Re: [PATCH] keys: reject descriptions that exceed the index length

[Jarkko Sakkinen]

On Mon, Aug 24, 2026 at 08:30:04PM +0900, Daehyeon Ko wrote:
> struct keyring_index_key::desc_len is a u16.  User-provided key
> descriptions are limited to 4095 bytes, but a key type preparser can
> generate a longer description when the caller passes NULL.
> 
> The X.509 parser forms a description from the certificate subject and
> twice the raw serial length.  A certificate with a two-byte subject and a
> 32766-byte serial therefore produces a 65536-byte description.  Assigning
> strlen() to desc_len wraps it to zero, after which __key_link_begin() hits:
> 
>     BUG_ON(index_key->desc_len == 0);
> 
> This is reachable through add_key() by an unprivileged user and can panic
> the kernel when oopses are fatal.
> 
> Measure generated descriptions before narrowing the length and reject
> values that cannot be represented.  The boundary input now returns EINVAL,
> while the one-byte-short control still reaches the normal quota check.

This lacks smoking gun type of evidence, and I don't understand why
as it requires an extremely low effort.

If I understood the code correctly, I'd start with a key that I would
craft along the lines of:

    openssl genpkey -algorithm Ed25519 -out key.bin

    openssl req -x509 -key key.bin \
                      -outform DER \
                      -out certificate.bin \
                      -subj "/CN=xx" \
                      -set_serial "0x7f$(head -c 65530 /dev/zero | tr '\0' 'f')"

Then I would simply expect this to crash my system:

    keyctl padd asymmetric %:s @s < certificate.bin

Will this happen? Have not tried it in a VM yet. I just feel a bit
confused that this was not already demontrated in the commit message,
which makes me think that I get something wrong?

BR, Jarkko