mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-28 12:53:14 +01:00
Cen Zhang
8697c431e2
encrypted_key_alloc() stores datablob_len in a u16. It is computed from
multiple string and payload lengths. If the result exceeds U16_MAX, the
assignment truncates the allocation size. KASAN reports a 32760-byte
slab-out-of-bounds write when __ekey_init() copies the master key
description into the undersized buffer.
The total payload length stored in key->datalen is also a u16. Use
check_add_overflow() to reject values that do not fit either destination,
and use kzalloc_flex() for the flexible-array allocation.
Fixes: 7e70cb4978 ("keys: add new key-type encrypted")
Cc: [email protected]
Assisted-by: GitHub-Copilot:claude-opus-4.6
Signed-off-by: Cen Zhang <[email protected]>
Signed-off-by: Francis Perron <[email protected]>
Reviewed-by: Jarkko Sakkinen <[email protected]>
Tested-by: R Nageswara Sastry <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jarkko Sakkinen <[email protected]>