Re: [PATCH v2] keys: make keyring indexes independent of kernel addresses

[Jarkko Sakkinen <jarkko@kernel.org>]

On Wed, Oct 14, 2026 at 03:43:06PM +0300, Jarkko Sakkinen wrote:
> On Tue, Oct 13, 2026 at 04:12:51PM -0700, Kyle Zeng wrote:
> > KEYCTL_READ returns the serial numbers in a keyring in associative-array
> > traversal order.  The first word of the index is a public, deterministic
> > hash of the type pointer, domain pointer and description.  An unprivileged
> > user can therefore insert keys with known descriptions, predict their
> > order for each possible KASLR slide, and recover the kernel image address.
> > On an x86-64 build with 16 MiB alignment, 45 user keys suffice to
> > distinguish the candidate slides.
> > 
> > Remove the addresses from the whole index, not just its first hash word.
> > Assign each key type and domain a nonzero 64-bit ID and hash those IDs and
> > the description with a once-initialized SipHash key.  Use the full IDs in
> > the later index chunks as well.  Truncating or hashing the IDs there would
> > lose the guarantee that distinct type/domain/description tuples have a
> > differing index bit.
> > 
> > Allocate IDs lazily since private key types need not be registered.  Cache
> > them in the index key so tree walks and copies of an existing index do not
> > need to dereference a type descriptor that may have been unregistered.
> > Keep the 32-bit chunk layout and diff_objects() bit offsets consistent,
> > and retain the separate root slot for keyrings used by recursive search.
> > The key comparison, permissions and userspace data format are unchanged;
> > only the address-dependent in-memory ordering is replaced.
> > 
> > Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring")
> > Assisted-by: Codex:gpt-6-astra
> > Signed-off-by: Kyle Zeng <kylebot@openai.com>
> 
> 
> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> 
> I'll apply this.

Now I did it, and your patch is now in my master branch (not yet -next,
will get there). Thank you.

It took a while because kunit test for assoc-array took almost the whole
day [1] (mainly figuring out test data that is not too much pain
to recap later on that replaced lottery I originally had).

[1] https://lore.kernel.org/keyrings/20261014160144.1835860-1-jarkko@kernel.org/T/#u

Br, Jarkko