[PATCH v2] audit: fix potential integer overflow in audit_log_n_hex()

[PATCH v2] audit: fix potential integer overflow in audit_log_n_hex()

[Ricardo Robaina]

The function calculates new_len as len << 1 for hex encoding. This
has two overflow risks: the shift itself can overflow when len is
large, and the result can be truncated when assigned to new_len
(declared as int) from the size_t calculation.

Fix by using check_shl_overflow() to catch shift overflow and
changing new_len and loop counter i to size_t to prevent truncation.

Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
Changes in v2:
- Use check_shl_overflow() instead of manual overflow check.

 kernel/audit.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index e1d489bc2dff..8ca268610641 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -62,6 +62,7 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <linux/sctp.h>
+#include <linux/overflow.h>
 
 #include "audit.h"
 
@@ -2076,7 +2077,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
 void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
 		size_t len)
 {
-	int i, avail, new_len;
+	int avail;
+	size_t i, new_len;
 	unsigned char *ptr;
 	struct sk_buff *skb;
 
@@ -2084,9 +2086,13 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
 		return;
 
 	BUG_ON(!ab->skb);
+
 	skb = ab->skb;
 	avail = skb_tailroom(skb);
-	new_len = len<<1;
+
+	if (check_shl_overflow(len, 1, &new_len))
+		return;
+
 	if (new_len >= avail) {
 		/* Round the buffer request up to the next multiple */
 		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
-- 
2.53.0

Re: [PATCH v2] audit: fix potential integer overflow in audit_log_n_hex()

[Richard Guy Briggs]

On 2026-06-01 10:09, Ricardo Robaina wrote:
> The function calculates new_len as len << 1 for hex encoding. This
> has two overflow risks: the shift itself can overflow when len is
> large, and the result can be truncated when assigned to new_len
> (declared as int) from the size_t calculation.
> 
> Fix by using check_shl_overflow() to catch shift overflow and
> changing new_len and loop counter i to size_t to prevent truncation.
> 
> Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>

Reviewed-by: Richard Guy Briggs <rgb@redhat.com>

> ---
> Changes in v2:
> - Use check_shl_overflow() instead of manual overflow check.
> 
>  kernel/audit.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/audit.c b/kernel/audit.c
> index e1d489bc2dff..8ca268610641 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -62,6 +62,7 @@
>  #include <net/ip.h>
>  #include <net/ipv6.h>
>  #include <linux/sctp.h>
> +#include <linux/overflow.h>
>  
>  #include "audit.h"
>  
> @@ -2076,7 +2077,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
>  void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
>  		size_t len)
>  {
> -	int i, avail, new_len;
> +	int avail;
> +	size_t i, new_len;
>  	unsigned char *ptr;
>  	struct sk_buff *skb;
>  
> @@ -2084,9 +2086,13 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
>  		return;
>  
>  	BUG_ON(!ab->skb);
> +
>  	skb = ab->skb;
>  	avail = skb_tailroom(skb);
> -	new_len = len<<1;
> +
> +	if (check_shl_overflow(len, 1, &new_len))
> +		return;
> +
>  	if (new_len >= avail) {
>  		/* Round the buffer request up to the next multiple */
>  		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
> -- 
> 2.53.0
> 
> 

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
Upstream IRC: SunRaycer
Voice: +1.613.860 2354 SMS: +1.613.518.6570

Re: [PATCH v2] audit: fix potential integer overflow in audit_log_n_hex()

[Paul Moore]

On Jun  1, 2026 Ricardo Robaina <rrobaina@redhat.com> wrote:
> 
> The function calculates new_len as len << 1 for hex encoding. This
> has two overflow risks: the shift itself can overflow when len is
> large, and the result can be truncated when assigned to new_len
> (declared as int) from the size_t calculation.
> 
> Fix by using check_shl_overflow() to catch shift overflow and
> changing new_len and loop counter i to size_t to prevent truncation.
> 
> Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
> ---
> Changes in v2:
> - Use check_shl_overflow() instead of manual overflow check.
> 
>  kernel/audit.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/audit.c b/kernel/audit.c
> index e1d489bc2dff..8ca268610641 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -62,6 +62,7 @@
>  #include <net/ip.h>
>  #include <net/ipv6.h>
>  #include <linux/sctp.h>
> +#include <linux/overflow.h>
>  
>  #include "audit.h"
>  
> @@ -2076,7 +2077,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
>  void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
>  		size_t len)
>  {
> -	int i, avail, new_len;
> +	int avail;
> +	size_t i, new_len;
>  	unsigned char *ptr;
>  	struct sk_buff *skb;
>  
> @@ -2084,9 +2086,13 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
>  		return;
>  
>  	BUG_ON(!ab->skb);
> +
>  	skb = ab->skb;
>  	avail = skb_tailroom(skb);
> -	new_len = len<<1;
> +
> +	if (check_shl_overflow(len, 1, &new_len))
> +		return;

By returning without logging a value I worry we could end up with an
oddly formatted audit record, e.g. "... A=foo B= C=bar ...".  Instead of
simply returning, should we log a '?' for the value and then return?

>  	if (new_len >= avail) {
>  		/* Round the buffer request up to the next multiple */
>  		new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
> -- 
> 2.53.0

--
paul-moore.com

Re: [PATCH v2] audit: fix potential integer overflow in audit_log_n_hex()

[Ricardo Robaina]

On Tue, Jun 30, 2026 at 4:46 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Jun  1, 2026 Ricardo Robaina <rrobaina@redhat.com> wrote:
> >
> > The function calculates new_len as len << 1 for hex encoding. This
> > has two overflow risks: the shift itself can overflow when len is
> > large, and the result can be truncated when assigned to new_len
> > (declared as int) from the size_t calculation.
> >
> > Fix by using check_shl_overflow() to catch shift overflow and
> > changing new_len and loop counter i to size_t to prevent truncation.
> >
> > Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
> > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
> > ---
> > Changes in v2:
> > - Use check_shl_overflow() instead of manual overflow check.
> >
> >  kernel/audit.c | 10 ++++++++--
> >  1 file changed, 8 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index e1d489bc2dff..8ca268610641 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -62,6 +62,7 @@
> >  #include <net/ip.h>
> >  #include <net/ipv6.h>
> >  #include <linux/sctp.h>
> > +#include <linux/overflow.h>
> >
> >  #include "audit.h"
> >
> > @@ -2076,7 +2077,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
> >  void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
> >               size_t len)
> >  {
> > -     int i, avail, new_len;
> > +     int avail;
> > +     size_t i, new_len;
> >       unsigned char *ptr;
> >       struct sk_buff *skb;
> >
> > @@ -2084,9 +2086,13 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
> >               return;
> >
> >       BUG_ON(!ab->skb);
> > +
> >       skb = ab->skb;
> >       avail = skb_tailroom(skb);
> > -     new_len = len<<1;
> > +
> > +     if (check_shl_overflow(len, 1, &new_len))
> > +             return;
>
> By returning without logging a value I worry we could end up with an
> oddly formatted audit record, e.g. "... A=foo B= C=bar ...".  Instead of
> simply returning, should we log a '?' for the value and then return?
>

It makes sense, Paul. I'll send a new version shortly.

> >       if (new_len >= avail) {
> >               /* Round the buffer request up to the next multiple */
> >               new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
> > --
> > 2.53.0
>
> --
> paul-moore.com
>