Re: [PATCH] platform: cznic: avoid slab-out-of-bounds write on short Turris key reads

[Marek Behún]

Acked-by: Marek Behún <kabel@xxxxxxxxxx>

On Tue, Nov 10, 2026 at 06:26:31AM +0900, Junyoung Jang wrote:
> For 0 < buflen <= PAGE_SIZE, keyctl_read_key() allocates a temporary
> kernel buffer of size buflen via kvmalloc() and passes it to the key
> type's .read() callback. Only after the callback returns does it check
> whether the returned required length exceeds buflen.
> 
> turris_signing_key_read() clamps buflen when it exceeds
> subtype->public_key_size, but ignores the clamped value and
> unconditionally passes subtype->public_key_size (33 or 67 bytes) to
> memcpy(). As a result, calling KEYCTL_READ with a smaller non-zero
> buffer (e.g., buflen=1) writes past the end of the temporary buffer,
> triggering a kernel heap slab-out-of-bounds write.
> 
> Per the key_type .read() contract, only copy the public key when the
> supplied buffer is large enough to hold it, and always return the
> required size.
> 
> Fixes: 0b28b7080ef5 ("platform: cznic: Add keyctl helpers for Turris platform")
> Signed-off-by: Junyoung Jang <graypanda.inzag@xxxxxxxxx>
> ---
>  drivers/platform/cznic/turris-signing-key.c | 6 +-----
>  1 file changed, 1 insertion(+), 5 deletions(-)
> 
> diff --git a/drivers/platform/cznic/turris-signing-key.c b/drivers/platform/cznic/turris-signing-key.c
> index 3827178565e2..af414e236de2 100644
> --- a/drivers/platform/cznic/turris-signing-key.c
> +++ b/drivers/platform/cznic/turris-signing-key.c
> @@ -46,12 +46,8 @@ static long turris_signing_key_read(const struct key *key, char *buffer, size_t
>  	if (!subtype)
>  		return -EIO;
>  
> -	if (buffer) {
> -		if (buflen > subtype->public_key_size)
> -			buflen = subtype->public_key_size;
> -
> +	if (buffer && buflen >= subtype->public_key_size)
>  		memcpy(buffer, subtype->get_public_key(key), subtype->public_key_size);
> -	}
>  
>  	return subtype->public_key_size;
>  }
> -- 
> 2.43.0