[PATCH v4 2/3] KEYS: Reject descriptions larger than KEY_MAX_DESC_SIZE

Jarkko Sakkinen jarkko at kernel.org
Tue Oct 20 21:16:19 UTC 2026


On Tue, Oct 20, 2026 at 08:43:20PM +0300, Jarkko Sakkinen wrote:

There is only case in key_alloc() where index_key.desc_len is not set:

	desclen = strlen(desc);
	if (desclen >= KEY_MAX_DESC_SIZE)
		goto error;


Other sites match to:

	static int keyring_index_key_set_desc(void *desc, int desclen)
	{
		desclen = strlen(index_key.description);
		if (desclen >= KEY_MAX_DESC_SIZE) {
			return -EINVAL;
		}
		index_key->desc_len = desclen;
	}	

Given how long setter for index key's has been broken at some many sites
and the bug has been buried for so many years, I don't see any good
reason not to make the operation explicit with a wrapper.

In this the size of this patch would also shrink as a result.

Br, Jarkko
 



More information about the Linux-security-module-archive mailing list