Re: [PATCH v2 1/6] KEYS: Expand key->{datalen,quotalen} to unsigned int

[Jarkko Sakkinen <jarkko@kernel.org>]

On Mon, Oct 19, 2026 at 12:12:48PM -0700, Eric Biggers wrote:
> On Mon, Oct 19, 2026 at 09:17:21PM +0300, Jarkko Sakkinen wrote:
> > In key_alloc() and key_payload_reserve(), key->quotalen and key->datalen
> > can receive values larger than USHRT_MAX.
> 
> Could use an explanation about how this can happen.  A keyring with more
> than 16383 links, I guess?

It is good to sanity check these given the source of origin.

I tried to implement your example and I think I was successful.

Here's what I did:

	keyctl new_session >/dev/null

	owner=$(keyctl newring owner @s)
	keeper=$(keyctl newring keeper @s)

	for ((i=0; i<16384; i++)); do
	  key=$(keyctl add user "k$i" x "$keeper")
	  keyctl link "$key" "$owner"
	done

	awk -v uid="$(id -u):" '$1 == uid {print $NF}' /proc/key-users
	keyctl clear "$owner"
	awk -v uid="$(id -u):" '$1 == uid {print $NF}' /proc/key-users

It is mostly safe from unprivileged user as /proc/sys/kernel/keys/maxkeys
and /proc/sys/kernel/keys/maxbytes are by default set to 200 and 20000.

When I run it as root, this what I get on first run:

252793/25000000
252793/25000000

Second run:

383862/25000000
383862/25000000

And third run for good measure:

514934/25000000
514934/25000000

So yeah, it is right on the uapi surface easily accessible :-)

> 
> - Eric

Br, Jarkko