Re: [RFC PATCH 1/6] keys: prevent quota overflow and widen quotalen and datalen to 32 bits

[Jarkko Sakkinen <jarkko@kernel.org>]

On Fri, Oct 16, 2026 at 10:28:44PM -0700, Eric Biggers wrote:
> On Sat, Oct 17, 2026 at 12:52:59AM +0300, Jarkko Sakkinen wrote:
> > @@ -245,6 +245,10 @@ struct key *key_alloc(struct key_type *type, const char *desc,
> >  	}
> >  
> >  	desclen = strlen(desc);
> > +	if (desclen >= INT_MAX || type->def_datalen > INT_MAX - desclen - 1) {
> > +		key = ERR_PTR(-EINVAL);
> > +		goto error;
> > +	}
> >  	quotalen = desclen + 1 + type->def_datalen;
> 
> This should be tightened further to 'desclen > U16_MAX', since desclen
> is assigned to a u16 later in the function.

Thanks for the remark. I think you are right and fits to what I've been
working on today.

Cutting hairs perhaps but I have really hard time to comprehend this as
a scoped bug fix.

Today morning I tried different things and what made sense to me is
instead think the bug scope as three separate integer overflows and and
one truncation bug.

The net result is here already:

https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git/log/?h=keys-rhashtable

I decided that I retain all fixes as part of the series but eagerly
apply and drop them series of course. Split series would be a mess.
And they are any way part of the staircase from "now" to "then".

> 
> - Eric

Br, Jarkko