On 2026-06-01 10:09, Ricardo Robaina wrote:
> The function calculates new_len as len << 1 for hex encoding. This
> has two overflow risks: the shift itself can overflow when len is
> large, and the result can be truncated when assigned to new_len
> (declared as int) from the size_t calculation.
>
> Fix by using check_shl_overflow() to catch shift overflow and
> changing new_len and loop counter i to size_t to prevent truncation.
>
> Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
> Signed-off-by: Ricardo Robaina <[email protected]>
Reviewed-by: Richard Guy Briggs <[email protected]>
> ---
> Changes in v2:
> - Use check_shl_overflow() instead of manual overflow check.
>
> kernel/audit.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/audit.c b/kernel/audit.c
> index e1d489bc2dff..8ca268610641 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -62,6 +62,7 @@
> #include <net/ip.h>
> #include <net/ipv6.h>
> #include <linux/sctp.h>
> +#include <linux/overflow.h>
>
> #include "audit.h"
>
> @@ -2076,7 +2077,8 @@ void audit_log_format(struct audit_buffer *ab, const
> char *fmt, ...)
> void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
> size_t len)
> {
> - int i, avail, new_len;
> + int avail;
> + size_t i, new_len;
> unsigned char *ptr;
> struct sk_buff *skb;
>
> @@ -2084,9 +2086,13 @@ void audit_log_n_hex(struct audit_buffer *ab, const
> unsigned char *buf,
> return;
>
> BUG_ON(!ab->skb);
> +
> skb = ab->skb;
> avail = skb_tailroom(skb);
> - new_len = len<<1;
> +
> + if (check_shl_overflow(len, 1, &new_len))
> + return;
> +
> if (new_len >= avail) {
> /* Round the buffer request up to the next multiple */
> new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
> --
> 2.53.0
>
>
- RGB
--
Richard Guy Briggs <[email protected]>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
Upstream IRC: SunRaycer
Voice: +1.613.860 2354 SMS: +1.613.518.6570
