Re: [PATCH v3] audit: fix potential integer overflow in audit_log_n_hex()

On Wed, Jul 8, 2026 at 3:22=E2=80=AFPM Paul Moore <[email protected]> wro=
te:
>
> On Jul  2, 2026 Ricardo Robaina <[email protected]> wrote:
> >
> > The function calculates new_len as len << 1 for hex encoding. This
> > has two overflow risks: the shift itself can overflow when len is
> > large, and the result can be truncated when assigned to new_len
> > (declared as int) from the size_t calculation.
> >
> > Fix by using check_shl_overflow() to catch shift overflow and
> > changing new_len and loop counter i to size_t to prevent truncation.
> >
> > Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
> > Reviewed-by: Richard Guy Briggs <[email protected]>
> > Signed-off-by: Ricardo Robaina <[email protected]>
> > ---
> > Changes in v2:
> > - Use check_shl_overflow() instead of manual overflow check.
> > Changes in v3:
> > - Log "?" before returning when overflow detected.
> >
> >  kernel/audit.c | 12 ++++++++++--
> >  1 file changed, 10 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/audit.c b/kernel/audit.c
> > index e1d489bc2dff..52eb3b511bad 100644
> > --- a/kernel/audit.c
> > +++ b/kernel/audit.c
> > @@ -62,6 +62,7 @@
> >  #include <net/ip.h>
> >  #include <net/ipv6.h>
> >  #include <linux/sctp.h>
> > +#include <linux/overflow.h>
> >
> >  #include "audit.h"
> >
> > @@ -2076,7 +2077,8 @@ void audit_log_format(struct audit_buffer *ab, co=
nst char *fmt, ...)
> >  void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf=
,
> >               size_t len)
> >  {
> > -     int i, avail, new_len;
> > +     int avail;
> > +     size_t i, new_len;
> >       unsigned char *ptr;
> >       struct sk_buff *skb;
> >
> > @@ -2084,9 +2086,15 @@ void audit_log_n_hex(struct audit_buffer *ab, co=
nst unsigned char *buf,
> >               return;
> >
> >       BUG_ON(!ab->skb);
> > +
>
> I removed this added vertical whitespace as it wasn't really necessary
> and could potentially impact anyone who wants to backport this patch.
> Otherwise this looks good to me, so I'm going to mark it for stable and
> merge it via audit/stable-7.2.
>
> Thanks!

Thanks, Paul!

>
> >       skb =3D ab->skb;
> >       avail =3D skb_tailroom(skb);
> > -     new_len =3D len<<1;
> > +
> > +     if (check_shl_overflow(len, 1, &new_len)) {
> > +             audit_log_format(ab, "?");
> > +             return;
> > +     }
> > +
> >       if (new_len >=3D avail) {
> >               /* Round the buffer request up to the next multiple */
> >               new_len =3D AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) =
+ 1);
> > --
> > 2.53.0
>
> --
> paul-moore.com
>