Re: [PATCH v2] ecryptfs: validate auth tok payload size

[Adriano Córdova]

El mar, 13 oct 2026 a las 2:00, Tyler Hicks (<code@xxxxxxxxxxx>) escribió:
>
> On 2026-10-04 09:37:55, Adriano Cordova wrote:
> > Validate that a key payload is large enough to hold a struct
> > ecryptfs_auth_tok, and that the password token's
> > session_key_encryption_key_bytes fits within
> > session_key_encryption_key[], before the payload is dereferenced.
>
> Hi Adriano - Thank you for the fixes!
>
> >
> > Cc: <stable@xxxxxxxxxxxxxxx>
> > Reported-by: syzbot+03c68e42ce4b33f7ce9b@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Reported-by: Nguyen Duy Nhat Anh <neganhat@xxxxxxxxx>
> > Tested-by: syzbot+03c68e42ce4b33f7ce9b@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Link: https://syzkaller.appspot.com/bug?extid=03c68e42ce4b33f7ce9b
>
> Change this tag from `Link:` to `Closes:`, please.
>
> > Signed-off-by: Adriano Cordova <adrianox@xxxxxxxxx>
> > ---
> > Changes in v2:
> > - Add Reported-by tag.
> >
> >  fs/ecryptfs/ecryptfs_kernel.h | 6 ++++++
> >  fs/ecryptfs/keystore.c        | 7 +++++++
> >  2 files changed, 13 insertions(+)
> >
> > diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
> > index 58165928ed1e..4315c18ba1cd 100644
> > --- a/fs/ecryptfs/ecryptfs_kernel.h
> > +++ b/fs/ecryptfs/ecryptfs_kernel.h
> > @@ -88,6 +88,9 @@ ecryptfs_get_encrypted_key_payload_data(struct key *key)
> >       if (!payload)
> >               return ERR_PTR(-EKEYREVOKED);
> >
> > +     if (payload->payload_datalen < sizeof(struct ecryptfs_auth_tok))
> > +             return ERR_PTR(-EINVAL);
> > +
>
> This change should be in its own patch with the following Fixes tag:
>
>   Fixes: 1252cc3b232e ("eCryptfs: added support for the encrypted key type")
>
> >       return (struct ecryptfs_auth_tok *)payload->payload_data;
> >  }
> >
> > @@ -124,6 +127,9 @@ ecryptfs_get_key_payload_data(struct key *key)
> >       if (!ukp)
> >               return ERR_PTR(-EKEYREVOKED);
> >
> > +     if (ukp->datalen < sizeof(struct ecryptfs_auth_tok))
> > +             return ERR_PTR(-EINVAL);
> > +
>
> Nguyen Duy Nhat Anh submitted this fix prior to your v1 so it is best if
> I take that initial patch. Please drop this change.
>
> >       return (struct ecryptfs_auth_tok *)ukp->data;
> >  }
> >
> > diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
> > index 51651314b7a6..7f2dbc81fcbc 100644
> > --- a/fs/ecryptfs/keystore.c
> > +++ b/fs/ecryptfs/keystore.c
> > @@ -477,6 +477,13 @@ ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key,
> >               rc = -EINVAL;
> >               goto out;
> >       }
> > +     if ((*auth_tok)->token_type == ECRYPTFS_PASSWORD
> > +         && (*auth_tok)->token.password.session_key_encryption_key_bytes
> > +            > ECRYPTFS_MAX_KEY_BYTES) {
> > +             printk(KERN_ERR "Invalid password auth_tok sKEK size\n");
> > +             rc = -EINVAL;
> > +             goto out;
> > +     }
>
> This change should be in its own patch with the following Fixes tag:
>
>   Fixes: 9c79f34f7ee7 ("eCryptfs: Filename Encryption: Tag 70 packets")
>
> Thanks again!
>
> Tyler
>
> >  out:
> >       return rc;
> >  }
> > --
> > 2.51.0
> >

Hi Tyler, thanks for the review. I will split the changes and send a v2.

Adriano