[PATCH] platform: cznic: avoid slab-out-of-bounds write on short Turris key reads

[PATCH] platform: cznic: avoid slab-out-of-bounds write on short Turris key reads

[Junyoung Jang]

For 0 < buflen <= PAGE_SIZE, keyctl_read_key() allocates a temporary
kernel buffer of size buflen via kvmalloc() and passes it to the key
type's .read() callback. Only after the callback returns does it check
whether the returned required length exceeds buflen.

turris_signing_key_read() clamps buflen when it exceeds
subtype->public_key_size, but ignores the clamped value and
unconditionally passes subtype->public_key_size (33 or 67 bytes) to
memcpy(). As a result, calling KEYCTL_READ with a smaller non-zero
buffer (e.g., buflen=1) writes past the end of the temporary buffer,
triggering a kernel heap slab-out-of-bounds write.

Per the key_type .read() contract, only copy the public key when the
supplied buffer is large enough to hold it, and always return the
required size.

Fixes: 0b28b7080ef5 ("platform: cznic: Add keyctl helpers for Turris platform")
Signed-off-by: Junyoung Jang <graypanda.inzag@gmail.com>
---
 drivers/platform/cznic/turris-signing-key.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/platform/cznic/turris-signing-key.c b/drivers/platform/cznic/turris-signing-key.c
index 3827178565e2..af414e236de2 100644
--- a/drivers/platform/cznic/turris-signing-key.c
+++ b/drivers/platform/cznic/turris-signing-key.c
@@ -46,12 +46,8 @@ static long turris_signing_key_read(const struct key *key, char *buffer, size_t
 	if (!subtype)
 		return -EIO;
 
-	if (buffer) {
-		if (buflen > subtype->public_key_size)
-			buflen = subtype->public_key_size;
-
+	if (buffer && buflen >= subtype->public_key_size)
 		memcpy(buffer, subtype->get_public_key(key), subtype->public_key_size);
-	}
 
 	return subtype->public_key_size;
 }
-- 
2.43.0

Re: [PATCH] platform: cznic: avoid slab-out-of-bounds write on short Turris key reads

[Marek Behún]

Acked-by: Marek Behún <kabel@kernel.org>

On Tue, Nov 10, 2026 at 06:26:31AM +0900, Junyoung Jang wrote:
> For 0 < buflen <= PAGE_SIZE, keyctl_read_key() allocates a temporary
> kernel buffer of size buflen via kvmalloc() and passes it to the key
> type's .read() callback. Only after the callback returns does it check
> whether the returned required length exceeds buflen.
> 
> turris_signing_key_read() clamps buflen when it exceeds
> subtype->public_key_size, but ignores the clamped value and
> unconditionally passes subtype->public_key_size (33 or 67 bytes) to
> memcpy(). As a result, calling KEYCTL_READ with a smaller non-zero
> buffer (e.g., buflen=1) writes past the end of the temporary buffer,
> triggering a kernel heap slab-out-of-bounds write.
> 
> Per the key_type .read() contract, only copy the public key when the
> supplied buffer is large enough to hold it, and always return the
> required size.
> 
> Fixes: 0b28b7080ef5 ("platform: cznic: Add keyctl helpers for Turris platform")
> Signed-off-by: Junyoung Jang <graypanda.inzag@gmail.com>
> ---
>  drivers/platform/cznic/turris-signing-key.c | 6 +-----
>  1 file changed, 1 insertion(+), 5 deletions(-)
> 
> diff --git a/drivers/platform/cznic/turris-signing-key.c b/drivers/platform/cznic/turris-signing-key.c
> index 3827178565e2..af414e236de2 100644
> --- a/drivers/platform/cznic/turris-signing-key.c
> +++ b/drivers/platform/cznic/turris-signing-key.c
> @@ -46,12 +46,8 @@ static long turris_signing_key_read(const struct key *key, char *buffer, size_t
>  	if (!subtype)
>  		return -EIO;
>  
> -	if (buffer) {
> -		if (buflen > subtype->public_key_size)
> -			buflen = subtype->public_key_size;
> -
> +	if (buffer && buflen >= subtype->public_key_size)
>  		memcpy(buffer, subtype->get_public_key(key), subtype->public_key_size);
> -	}
>  
>  	return subtype->public_key_size;
>  }
> -- 
> 2.43.0