Re: [PATCH] audit: fix potential integer overflow in audit_log_n_hex()

[Ricardo Robaina]

On Tue, May 26, 2026 at 6:23 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
>
> On May 13, 2026 Ricardo Robaina <rrobaina@xxxxxxxxxx> wrote:
> >
> > The function audit_log_n_hex() calculates new_len as len << 1 to
> > account for hex encoding, where each byte becomes two characters.
> > However, when len is passed as size_t but new_len was declared as
> > int, this could lead to integer overflow for large values of len.
> >
> > Additionally, the bit shift operation itself could overflow if len
> > exceeds SIZE_MAX / 2, leading to incorrect buffer size calculations
> > and potential memory corruption.
> >
> > Fix this by changing new_len and loop counter i from int to size_t
> > to match the len parameter type, preventing signed/unsigned mismatches,
> > and by adding an overflow check before the bit shift operation that
> > calculates len << 1.
> >
> > Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
> > Signed-off-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
> > ---
> >  kernel/audit.c | 10 ++++++++--
> >  1 file changed, 8 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index e1d489bc2dff..32ac50996451 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -2076,7 +2076,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
> >  void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
> >               size_t len)
> >  {
> > -     int i, avail, new_len;
> > +     int avail;
> > +     size_t i, new_len;
> >       unsigned char *ptr;
> >       struct sk_buff *skb;
> >
> > @@ -2084,9 +2085,14 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
> >               return;
> >
> >       BUG_ON(!ab->skb);
> > +
> > +     /* prevent new_len overflow */
> > +     if (len > SIZE_MAX / 2)
> > +             return;
> > +
> >       skb = ab->skb;
> >       avail = skb_tailroom(skb);
> > -     new_len = len<<1;
> > +     new_len = len << 1;
> >       if (new_len >= avail) {
> >               /* Round the buffer request up to the next multiple */
> >               new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
>
> I might suggest using check_shl_overflow() instead, mostly because it
> helps document a shift that could potentially overflow.
>
> --
> paul-moore.com
>

Thanks for reviewing this patch, Paul. Sounds like a good idea, I'll
work on a v2 shortly.

-Ricardo