[PATCH] KEYS: reject descriptions exceeding U16_MAX in __key_create_or_update()

[sashiko-bot at kernel.org]

> struct keyring_index_key stores the key description length in a 16-bit
> field (u16 desc_len), and __key_link_begin() enforces
> BUG_ON(index_key->desc_len == 0).
> 
> While add_key() bounds explicit userspace description strings to
> KEY_MAX_DESC_SIZE (4096), when the userspace description is NULL or
> empty __key_create_or_update() delegates description generation to
> index_key.type->preparse(&prep) on the payload (up to 1 MiB). Key types
> such as "asymmetric" (x509_key_preparse()) construct prep.description
> from the certificate issuer, subject, and hex-encoded serial number,
> which can exceed 65535 bytes.
> 
> __key_create_or_update() then assigns:
> 
>         index_key.desc_len = strlen(index_key.description);
> 
> without checking whether the length fits in u16. When
> strlen(index_key.description) is 65536 (0x10000), index_key.desc_len
> truncates to 0 and immediately triggers BUG_ON(index_key->desc_len == 0)
> in __key_link_begin(). Lengths above 65536 truncate modulo 65536,
> corrupting keyring hash and comparison lengths.
> 
> Reject empty descriptions or descriptions longer than U16_MAX with
> -EINVAL in __key_create_or_update() and key_alloc().
> 
> Fixes: 16feef434017 ("KEYS: Consolidate the concept of an 'index key' for key access")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike at gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919203511.2580732-1-benquike@gmail.com?part=1