[PATCH v2 5/6] KEYS: Reject @datalen values over INT_MAX

[Jarkko Sakkinen]

On Tue, Oct 20, 2026 at 12:07:32AM +0300, Jarkko Sakkinen wrote:
> On Mon, Oct 19, 2026 at 12:31:48PM -0700, Eric Biggers wrote:
> > On Mon, Oct 19, 2026 at 09:17:25PM +0300, Jarkko Sakkinen wrote:
> > > Protect quota from overflowing by rejecting @datalen values that
> > > surpass over INT_MAX.
> > 
> > Is there an example of how this can happen, and why the limit needs to
> > still be so large?  add_key() for example limits the payload length to
> > 1 MiB.
> 
> I did a bit scavenging, and to my knowleddge, no. So I would retain
> this as safety measure but would not consider it as a bug fix.

While it is true that add_key() has 1 MiB limit there's also
root quota. That was what I was originally thinking about
now that I scratched my head a bit.

But...

However, it is capped by /proc/sys/kernel/keys/root_maxbytes, 
SYSCTL_INT_MAX already.

So that makes the check this patch adds irrelevant, and thus
it should be dropped.

Phew... At least it is now investigated in-depth enough, I
think.

Br, Jarkko