[PATCH v4 2/3] KEYS: Reject descriptions larger than KEY_MAX_DESC_SIZE
Jarkko Sakkinen
jarkko at kernel.org
Tue Oct 20 21:16:19 UTC 2026
On Tue, Oct 20, 2026 at 08:43:20PM +0300, Jarkko Sakkinen wrote:
There is only case in key_alloc() where index_key.desc_len is not set:
desclen = strlen(desc);
if (desclen >= KEY_MAX_DESC_SIZE)
goto error;
Other sites match to:
static int keyring_index_key_set_desc(void *desc, int desclen)
{
desclen = strlen(index_key.description);
if (desclen >= KEY_MAX_DESC_SIZE) {
return -EINVAL;
}
index_key->desc_len = desclen;
}
Given how long setter for index key's has been broken at some many sites
and the bug has been buried for so many years, I don't see any good
reason not to make the operation explicit with a wrapper.
In this the size of this patch would also shrink as a result.
Br, Jarkko
More information about the Linux-security-module-archive
mailing list