[PATCH v2 4/6] KEYS: Prevent overflow of quota in key_alloc()

[Jarkko Sakkinen]

On Mon, Oct 19, 2026 at 11:55:19PM +0300, Jarkko Sakkinen wrote:
> On Mon, Oct 19, 2026 at 12:25:45PM -0700, Eric Biggers wrote:
> > On Mon, Oct 19, 2026 at 09:17:24PM +0300, Jarkko Sakkinen wrote:
> > > Check that the calculated quota length does not go over INT_MAX.
> > > 
> > > Cc: stable at vger.kernel.org
> > > Assisted-by: LLM
> > > Fixes: 7e047ef5fe2d ("[PATCH] keys: sort out key quota system")
> > > Reviewed-by: David Howells <dhowells at redhat.com>
> > > Signed-off-by: Jarkko Sakkinen <jarkko at kernel.org>
> > 
> > Seems this should be merged into patch 3?
> > 
> > Also is this reachable?  I.e. do any of the key types actually specify
> > def_datalen > INT_MAX - KEY_MAX_DESC_SIZE + 1?
> 
> This is very good question and my *guess* is that no there is not.
> 
> That said, when not treated as a bug fix this patch is a great
> safe-guard e.g., to block corraterall effects of some other
> bugs.
> 
> So yeah, that's I would propose here. Let's not call it a bug fix
> but still merge.

Or actually: no let's not do this. I'm making my life only more
difficult.

I think it is totally sane to squash this to patch 3 and it
is reasonable for that fix have this additional safe-guard.

Br, Jarkko