[RFC PATCH 7/8] KEYS: Reject @datalen values over INT_MAX

[Jarkko Sakkinen]

Protect quota from overflowing by rejecting @datalen values that
surpass over INT_MAX.

Cc: stable at vger.kernel.org
Assisted-by: LLM
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jarkko Sakkinen <jarkko at kernel.org>
---
 security/keys/key.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/security/keys/key.c b/security/keys/key.c
index 5afc16425daf..5718ae7b80e5 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -379,11 +379,16 @@ EXPORT_SYMBOL(key_alloc);
  */
 int key_payload_reserve(struct key *key, size_t datalen)
 {
-	int delta = (int)datalen - key->datalen;
+	int delta;
 	int ret = 0;
 
 	key_check(key);
 
+	if (datalen > INT_MAX)
+		return -EINVAL;
+
+	delta = (int)datalen - key->datalen;
+
 	/* contemplate the quota adjustment */
 	if (delta != 0 && test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
 		unsigned maxbytes = uid_eq(key->user->uid, GLOBAL_ROOT_UID) ?
-- 
2.47.3