Re: [PATCH] assoc_array: Preserve full words when splitting shortcuts

[Kyle Zeng]

On Tue, Oct 06, 2026 at 03:25:08PM -0700, Andrew Morton wrote:
> On Tue,  6 Oct 2026 15:06:38 -0700 Kyle Zeng <kylebot@xxxxxxxxxx> wrote:
> 
> > assoc_array_insert_mid_shortcut() copies enough index-key words for the
> > new pre-shortcut, then masks off the unused bits in its last word.  If
> > diff is word-aligned, the shift is zero and the mask clears that entire
> > word, even though all of it belongs to the required prefix.  The new
> > shortcut no longer matches the objects behind it, so lookups can fail
> > for both the existing objects and the new one.
> > 
> > For example, inserting a user key with a different description length
> > into a keyring containing enough full-hash collisions can split a
> > shortcut at bit 64 and erase its hash word.  The resulting search
> > failure can also expose the pointer-dependent keyring hash as a KASLR
> > oracle.
> > 
> > Only trim the last word when diff ends inside it.  This mirrors
> > commit bb2ba2d75a2d ("assoc_array: Fix shortcut creation"), which fixed
> > the terminal-node case, and leaves non-word-aligned splits unchanged.
> 
> Thanks.
> 
> When fixing a bug please clearly describe the userspace-visible runtime
> effects of that bug.  Including how-to-hit-it, reproducer, user reports, etc.

Hi Andrew,

Thanks for the response.
As mentioned in the commit message, a search failure can expose the
pointer-dependent keyring hash as a KASLR oracle. As a result, a local
unprivileged user can use this to leak kernel pointer and bypass KASLR.

The reproducer is not attached intentionally but can be shared through
DM.

Best,
Kyle

> 
> > Fixes: 3cb989501c26 ("Add a generic associative array implementation.")
> > Cc: stable@xxxxxxxxxxxxxxx
> 
> Especially when proposing a backport. 
> Documentation/process/stable-kernel-rules.rst provides guidelines.
> 
> > Assisted-by: Codex:gpt-6-astra
> > Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> > ---
> >  lib/assoc_array.c | 8 +++++---
> 
> get_maintainer coverage is poor.  Please use git-show also:
> hp2:/usr/src/mm> git show -s --format="%an <%ae> - %s" 3cb989501c26
> David Howells <dhowells@xxxxxxxxxx> - Add a generic associative array implementation.
> 
> Also, as this affects keyrings, grep -i keyrings MAINTAINERS shows the
> mailing list.