David Howells [off-list ref] wrote:
quoted hunk ↗ jump to hunk
(2) I should probably require READ permission on the key holding the appdata
provided by usespace through RXRPC_RESPONSE_APPDATA rather than SEARCH
permission to prevent this being used to pull the data out of keys that
can't otherwise read directly with keyctl().
I can fix both of these with follow-up single line fix patches or (2) could
be fixed in place at the point of application:
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -640,7 +640,7 @@ static int rxrpc_sendmsg_cmsg(struct msghdr *msg, struct rxrpc_send_params *p)
if (p->call.app_data)
return -EINVAL;
key_id = *(key_serial_t *)CMSG_DATA(cmsg);
- key = lookup_user_key(key_id, 0, KEY_NEED_SEARCH);
+ key = lookup_user_key(key_id, 0, KEY_NEED_READ);
if (IS_ERR(key))
return PTR_ERR(key);
if (key_ref_to_ptr(key)->type != &key_type_user &&
Actually, there's a better way to do this, and that's to check the prefix on
the key description. See attached patch.
David
---
commit 6d456b373d5c7cf2c1c9f5ead0e563c75e739442
Author: David Howells [off-list ref]
Date: Tue Aug 18 14:30:37 2026 +0100
rxrpc: Fix user appdata key check
The check made by rxrpc_sendmsg_cmsg() for RXRPC_RESPONSE_APPDATA on the
key it retrieves allows keys to be accessed by generating
CHALLENGE/RESPONSE exchange. Currently, any user or logon key can be
accessed in this manner. Fix this by restricting the patch description to
require a prefix of "rxrpc-appdata:".
Fixes: xxxxxxxxxxxx ("rxrpc: Fix CHALLENGE packet overqueuing and simplify RESPONSE generation")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260812110129.979970-6-dhowells@redhat.com
Signed-off-by: David Howells [off-list ref]
cc: Marc Dionne [off-list ref]
cc: Jeffrey Altman [off-list ref]
cc: Eric Dumazet [off-list ref]
cc: "David S. Miller" [off-list ref]
cc: Jakub Kicinski [off-list ref]
cc: Paolo Abeni [off-list ref]
cc: Simon Horman [off-list ref]
cc: Jarkko Sakkinen [off-list ref]
cc: linux-afs@lists.infradead.org
cc: keyrings@vger.kernel.org
cc: stable@kernel.org
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 4755fc76d8f3..eb3dc352684e 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -648,6 +648,13 @@ static int rxrpc_sendmsg_cmsg(struct msghdr *msg, struct rxrpc_send_params *p)
key_ref_put(key);
return -EINVAL;
}
+ if (!key_ref_to_ptr(key)->description ||
+ strncmp(key_ref_to_ptr(key)->description,
+ "rxrpc-appdata:", 14) != 0) {
+ key_ref_put(key);
+ return -EINVAL;
+ }
+
p->call.app_data = key_ref_to_ptr(key);
break;