From nobody Sat Jul 25 04:30:37 2026 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E262231C91 for ; Sat, 18 Jul 2026 05:09:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784351370; cv=none; b=JrNOHINTIyfT1MLuvl7i682AoQs3hAP0/nvoIiK6lJQan4vwfBjqpasqruj8ZE2g+aVfFltFwHwT7m2SrrR2GWz40RHQCrPraQiMXBGCRiku8dDTJBFSnEnS/0vuU9Fcd3fuqHUyU6yK4T5AbT9H6rdgIP6WuYJmzkq6kr36SGQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784351370; c=relaxed/simple; bh=m0ccft+gceUz3MPTqfWxpwD+GP4/rdsMkv/6QSxi0lI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Adh4zopt4W/scFIWyu8TZGNI85YhFZxkidofLGuLtiUALsWY71EXBYwpL7EK2K4w6NwKE2d0/hUewvkVfgMU7HqB/wzju0H6ZDnPOrm7kiNk2Z4++P7Tia+g7ynkdZ8MzB7pqluJvkWGq4hY+PJ/WAN0uZ6gu4MolVmN18wvrV0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NKn+I1wb; arc=none smtp.client-ip=209.85.210.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NKn+I1wb" Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-84847482584so1855304b3a.0 for ; Fri, 17 Jul 2026 22:09:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784351369; x=1784956169; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GGpAvn9E9sdeBFr4azx3JRFkGov7PU5BobgH3wDuOJg=; b=NKn+I1wbZuA/B9fCidmzfsUEB/JblJf4P1v5WooyeC54yXKFLKRXxnRdVBAXfodph8 SchRMexgUtFgUXfm7FEfV9jXo2mGXKA3sZx6uB8TgKtrGSy+hGq75M0gshAHB3rBivOO 1gXJxO61zCdY4kshgSOhSQ9F5DxFXG1XqYI1rt2oqoaMddMSKRbEQQENj8UbSDZETbi1 XEo2z6jcXxWAE+F8OpTKyuusa7vsu2ZnBQdMclP4QWXZyaDANnIhzyVAx8bMA6z8QoLt Y3rggPYFJ6v+rG1PiEVtogr/EfuUAyQ8192zbnkYwER/4mpm9j1xfnWvHwYXIA480xah /REQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784351369; x=1784956169; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=GGpAvn9E9sdeBFr4azx3JRFkGov7PU5BobgH3wDuOJg=; b=Yn1U1+TTNp7FjbcD4vW2z1NNmDjI4WGFy2bcn64Spi5d3d9p8ZpsM6LUNtPKIxTwgp 6KGmFv+q0iHHqKmtKU7triw2DliHAIAqGKpnOnmL5/mHOYKX5gBKwfmseiKskSruQ39q /bbAqop/HO3e7hffjIS3MfhDLv0PL5hSN/re0nEhQp9upMyea/Ss0b1XI980BiT3eEtR ypFxrzgtKBS1uRvEme7L54TnLCHlMaUoYeRLG1HudOX2rxgS28w8gxj/Q0QTPssl8bY+ QkiAhHFRHZBQrH9n48fiFcnRfA14z7qtIVBmnhxuVZz9CiTp9P2CGmVVwfdwT8JCsqVh 2NLA== X-Forwarded-Encrypted: i=1; AHgh+RobpUFil592dJpecA+W+q/U1HDMgNH8QGM8ewhdCyF6i0AFyl7l9Y0qo9vOZ4k+e7kf5/hHwsei4igELXg=@vger.kernel.org X-Gm-Message-State: AOJu0YzVeL1LJUlb9SqB7U++OuxRJAl11/A7fEDsCR4yRoxMoHlAAhoo r8dZYlrpeeOX2ap4XCD1N2/SDqi9OzcaA+7xyPGyf+YHH68YPKcdbDxD X-Gm-Gg: AfdE7cka3+xidbeHqY9N4zF83QXeX0CzhpZk7hOSbENTtjxKJ85acFvzShk4XHA44qO 4MrA8JwmSz49o25LZdhkf+uuPBFsAV88mKa88X1WnIWg0VtMwLFOuFsKj/3LQoDiUiJKKANwKRq qMBcUIEVacc6tpMMMyWVcH2FV32bCfQ6C34AqlGXDTK4hJp6v+rPfgI/4URGNahXk/4N4L6oLea HO76aIbiyam88hlVGWAntJV+yl5OUxPZUR1PfbcA3dmsgEgMCKCtb/jDUUPWsfHmnuxqrEhMGDR VpLl/SPqzLpPhYWmO6my/Aa80WDHQqNCd5btLzi7PLzxj7TUbRDBQD6Ed0/P75gcCeXsMbGAViO xbqNj3TzopKGa7atdYDbHACDoHDF0KmzEUr17S8Po17K0pZeS0YD5rUSE/7mrgPyYxcsBxwhfwL Q9Z1BmEP37TVwEaA== X-Received: by 2002:a05:6a00:1f14:b0:847:9803:ec6f with SMTP id d2e1a72fcca58-84beb187fc2mr9986170b3a.10.1784351368541; Fri, 17 Jul 2026 22:09:28 -0700 (PDT) Received: from osman.mioffice.cn ([43.224.245.178]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84c2afd07e2sm2205246b3a.61.2026.07.17.22.09.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 22:09:28 -0700 (PDT) From: Zhan Xusheng X-Google-Original-From: Zhan Xusheng To: Paul Moore Cc: Eric Paris , Ricardo Robaina , Richard Guy Briggs , audit@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Zhan Xusheng Subject: [PATCH v2] audit: fix potential integer overflow in audit_log_n_string() Date: Sat, 18 Jul 2026 13:09:22 +0800 Message-ID: <20260718050922.1980425-1-zhanxusheng@xiaomi.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260715024635.25376-1-zhanxusheng@xiaomi.com> References: <20260715024635.25376-1-zhanxusheng@xiaomi.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" audit_log_n_string() computes new_len as "slen + 3" (enclosing quotes plus the NUL terminator) and stores it into an int, while slen is a size_t. For a sufficiently large slen the addition can overflow and/or the result be truncated when assigned to the int new_len, so the "new_len > avail" check can be bypassed and the subsequent memcpy(ptr, string, slen) can write past the skb tail. This is the same class of bug that was fixed for the hex sibling in commit 65dfde57d1e2 ("audit: fix potential integer overflow in audit_log_n_hex()"); both helpers are reached through audit_log_n_untrustedstring() with the same length source. Make new_len a size_t and use check_add_overflow() to catch the overflow, mirroring the audit_log_n_hex() fix. No functional change for the in-tree callers, which all pass bounded lengths. Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings") Cc: stable@vger.kernel.org Signed-off-by: Zhan Xusheng --- v2: - drop the unnecessary (size_t) cast on the constant (Paul Moore) - emit "?" instead of "\"?\"" on overflow, matching audit_log_n_hex() (Paul Moore) kernel/audit.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 562476937fa7..9412af9144bc 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2120,7 +2120,8 @@ void audit_log_n_hex(struct audit_buffer *ab, const u= nsigned char *buf, void audit_log_n_string(struct audit_buffer *ab, const char *string, size_t slen) { - int avail, new_len; + int avail; + size_t new_len; unsigned char *ptr; struct sk_buff *skb; =20 @@ -2130,7 +2131,13 @@ void audit_log_n_string(struct audit_buffer *ab, con= st char *string, BUG_ON(!ab->skb); skb =3D ab->skb; avail =3D skb_tailroom(skb); - new_len =3D slen + 3; /* enclosing quotes + null terminator */ + + /* enclosing quotes + null terminator */ + if (check_add_overflow(slen, 3, &new_len)) { + audit_log_format(ab, "?"); + return; + } + if (new_len > avail) { avail =3D audit_expand(ab, new_len); if (!avail) --=20 2.43.0