != 0) {
+				key_ref_put(key);
+				return -EINVAL;
+			}
+				
 			p->call.app_data = key_ref_to_ptr(key);
 			break;