From nobody Sat Jul 25 18:01:21 2026 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E9F836F415 for ; Wed, 15 Jul 2026 02:46:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784083605; cv=none; b=qLHFrt1YYCLwT8HOyGWlBwOFdqetRiLud9886fBAytnYk+VkDKL2TBt+0hvb4VWetUH7Sur7AYR3c3IYo0hdZDyl2IrX6xj5sXwIxj1gZrDnfGxmAhIyG9uCZinL6K2a2s57MejtRL7c+/bsJt5nH8XatrLUY0F/SXhsUHaYsto= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784083605; c=relaxed/simple; bh=y95DrYbP/VmjOSUNzUGbzSp38YYbp8UhXE/2Bv6rCrs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EXn6Sx1YgVasKip+ycrBI1gkvpdx40ZELan/oR5zYfpNYkkb8+u26mwJKytazF5kfvZAstT/G7NbMGzVgX0QPnXdS+yM04sSVRzbS9UAXnMbK+eLh3YZjlwN3BxRwFCE7d6kIBJ/xcks7sOezSzjIW30dS8nNaOWIsHC71kVfkg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QpHGXfsl; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QpHGXfsl" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2caf228a910so37336125ad.2 for ; Tue, 14 Jul 2026 19:46:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784083604; x=1784688404; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=IgrBcgsc/jMn8PcArbo69Rr9sOwNc88jPEb6vu9Je+A=; b=QpHGXfslb83Ccc2nR3Soo0LX+Pr5KmLbmE9LZwcfK4rWzMXNGWv4QoVcLKq3ZapsBO shlPznte5Sh6O4F/MMfN9hg5YBEKBIjLQ385vQG7RC+bGscRLdCXUyclOdpzpiiLEUDT OYQLcrpiHChxM18J/g3c1nFV/QJM/OF0fvT8wVEPJkGbFRTy5j2Vi3SCFLfijeAppcpa hfumkkE/SsCFfEgAVgxB490AYYJgabY5pwvNoCd2gmVAOQnev3EqCU2Duqcn09ouiT7r zrV+LczB41Rin5FMr7FhgqYihci7SYdSXQLS81QKltOwvO8GJoNMBY2JyamHobISe5n7 DOzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784083604; x=1784688404; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IgrBcgsc/jMn8PcArbo69Rr9sOwNc88jPEb6vu9Je+A=; b=lY31+VDIHUCv17EV3c7nHIX0IC9NFMFXDxpD4+9riRZ/99RhtX+ZcjPRVJiRotBpKf j0aW9FX5JOdT81U5v0WYhFzd3JWFpjjzo+GygbRJHTekWtCRWur7K8rDuJx86bw/C3sC S6DjTnLF/2Jn9Ju0Ab7F73CJafvDcfFN9iLCEUzOVQ9NxBRUkYsB7va6NcfnHv76k6mD ohEbYeqPUNd78QdDKJQEj/aUlXEyqqCAXZ8DPhMdaFsp6ZPJEGzK9lP4hvxYdm22WRm+ z5sbwCIeWTEvjaMQ67XMOQd1pUPocWPuGixNRuhdQsaSwYADtffHZw5ArEBl4YS5x/cC OHDg== X-Forwarded-Encrypted: i=1; AHgh+RqIyHSaDp5oNOH3Ru7EsJTF5xRGc9A92jN6Fyyd8cerunjlZCcYI7Sz0a0b9QE4R8v3SrRYfzJa4hMN2mQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yzruo3rwzN4Oeol0Pf9EMwli2p9kFjBtf17O2/i6OkDR3WjLPb3 l9DwO7OWKPGu8TNo/6SksaUX7GOmg2J8YlXMKBxAX8P18dCXiNwZ3ncA X-Gm-Gg: AfdE7ckddM+R6AD1hs/ULiuyCse4lEMihGQAJ0jc6wxw4+Tet2VYYOR0+8TOuB+RVPF 8dyAGCFerrATzJW0O0pdT67dbaGEC5bn4RgziXizRHECztuwpqggHl6AEspz4Kw2pwkcJMvrG1i RKkDjDp09wu9PCUAAROolC3Jr/+Hoy39I/kFAka/OL+IbwOIbm3KQALwtLDsVlLA0rJqPdrghwI pVGxh8az714imuxj5v88fJLiAALW5vXffgjPS9IsZvOacrViWiPMV1U1VE974ri+up6tMwpI0R8 7uK6BX2rGBukRIjx5WpLbhSuKAzNSv/XPn4mB4xzX79DLywRNPhyRaofahMRHyQWWPaZYNPwg/s NqtLc+RUA80h1GOJTGpj3rvOVq6ZqXwceSGJQXg7syh1ISlhdtY1sg+W2jOqr5ia76Yy0hY7Qsm cV3YxXNltsC1o6t5UBTeSx4G8pi9nlFwY3uX4= X-Received: by 2002:a17:902:e787:b0:2cc:7c36:2c23 with SMTP id d9443c01a7336-2cf03d6be8amr8405355ad.43.1784083603695; Tue, 14 Jul 2026 19:46:43 -0700 (PDT) Received: from osman.mioffice.cn ([43.224.245.178]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9d1edb0sm124530935ad.53.2026.07.14.19.46.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 19:46:42 -0700 (PDT) From: Zhan Xusheng X-Google-Original-From: Zhan Xusheng To: Paul Moore Cc: Eric Paris , Ricardo Robaina , Richard Guy Briggs , audit@vger.kernel.org, linux-kernel@vger.kernel.org, Zhan Xusheng , stable@vger.kernel.org Subject: [PATCH] audit: fix potential integer overflow in audit_log_n_string() Date: Wed, 15 Jul 2026 10:46:35 +0800 Message-ID: <20260715024635.25376-1-zhanxusheng@xiaomi.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" audit_log_n_string() computes new_len as "slen + 3" (enclosing quotes plus the NUL terminator) and stores it into an int, while slen is a size_t. For a sufficiently large slen the addition can overflow and/or the result be truncated when assigned to the int new_len, so the "new_len > avail" check can be bypassed and the subsequent memcpy(ptr, string, slen) can write past the skb tail. This is the same class of bug that was fixed for the hex sibling in commit 65dfde57d1e2 ("audit: fix potential integer overflow in audit_log_n_hex()"); both helpers are reached through audit_log_n_untrustedstring() with the same length source. Make new_len a size_t and use check_add_overflow() to catch the overflow, mirroring the audit_log_n_hex() fix. No functional change for the in-tree callers, which all pass bounded lengths. Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings") Cc: stable@vger.kernel.org Signed-off-by: Zhan Xusheng --- kernel/audit.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 562476937fa7..547ae0cebec9 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2120,7 +2120,8 @@ void audit_log_n_hex(struct audit_buffer *ab, const u= nsigned char *buf, void audit_log_n_string(struct audit_buffer *ab, const char *string, size_t slen) { - int avail, new_len; + int avail; + size_t new_len; unsigned char *ptr; struct sk_buff *skb; =20 @@ -2130,7 +2131,13 @@ void audit_log_n_string(struct audit_buffer *ab, con= st char *string, BUG_ON(!ab->skb); skb =3D ab->skb; avail =3D skb_tailroom(skb); - new_len =3D slen + 3; /* enclosing quotes + null terminator */ + + /* enclosing quotes + null terminator */ + if (check_add_overflow(slen, (size_t)3, &new_len)) { + audit_log_format(ab, "\"?\""); + return; + } + if (new_len > avail) { avail =3D audit_expand(ab, new_len); if (!avail) --=20 2.43.0