* [PATCH v3] KEYS: encrypted: fix integer overflow of datablob_len
@ 2026-09-09 15:34 Cen Zhang
2026-09-09 23:01 ` Jarkko Sakkinen
2026-09-10 4:44 ` R Nageswara Sastry
0 siblings, 2 replies; 4+ messages in thread
From: Cen Zhang @ 2026-09-09 15:34 UTC (permalink / raw)
To: Mimi Zohar
Cc: David Howells, Jarkko Sakkinen, Paul Moore, James Morris,
Serge E. Hallyn, Roberto Sassu, David Safford,
Greg Kroah-Hartman, Kees Cook, Francis Perron, linux-integrity,
keyrings, linux-security-module, linux-kernel, stable,
Akrites SIRT, AutonomousCodeSecurity, tgopinath, kys
encrypted_key_alloc() stores datablob_len in a u16. It is computed from
multiple string and payload lengths. If the result exceeds U16_MAX, the
assignment truncates the allocation size. KASAN reports a 32760-byte
slab-out-of-bounds write when __ekey_init() copies the master key
description into the undersized buffer.
The total payload length stored in key->datalen is also a u16. Use
check_add_overflow() to reject values that do not fit either destination,
and use kzalloc_flex() for the flexible-array allocation.
Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/keyrings/20260826154456.85974-1-blbllhy@gmail.com/
Assisted-by: GitHub-Copilot:claude-opus-4.6
Signed-off-by: Cen Zhang <cenzhang@linux.microsoft.com>
Signed-off-by: Francis Perron <francis@akrites.dev>
---
Changes in v3:
- Describe the bounds using u16 and U16_MAX and simplify the commit
message.
- Include the KASAN-reported write size.
- Remove organization names from the author and sign-off identities.
- Remove the unnecessary off-list discussion note.
- Use cenzhang@linux.microsoft.com.
- No code changes.
security/keys/encrypted-keys/encrypted.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 59cb77b237b3..e07092ea301a 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -19,6 +19,7 @@
#include <linux/parser.h>
#include <linux/string.h>
#include <linux/err.h>
+#include <linux/overflow.h>
#include <keys/user-type.h>
#include <keys/trusted-type.h>
#include <keys/encrypted-type.h>
@@ -579,6 +580,7 @@ static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
{
struct encrypted_key_payload *epayload = NULL;
unsigned short datablob_len;
+ unsigned short payload_totallen;
unsigned short decrypted_datalen;
unsigned short payload_datalen;
unsigned int encrypted_datalen;
@@ -632,16 +634,22 @@ static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
encrypted_datalen = roundup(decrypted_datalen, blksize);
- datablob_len = format_len + 1 + strlen(master_desc) + 1
- + strlen(datalen) + 1 + ivsize + 1 + encrypted_datalen;
+ if (check_add_overflow(format_len + 1 + strlen(master_desc) + 1
+ + strlen(datalen) + 1 + ivsize + 1,
+ encrypted_datalen, &datablob_len))
+ return ERR_PTR(-EINVAL);
+
+ if (check_add_overflow(datablob_len,
+ payload_datalen + HASH_SIZE + 1,
+ &payload_totallen))
+ return ERR_PTR(-EINVAL);
- ret = key_payload_reserve(key, payload_datalen + datablob_len
- + HASH_SIZE + 1);
+ ret = key_payload_reserve(key, payload_totallen);
if (ret < 0)
return ERR_PTR(ret);
- epayload = kzalloc(sizeof(*epayload) + payload_datalen +
- datablob_len + HASH_SIZE + 1, GFP_KERNEL);
+ epayload = kzalloc_flex(*epayload, payload_data, payload_totallen,
+ GFP_KERNEL);
if (!epayload)
return ERR_PTR(-ENOMEM);
base-commit: 893e11787f78e43b534e252249ac3fff4d1333f8
--
2.55.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] KEYS: encrypted: fix integer overflow of datablob_len
2026-09-09 15:34 [PATCH v3] KEYS: encrypted: fix integer overflow of datablob_len Cen Zhang
@ 2026-09-09 23:01 ` Jarkko Sakkinen
2026-09-10 4:44 ` R Nageswara Sastry
1 sibling, 0 replies; 4+ messages in thread
From: Jarkko Sakkinen @ 2026-09-09 23:01 UTC (permalink / raw)
To: Cen Zhang
Cc: Mimi Zohar, David Howells, Paul Moore, James Morris,
Serge E. Hallyn, Roberto Sassu, David Safford,
Greg Kroah-Hartman, Kees Cook, Francis Perron, linux-integrity,
keyrings, linux-security-module, linux-kernel, stable,
Akrites SIRT, AutonomousCodeSecurity, tgopinath, kys
On Wed, Sep 09, 2026 at 11:34:33AM -0400, Cen Zhang wrote:
> encrypted_key_alloc() stores datablob_len in a u16. It is computed from
> multiple string and payload lengths. If the result exceeds U16_MAX, the
> assignment truncates the allocation size. KASAN reports a 32760-byte
> slab-out-of-bounds write when __ekey_init() copies the master key
> description into the undersized buffer.
>
> The total payload length stored in key->datalen is also a u16. Use
> check_add_overflow() to reject values that do not fit either destination,
> and use kzalloc_flex() for the flexible-array allocation.
>
> Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/keyrings/20260826154456.85974-1-blbllhy@gmail.com/
> Assisted-by: GitHub-Copilot:claude-opus-4.6
> Signed-off-by: Cen Zhang <cenzhang@linux.microsoft.com>
> Signed-off-by: Francis Perron <francis@akrites.dev>
> ---
> Changes in v3:
> - Describe the bounds using u16 and U16_MAX and simplify the commit
> message.
> - Include the KASAN-reported write size.
> - Remove organization names from the author and sign-off identities.
> - Remove the unnecessary off-list discussion note.
> - Use cenzhang@linux.microsoft.com.
> - No code changes.
>
> security/keys/encrypted-keys/encrypted.c | 20 ++++++++++++++------
> 1 file changed, 14 insertions(+), 6 deletions(-)
>
> diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
> index 59cb77b237b3..e07092ea301a 100644
> --- a/security/keys/encrypted-keys/encrypted.c
> +++ b/security/keys/encrypted-keys/encrypted.c
> @@ -19,6 +19,7 @@
> #include <linux/parser.h>
> #include <linux/string.h>
> #include <linux/err.h>
> +#include <linux/overflow.h>
> #include <keys/user-type.h>
> #include <keys/trusted-type.h>
> #include <keys/encrypted-type.h>
> @@ -579,6 +580,7 @@ static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
> {
> struct encrypted_key_payload *epayload = NULL;
> unsigned short datablob_len;
> + unsigned short payload_totallen;
> unsigned short decrypted_datalen;
> unsigned short payload_datalen;
> unsigned int encrypted_datalen;
> @@ -632,16 +634,22 @@ static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
>
> encrypted_datalen = roundup(decrypted_datalen, blksize);
>
> - datablob_len = format_len + 1 + strlen(master_desc) + 1
> - + strlen(datalen) + 1 + ivsize + 1 + encrypted_datalen;
> + if (check_add_overflow(format_len + 1 + strlen(master_desc) + 1
> + + strlen(datalen) + 1 + ivsize + 1,
> + encrypted_datalen, &datablob_len))
> + return ERR_PTR(-EINVAL);
> +
> + if (check_add_overflow(datablob_len,
> + payload_datalen + HASH_SIZE + 1,
> + &payload_totallen))
> + return ERR_PTR(-EINVAL);
>
> - ret = key_payload_reserve(key, payload_datalen + datablob_len
> - + HASH_SIZE + 1);
> + ret = key_payload_reserve(key, payload_totallen);
> if (ret < 0)
> return ERR_PTR(ret);
>
> - epayload = kzalloc(sizeof(*epayload) + payload_datalen +
> - datablob_len + HASH_SIZE + 1, GFP_KERNEL);
> + epayload = kzalloc_flex(*epayload, payload_data, payload_totallen,
> + GFP_KERNEL);
> if (!epayload)
> return ERR_PTR(-ENOMEM);
>
>
> base-commit: 893e11787f78e43b534e252249ac3fff4d1333f8
> --
> 2.55.0
Thanks!
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] KEYS: encrypted: fix integer overflow of datablob_len
2026-09-09 15:34 [PATCH v3] KEYS: encrypted: fix integer overflow of datablob_len Cen Zhang
2026-09-09 23:01 ` Jarkko Sakkinen
@ 2026-09-10 4:44 ` R Nageswara Sastry
2026-09-18 1:31 ` Jarkko Sakkinen
1 sibling, 1 reply; 4+ messages in thread
From: R Nageswara Sastry @ 2026-09-10 4:44 UTC (permalink / raw)
To: Cen Zhang, Mimi Zohar
Cc: David Howells, Jarkko Sakkinen, Paul Moore, James Morris,
Serge E. Hallyn, Roberto Sassu, David Safford,
Greg Kroah-Hartman, Kees Cook, Francis Perron, linux-integrity,
keyrings, linux-security-module, linux-kernel, stable,
Akrites SIRT, AutonomousCodeSecurity, tgopinath, kys
On 09.09.2026 9:04 PM, Cen Zhang wrote:
> encrypted_key_alloc() stores datablob_len in a u16. It is computed from
> multiple string and payload lengths. If the result exceeds U16_MAX, the
> assignment truncates the allocation size. KASAN reports a 32760-byte
> slab-out-of-bounds write when __ekey_init() copies the master key
> description into the undersized buffer.
>
> The total payload length stored in key->datalen is also a u16. Use
> check_add_overflow() to reject values that do not fit either destination,
> and use kzalloc_flex() for the flexible-array allocation.
>
> Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/keyrings/20260826154456.85974-1-blbllhy@gmail.com/
> Assisted-by: GitHub-Copilot:claude-opus-4.6
> Signed-off-by: Cen Zhang <cenzhang@linux.microsoft.com>
> Signed-off-by: Francis Perron <francis@akrites.dev>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
System: ppc64le LPAR (IBM POWER), Linux 7.3-rc2
> ---
> Changes in v3:
> - Describe the bounds using u16 and U16_MAX and simplify the commit
> message.
> - Include the KASAN-reported write size.
> - Remove organization names from the author and sign-off identities.
> - Remove the unnecessary off-list discussion note.
> - Use cenzhang@linux.microsoft.com.
> - No code changes.
>
> security/keys/encrypted-keys/encrypted.c | 20 ++++++++++++++------
> 1 file changed, 14 insertions(+), 6 deletions(-)
>
> diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
> index 59cb77b237b3..e07092ea301a 100644
> --- a/security/keys/encrypted-keys/encrypted.c
> +++ b/security/keys/encrypted-keys/encrypted.c
> @@ -19,6 +19,7 @@
> #include <linux/parser.h>
> #include <linux/string.h>
> #include <linux/err.h>
> +#include <linux/overflow.h>
> #include <keys/user-type.h>
> #include <keys/trusted-type.h>
> #include <keys/encrypted-type.h>
> @@ -579,6 +580,7 @@ static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
> {
> struct encrypted_key_payload *epayload = NULL;
> unsigned short datablob_len;
> + unsigned short payload_totallen;
> unsigned short decrypted_datalen;
> unsigned short payload_datalen;
> unsigned int encrypted_datalen;
> @@ -632,16 +634,22 @@ static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
>
> encrypted_datalen = roundup(decrypted_datalen, blksize);
>
> - datablob_len = format_len + 1 + strlen(master_desc) + 1
> - + strlen(datalen) + 1 + ivsize + 1 + encrypted_datalen;
> + if (check_add_overflow(format_len + 1 + strlen(master_desc) + 1
> + + strlen(datalen) + 1 + ivsize + 1,
> + encrypted_datalen, &datablob_len))
> + return ERR_PTR(-EINVAL);
> +
> + if (check_add_overflow(datablob_len,
> + payload_datalen + HASH_SIZE + 1,
> + &payload_totallen))
> + return ERR_PTR(-EINVAL);
>
> - ret = key_payload_reserve(key, payload_datalen + datablob_len
> - + HASH_SIZE + 1);
> + ret = key_payload_reserve(key, payload_totallen);
> if (ret < 0)
> return ERR_PTR(ret);
>
> - epayload = kzalloc(sizeof(*epayload) + payload_datalen +
> - datablob_len + HASH_SIZE + 1, GFP_KERNEL);
> + epayload = kzalloc_flex(*epayload, payload_data, payload_totallen,
> + GFP_KERNEL);
> if (!epayload)
> return ERR_PTR(-ENOMEM);
>
>
> base-commit: 893e11787f78e43b534e252249ac3fff4d1333f8
--
Thanks and Regards
R.Nageswara Sastry
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] KEYS: encrypted: fix integer overflow of datablob_len
2026-09-10 4:44 ` R Nageswara Sastry
@ 2026-09-18 1:31 ` Jarkko Sakkinen
0 siblings, 0 replies; 4+ messages in thread
From: Jarkko Sakkinen @ 2026-09-18 1:31 UTC (permalink / raw)
To: R Nageswara Sastry
Cc: Cen Zhang, Mimi Zohar, David Howells, Paul Moore, James Morris,
Serge E. Hallyn, Roberto Sassu, David Safford,
Greg Kroah-Hartman, Kees Cook, Francis Perron, linux-integrity,
keyrings, linux-security-module, linux-kernel, stable,
Akrites SIRT, AutonomousCodeSecurity, tgopinath, kys
On Thu, Sep 10, 2026 at 10:14:57AM +0530, R Nageswara Sastry wrote:
>
> On 09.09.2026 9:04 PM, Cen Zhang wrote:
> > encrypted_key_alloc() stores datablob_len in a u16. It is computed from
> > multiple string and payload lengths. If the result exceeds U16_MAX, the
> > assignment truncates the allocation size. KASAN reports a 32760-byte
> > slab-out-of-bounds write when __ekey_init() copies the master key
> > description into the undersized buffer.
> >
> > The total payload length stored in key->datalen is also a u16. Use
> > check_add_overflow() to reject values that do not fit either destination,
> > and use kzalloc_flex() for the flexible-array allocation.
> >
> > Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
> > Cc: stable@vger.kernel.org
> > Link: https://lore.kernel.org/keyrings/20260826154456.85974-1-blbllhy@gmail.com/
> > Assisted-by: GitHub-Copilot:claude-opus-4.6
> > Signed-off-by: Cen Zhang <cenzhang@linux.microsoft.com>
> > Signed-off-by: Francis Perron <francis@akrites.dev>
> Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
>
> System: ppc64le LPAR (IBM POWER), Linux 7.3-rc2
> > ---
> > Changes in v3:
> > - Describe the bounds using u16 and U16_MAX and simplify the commit
> > message.
> > - Include the KASAN-reported write size.
> > - Remove organization names from the author and sign-off identities.
> > - Remove the unnecessary off-list discussion note.
> > - Use cenzhang@linux.microsoft.com.
> > - No code changes.
> >
> > security/keys/encrypted-keys/encrypted.c | 20 ++++++++++++++------
> > 1 file changed, 14 insertions(+), 6 deletions(-)
> >
> > diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
> > index 59cb77b237b3..e07092ea301a 100644
> > --- a/security/keys/encrypted-keys/encrypted.c
> > +++ b/security/keys/encrypted-keys/encrypted.c
> > @@ -19,6 +19,7 @@
> > #include <linux/parser.h>
> > #include <linux/string.h>
> > #include <linux/err.h>
> > +#include <linux/overflow.h>
> > #include <keys/user-type.h>
> > #include <keys/trusted-type.h>
> > #include <keys/encrypted-type.h>
> > @@ -579,6 +580,7 @@ static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
> > {
> > struct encrypted_key_payload *epayload = NULL;
> > unsigned short datablob_len;
> > + unsigned short payload_totallen;
> > unsigned short decrypted_datalen;
> > unsigned short payload_datalen;
> > unsigned int encrypted_datalen;
> > @@ -632,16 +634,22 @@ static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
> > encrypted_datalen = roundup(decrypted_datalen, blksize);
> > - datablob_len = format_len + 1 + strlen(master_desc) + 1
> > - + strlen(datalen) + 1 + ivsize + 1 + encrypted_datalen;
> > + if (check_add_overflow(format_len + 1 + strlen(master_desc) + 1
> > + + strlen(datalen) + 1 + ivsize + 1,
> > + encrypted_datalen, &datablob_len))
> > + return ERR_PTR(-EINVAL);
> > +
> > + if (check_add_overflow(datablob_len,
> > + payload_datalen + HASH_SIZE + 1,
> > + &payload_totallen))
> > + return ERR_PTR(-EINVAL);
> > - ret = key_payload_reserve(key, payload_datalen + datablob_len
> > - + HASH_SIZE + 1);
> > + ret = key_payload_reserve(key, payload_totallen);
> > if (ret < 0)
> > return ERR_PTR(ret);
> > - epayload = kzalloc(sizeof(*epayload) + payload_datalen +
> > - datablob_len + HASH_SIZE + 1, GFP_KERNEL);
> > + epayload = kzalloc_flex(*epayload, payload_data, payload_totallen,
> > + GFP_KERNEL);
> > if (!epayload)
> > return ERR_PTR(-ENOMEM);
> >
> > base-commit: 893e11787f78e43b534e252249ac3fff4d1333f8
>
> --
> Thanks and Regards
> R.Nageswara Sastry
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-18 1:31 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-09 15:34 [PATCH v3] KEYS: encrypted: fix integer overflow of datablob_len Cen Zhang
2026-09-09 23:01 ` Jarkko Sakkinen
2026-09-10 4:44 ` R Nageswara Sastry
2026-09-18 1:31 ` Jarkko Sakkinen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®