[PATCH v2 3/6] KEYS: Prevent overflow of user->{qnkeys,qnbytes} in key_alloc()

[Jarkko Sakkinen]

On Mon, Oct 19, 2026 at 11:53:12PM +0300, Jarkko Sakkinen wrote:
> On Mon, Oct 19, 2026 at 12:23:32PM -0700, Eric Biggers wrote:
> > On Mon, Oct 19, 2026 at 09:17:23PM +0300, Jarkko Sakkinen wrote:
> > > Add the missing overflow checks for user->qnkeys and user->qnbytes
> > > in order keep calculations within INT_MAX range, which is the
> > > absolute maximum quota.
> > > 
> > > Cc: stable at vger.kernel.org
> > > Assisted-by: LLM
> > > Fixes: 7e047ef5fe2d ("[PATCH] keys: sort out key quota system")
> > > Reviewed-by: David Howells <dhowells at redhat.com>
> > > Signed-off-by: Jarkko Sakkinen <jarkko at kernel.org>
> > 
> > Don't keyctl_chown_key() and key_payload_reserve() need similar fixes?
> 
> Thanks, I'll investigate.

OK so this is me misleading as my description is missing one important
detail: KEY_ALLOC_QUOTA_OVERRUN bypasses the maxkeys and maxbytes
checks.

This is the exact reason why this fix is needed and commit message
does not properly address that i.e. lacks the actual root cause.

Also:

1. keyctl_chown_key() checks against maxkeys and maxbytes so it 
   is clear.
2. key_payload_reserve() checs against maxbytes.

Br, Jarkko