[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20251007185220.234611-2-thorsten.blum@linux.dev>
Date: Tue, 7 Oct 2025 20:52:20 +0200
From: Thorsten Blum <thorsten.blum@...ux.dev>
To: David Howells <dhowells@...hat.com>,
Lukas Wunner <lukas@...ner.de>,
Ignat Korchagin <ignat@...udflare.com>,
Herbert Xu <herbert@...dor.apana.org.au>,
"David S. Miller" <davem@...emloft.net>
Cc: Thorsten Blum <thorsten.blum@...ux.dev>,
keyrings@...r.kernel.org,
linux-crypto@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: [PATCH 1/2] crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
Use size_add() to prevent a potential integer overflow when adding the
binary blob lengths in asymmetric_key_generate_id(), which could cause a
buffer overflow when copying the data using memcpy().
Use struct_size() to calculate the number of bytes to allocate for the
new asymmetric key id.
No functional changes.
Signed-off-by: Thorsten Blum <thorsten.blum@...ux.dev>
---
crypto/asymmetric_keys/asymmetric_type.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index ba2d9d1ea235..aea925c88973 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -11,6 +11,7 @@
#include <crypto/public_key.h>
#include <linux/seq_file.h>
#include <linux/module.h>
+#include <linux/overflow.h>
#include <linux/slab.h>
#include <linux/ctype.h>
#include <keys/system_keyring.h>
@@ -141,12 +142,13 @@ struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1,
size_t len_2)
{
struct asymmetric_key_id *kid;
+ size_t len;
- kid = kmalloc(sizeof(struct asymmetric_key_id) + len_1 + len_2,
- GFP_KERNEL);
+ len = size_add(len_1, len_2);
+ kid = kmalloc(struct_size(kid, data, len), GFP_KERNEL);
if (!kid)
return ERR_PTR(-ENOMEM);
- kid->len = len_1 + len_2;
+ kid->len = len;
memcpy(kid->data, val_1, len_1);
memcpy(kid->data + len_1, val_2, len_2);
return kid;
--
2.51.0
Powered by blists - more mailing lists