Re: [RFC PATCH 1/6] keys: prevent quota overflow and widen quotalen and datalen to 32 bits
flat view
From: Eric Biggers <ebiggers@kernel.org>
Date: 2026-10-17 05:28:46
Also in:
keyrings, linux-cifs, lkml
On Sat, Oct 17, 2026 at 12:52:59AM +0300, Jarkko Sakkinen wrote:
quoted hunk ↗ jump to hunk
@@ -245,6 +245,10 @@ struct key *key_alloc(struct key_type *type, const char *desc, } desclen = strlen(desc); + if (desclen >= INT_MAX || type->def_datalen > INT_MAX - desclen - 1) { + key = ERR_PTR(-EINVAL); + goto error; + } quotalen = desclen + 1 + type->def_datalen;
This should be tightened further to 'desclen > U16_MAX', since desclen is assigned to a u16 later in the function. - Eric