[RFC PATCH 3/8] KEYS: Reject @desclen values over U16_MAX in key_alloc()

[Jarkko Sakkinen <jarkko@kernel.org>]

@desclen in key_alloc() is saved to the 16-bit wide desc_len field in
struct keyring_index_key.

Reject @desclen values over U16_MAX with -EINVAL in order to prevent
integer overflow.

Cc: stable@vger.kernel.org
Assisted-by: LLM
Fixes: f771fde82051 ("keys: Simplify key description management")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
---
 security/keys/key.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/keys/key.c b/security/keys/key.c
index 6ebb8691551f..7888c0c6a772 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -245,6 +245,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 	}
 
 	desclen = strlen(desc);
+	if (desclen > U16_MAX)
+		goto error;
 	quotalen = desclen + 1 + type->def_datalen;
 
 	/* get hold of the key tracking for this user */
-- 
2.47.3