[PATCH v3] audit: fix potential integer overflow in audit_log_n_hex()

[PATCH v3] audit: fix potential integer overflow in audit_log_n_hex()

[Ricardo Robaina]

The function calculates new_len as len << 1 for hex encoding. This
has two overflow risks: the shift itself can overflow when len is
large, and the result can be truncated when assigned to new_len
(declared as int) from the size_t calculation.

Fix by using check_shl_overflow() to catch shift overflow and
changing new_len and loop counter i to size_t to prevent truncation.

Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
Changes in v2:
- Use check_shl_overflow() instead of manual overflow check.
Changes in v3:
- Log "?" before returning when overflow detected.

 kernel/audit.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index e1d489bc2dff..52eb3b511bad 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -62,6 +62,7 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <linux/sctp.h>
+#include <linux/overflow.h>
 
 #include "audit.h"
 
@@ -2076,7 +2077,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
 void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
 		size_t len)
 {
-	int i, avail, new_len;
+	int avail;
+	size_t i, new_len;
 	unsigned char *ptr;
 	struct sk_buff *skb;
 
@@ -2084,9 +2086,15 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
 		return;
 
 	BUG_ON(!ab->skb);
+
 	skb = ab->skb;
 	avail = skb_tailroom(skb);
-	new_len = len<<1;
+
+	if (check_shl_overflow(len, 1, &new_len)) {
+		audit_log_format(ab, "?");
+		return;
+	}
+
 	if (new_len >= avail) {
 		/* Round the buffer request up to the next multiple */
 		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
-- 
2.53.0

Re: [PATCH v3] audit: fix potential integer overflow in audit_log_n_hex()

[Paul Moore]

On Jul  2, 2026 Ricardo Robaina <rrobaina@redhat.com> wrote:
> 
> The function calculates new_len as len << 1 for hex encoding. This
> has two overflow risks: the shift itself can overflow when len is
> large, and the result can be truncated when assigned to new_len
> (declared as int) from the size_t calculation.
> 
> Fix by using check_shl_overflow() to catch shift overflow and
> changing new_len and loop counter i to size_t to prevent truncation.
> 
> Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
> Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> ---
> Changes in v2:
> - Use check_shl_overflow() instead of manual overflow check.
> Changes in v3:
> - Log "?" before returning when overflow detected.
> 
>  kernel/audit.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/audit.c b/kernel/audit.c
> index e1d489bc2dff..52eb3b511bad 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -62,6 +62,7 @@
>  #include <net/ip.h>
>  #include <net/ipv6.h>
>  #include <linux/sctp.h>
> +#include <linux/overflow.h>
>  
>  #include "audit.h"
>  
> @@ -2076,7 +2077,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
>  void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
>  		size_t len)
>  {
> -	int i, avail, new_len;
> +	int avail;
> +	size_t i, new_len;
>  	unsigned char *ptr;
>  	struct sk_buff *skb;
>  
> @@ -2084,9 +2086,15 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
>  		return;
>  
>  	BUG_ON(!ab->skb);
> +

I removed this added vertical whitespace as it wasn't really necessary
and could potentially impact anyone who wants to backport this patch.
Otherwise this looks good to me, so I'm going to mark it for stable and
merge it via audit/stable-7.2.

Thanks!

>  	skb = ab->skb;
>  	avail = skb_tailroom(skb);
> -	new_len = len<<1;
> +
> +	if (check_shl_overflow(len, 1, &new_len)) {
> +		audit_log_format(ab, "?");
> +		return;
> +	}
> +
>  	if (new_len >= avail) {
>  		/* Round the buffer request up to the next multiple */
>  		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
> -- 
> 2.53.0

--
paul-moore.com

Re: [PATCH v3] audit: fix potential integer overflow in audit_log_n_hex()

[Ricardo Robaina]

On Wed, Jul 8, 2026 at 3:22 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Jul  2, 2026 Ricardo Robaina <rrobaina@redhat.com> wrote:
> >
> > The function calculates new_len as len << 1 for hex encoding. This
> > has two overflow risks: the shift itself can overflow when len is
> > large, and the result can be truncated when assigned to new_len
> > (declared as int) from the size_t calculation.
> >
> > Fix by using check_shl_overflow() to catch shift overflow and
> > changing new_len and loop counter i to size_t to prevent truncation.
> >
> > Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
> > Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
> > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > ---
> > Changes in v2:
> > - Use check_shl_overflow() instead of manual overflow check.
> > Changes in v3:
> > - Log "?" before returning when overflow detected.
> >
> >  kernel/audit.c | 12 ++++++++++--
> >  1 file changed, 10 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index e1d489bc2dff..52eb3b511bad 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -62,6 +62,7 @@
> >  #include <net/ip.h>
> >  #include <net/ipv6.h>
> >  #include <linux/sctp.h>
> > +#include <linux/overflow.h>
> >
> >  #include "audit.h"
> >
> > @@ -2076,7 +2077,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
> >  void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
> >               size_t len)
> >  {
> > -     int i, avail, new_len;
> > +     int avail;
> > +     size_t i, new_len;
> >       unsigned char *ptr;
> >       struct sk_buff *skb;
> >
> > @@ -2084,9 +2086,15 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
> >               return;
> >
> >       BUG_ON(!ab->skb);
> > +
>
> I removed this added vertical whitespace as it wasn't really necessary
> and could potentially impact anyone who wants to backport this patch.
> Otherwise this looks good to me, so I'm going to mark it for stable and
> merge it via audit/stable-7.2.
>
> Thanks!

Thanks, Paul!

>
> >       skb = ab->skb;
> >       avail = skb_tailroom(skb);
> > -     new_len = len<<1;
> > +
> > +     if (check_shl_overflow(len, 1, &new_len)) {
> > +             audit_log_format(ab, "?");
> > +             return;
> > +     }
> > +
> >       if (new_len >= avail) {
> >               /* Round the buffer request up to the next multiple */
> >               new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
> > --
> > 2.53.0
>
> --
> paul-moore.com
>