From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f171.google.com (mail-qk1-f171.google.com [209.85.222.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20E0039F18A for ; Sun, 19 Jul 2026 16:15:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784477723; cv=none; b=kaoy/6/QMTo5zNA/8mh3pxhz/V7LK6urSTlKLbCS4Af/xXL+swl+Q3thx0/PPGRwY/xi2gTKKTv9StdJnIjEX8yat0mGbg0n7S7z/eQ1WFavYTf8lW7ttKPmOsHrBb+7x0JnDmUL+tqqHYqykZ4vfN950en51v1ohOFV4zA3DJc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784477723; c=relaxed/simple; bh=sLM500yHckZI96gdaqrzAndkSOc2GG8Oew7rzW2iE4w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=J5guRrYL2PvAGtLNdBq29wGdGbDsi2XTTKjTY9gU5uGa53WqUP550zxkEtqpjGkYM6Z3f33WUWSap+OvQPBd6W5cFncj5stv21F5wOboOErlZR5SlSsCwjibmcBam4Z8oPkB+6I+xH+PcDT0kRWknAWcBW3tfECUrDF4JFmhQlA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Xvi+f0tx; arc=none smtp.client-ip=209.85.222.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Xvi+f0tx" Received: by mail-qk1-f171.google.com with SMTP id af79cd13be357-92e4fd65b2bso477687185a.0 for ; Sun, 19 Jul 2026 09:15:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784477721; x=1785082521; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KmGHK7gXD3QQ+rsXKqEFIuK8Q+UTYgnfH59paMrURE4=; b=Xvi+f0txlDc5DzDpvfzXZM2GfMmfNeFC4ziDGcnF6/wmYc3+ZriVkf4BDA5YKIMhUN COA0Mxn+QHkCym6Qz6XC4/o3AXMw/okLcNgUFfVylcFqbzKdQtU+ajfnsMge23sBwLgJ is7o+bUEf88J+RB0qvf91mV0RTO8DYespPcWpPjsIqb/ZLjkL3kS31HOaLtYlUrg0c8B ESp1mgE9k/ddxvWScAYrKqVaEllUzVx3i6YdvS1W4v8Z769lbIhi8XhMkjLOx1lBuLj5 vYLLiugSZkORscB2icocFl1CPEi1Z9nsZbOCW2fZ4/BJppj8ruasAfYysQxNDNxZPxv3 elvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784477721; x=1785082521; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=KmGHK7gXD3QQ+rsXKqEFIuK8Q+UTYgnfH59paMrURE4=; b=OIlLMcRZ4ipyDw9+jQ8NObJnrT7dZYbRuEZboK2b3Cn3dS/2TKR2e+WUB/FgiFDVJz FWj9d1VjnNbQlm0GxQxmOq2hF/g+oIHLbZ2oFhTCdtKTW4D1YHKqlHr/aQAtbh6zKK8G hzgLoQlI6+cXdb3VG6qgrfA/+aNxqx6E9Ipn70v+PRRCP4cDfgcnd8XidPy8fXJASGOh x9RD8lbG0oPeNdouk7Xnuvp2JFlN680+Rp4AJdPZ/v9RAByqG+VhfRg9nW1eUwJu2bwq kHXMXcgA6FFDqCcM7qx+EBbh005QblD8TyDKJk0PM0xJsPOC74+f2Ma7Xp/iivcr8zYF I24A== X-Forwarded-Encrypted: i=1; AHgh+RqdsHrqRpnnG5YCm66pAR2iB5LSI9Ff7HUaRAwWEdSsoYikUQ0ZrnIuR+3gACfF8HvkidJ4qhGH722TdXQ=@vger.kernel.org X-Gm-Message-State: AOJu0Ywot6VqAxSEYc9n+1a2gTMyqs+DER+kuFHMgUyHcLqGJoZSX38d JysfVumL7VHHosMbm3jFCAV2asNLxDbdNhuZI9Buj4rrphoVc4NU5yIH X-Gm-Gg: AfdE7cngLp9bMHDjUYrzEIPPrUPnxiKygAVv+hDzDWReUdZWIXdGRM56TaPriX7MOIS MaIkeJ0eZzhD3opPZFSCONIoP7i91Lb+suulS1KMCE+UbVXWcVG1CnZ6M3EBwOC7SnAeYqtb1iP Y91C8DJhGQ2kYabju01jbUX5cZDYC+YrIHQbDH/xx6TMnhzjC2GkUvhUEPERuR1fb1Un9Tj18jB dDIfv0Nzz1NRgVM3VqdTpBeaEtv2uxci7t3Ifnwrihr6+W7uekaG5mZFmjbokpVrsdXdNidj97R SX1I/4Jyxlhpa3ZgsiPWovBy+6jjleyHteUrC1okP6df5u4eL2pNqBKkgUtEfoMCEMvwm66rFCV 5VHeCt4mgI1Iq1BOq7Tc7KsR7z5imDAoZffRVgoMJCWlV/cUkyrrITaeiiOTLBmwfyQw6VMDgGw xbhuc2vEa3wFN9PvwDJq4pw9/ys8heX/WW3TqSUgpewPix5wlEjxus9yY5M4wXavx9fyWVmq7iY yQw0+6FfryRAePRFhgZ/w== X-Received: by 2002:a05:620a:19a2:b0:92b:6805:919a with SMTP id af79cd13be357-930b4353319mr1036758785a.66.1784477720740; Sun, 19 Jul 2026 09:15:20 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-930b52fe271sm672374185a.16.2026.07.19.09.15.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 19 Jul 2026 09:15:20 -0700 (PDT) From: Michael Bommarito To: David Howells , Jarkko Sakkinen Cc: Andrew Morton , Paul Moore , James Morris , "Serge E . Hallyn" , keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 3/3] assoc_array: trim the final shortcut word using the current chunk end Date: Sun, 19 Jul 2026 12:15:05 -0400 Message-ID: <20260719161505.2423935-4-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260719161505.2423935-1-michael.bommarito@gmail.com> References: <20260719161505.2423935-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit assoc_array_walk() masks off the bits past shortcut->skip_to_level in the word that contains skip_to_level, gated on round_up(sc_level, ASSOC_ARRAY_KEY_CHUNK_SIZE) > skip_to_level. That guard is wrong in two opposite ways: - When sc_level is word-aligned (every word after the first) round_up() is a no-op, so the guard is sc_level > skip_to_level and never fires for the word that holds skip_to_level. A shortcut that spans more than one word and ends in the middle of its last word leaves that word untrimmed, and its stale high bits leak into the dissimilarity word and can steer the walk down the wrong descendant. - When sc_level is unaligned (the first word) and skip_to_level sits on the next chunk boundary, sc_level + CHUNK would exceed skip_to_level and fire the trim with shift = skip_to_level & CHUNK_MASK == 0, which clears the whole dissimilarity word and makes a differing shortcut compare equal. Use the end of the chunk that contains sc_level instead: skip_to_level < round_down(sc_level, CHUNK) + CHUNK For an aligned sc_level whose word holds skip_to_level this now fires (the first bug); for an unaligned sc_level with skip_to_level on the following boundary it does not, so shift is never 0 when the branch runs and the trim never clears the whole word. Fixes: 3cb989501c26 ("Add a generic associative array implementation.") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Jarkko Sakkinen --- lib/assoc_array.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/assoc_array.c b/lib/assoc_array.c index bcc6e0a013eb8..b6c9723e12ced 100644 --- a/lib/assoc_array.c +++ b/lib/assoc_array.c @@ -255,7 +255,8 @@ assoc_array_walk(const struct assoc_array *array, sc_segments = shortcut->index_key[sc_level >> ASSOC_ARRAY_KEY_CHUNK_SHIFT]; dissimilarity = segments ^ sc_segments; - if (round_up(sc_level, ASSOC_ARRAY_KEY_CHUNK_SIZE) > shortcut->skip_to_level) { + if (shortcut->skip_to_level < round_down(sc_level, + ASSOC_ARRAY_KEY_CHUNK_SIZE) + ASSOC_ARRAY_KEY_CHUNK_SIZE) { /* Trim segments that are beyond the shortcut */ int shift = shortcut->skip_to_level & ASSOC_ARRAY_KEY_CHUNK_MASK; dissimilarity &= ~(ULONG_MAX << shift); -- 2.53.0