diff options
| author | Cen Zhang <cenzhang@linux.microsoft.com> | 2026-09-12 00:31:16 +0300 |
|---|---|---|
| committer | Jarkko Sakkinen <jarkko@kernel.org> | 2026-09-12 00:43:45 +0300 |
| commit | 8697c431e297eb0d0ab13dda6bc172b48a34f05c (patch) | |
| tree | 6bbcf83c9e805b0f6f2137747f4dc0352b79276f /tools/perf/scripts/python/stackcollapse.py | |
| parent | 114f00d738f15dd8c7318369edcdc53dd6d08763 (diff) | |
| download | linux-next-8697c431e297eb0d0ab13dda6bc172b48a34f05c.tar.gz linux-next-8697c431e297eb0d0ab13dda6bc172b48a34f05c.zip | |
KEYS: encrypted: fix integer overflow of datablob_len
encrypted_key_alloc() stores datablob_len in a u16. It is computed from
multiple string and payload lengths. If the result exceeds U16_MAX, the
assignment truncates the allocation size. KASAN reports a 32760-byte
slab-out-of-bounds write when __ekey_init() copies the master key
description into the undersized buffer.
The total payload length stored in key->datalen is also a u16. Use
check_add_overflow() to reject values that do not fit either destination,
and use kzalloc_flex() for the flexible-array allocation.
Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
Cc: stable@vger.kernel.org
Assisted-by: GitHub-Copilot:claude-opus-4.6
Signed-off-by: Cen Zhang <cenzhang@linux.microsoft.com>
Signed-off-by: Francis Perron <francis@akrites.dev>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Link: https://lore.kernel.org/r/20260909153433.83117-1-cenzhang@linux.microsoft.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions