Re: [PATCH v3 1/2] ecryptfs: reject short encrypted key payloads

[Tyler Hicks]

On Fri, 16 Oct 2026 14:06:32 -0300, Adriano Cordova wrote:
> Reject payloads too short to hold a struct ecryptfs_auth_tok,
> as a key created with a non-ecryptfs format is shorter than
> the struct, so the payload gets dereferenced past its end.

Thank you! This has been applied to the next branch of the tyhicks/ecryptfs.git tree.

I made one small change to the first patch's commit message. Instead of
"as a key created with a non-ecryptfs format is shorter than the
struct", I changed it to "as a key created with a non-ecryptfs format
can be shorter than the struct".

You can find a direct link below but please be aware that the commit hash is
unstable and, therefore, the URL may not be valid in the future.

[1/2] ecryptfs: reject short encrypted key payloads
      https://git.kernel.org/tyhicks/ecryptfs/c/00cc31a869e2f635e6455685c91c4c9045c96ebd
[2/2] ecryptfs: bound session_key_encryption_key_bytes in auth tok
      https://git.kernel.org/tyhicks/ecryptfs/c/8f6626bd6594a78f454d02b27b74a580c890cab9

Tyler