Re: [PATCH v3] asymmetric_keys: reject trust keys without IDs

[Herbert Xu <herbert@gondor.apana.org.au>]

On Sun, Sep 06, 2026 at 07:01:53PM +0800, Weiming Shi wrote:
> The PKCS#8 parser deliberately leaves the asym_key_ids payload slot
> empty. key_or_keyring_common() unconditionally dereferences that slot
> when a PKCS#8 key is supplied to a key_or_keyring restriction. Both the
> plain and :chain forms reach this branch, allowing an unprivileged caller
> to trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING
> followed by add_key().
> 
>  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000
>  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
>  RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)
>  Call Trace:
>   <TASK>
>   __key_create_or_update (security/keys/key.c:884)
>   key_create_or_update (security/keys/key.c:1021)
>   __do_sys_add_key (security/keys/keyctl.c:134)
>   do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
>   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
>   </TASK>
>  Kernel panic - not syncing: Fatal exception
> 
> Reject an asymmetric restriction key without key IDs. A PKCS#8 private
> key cannot identify the signer of a candidate certificate and is not a
> valid trust anchor.
> 
> Fixes: 3c58b2362ba8 ("KEYS: Implement PKCS#8 RSA Private Key parser [ver #2]")
> Cc: stable@vger.kernel.org
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Link: https://lore.kernel.org/r/20260429181629.110802-2-bestswngs@gmail.com
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
> Changes in v3:
> - Drop the unnecessary find_asymmetric_key() check.
> - Reject a trust key without IDs instead of continuing the chain lookup.
> - Use the PKCS#8 parser commit as the Fixes target.
> 
>  crypto/asymmetric_keys/restrict.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt