[PATCH v2 4/6] KEYS: Prevent overflow of quota in key_alloc()

[Jarkko Sakkinen]

On Mon, Oct 19, 2026 at 12:25:45PM -0700, Eric Biggers wrote:
> On Mon, Oct 19, 2026 at 09:17:24PM +0300, Jarkko Sakkinen wrote:
> > Check that the calculated quota length does not go over INT_MAX.
> > 
> > Cc: stable at vger.kernel.org
> > Assisted-by: LLM
> > Fixes: 7e047ef5fe2d ("[PATCH] keys: sort out key quota system")
> > Reviewed-by: David Howells <dhowells at redhat.com>
> > Signed-off-by: Jarkko Sakkinen <jarkko at kernel.org>
> 
> Seems this should be merged into patch 3?
> 
> Also is this reachable?  I.e. do any of the key types actually specify
> def_datalen > INT_MAX - KEY_MAX_DESC_SIZE + 1?

This is very good question and my *guess* is that no there is not.

That said, when not treated as a bug fix this patch is a great
safe-guard e.g., to block corraterall effects of some other
bugs.

So yeah, that's I would propose here. Let's not call it a bug fix
but still merge.

> 
> - Eric

Br, Jarkko