This v2 splits the packet parser hardening into three separate fixes as
requested by Tyler Hicks:

  1. pass the actual packet set buffer size into ecryptfs_parse_packet_set()
  2. fix the tag 11 exact-fit size check
  3. reject too-small tag 70 packet bodies before size subtraction

Changes in v2:
- Split the original patch into three independent fixes.
- Dropped the unrelated trailing blank line removal in keystore.c.


Yichong Chen (3):
  ecryptfs: pass packet set buffer size to parser
  ecryptfs: fix tag 11 packet exact-fit size check
  ecryptfs: reject too-small tag 70 packets

 fs/ecryptfs/crypto.c          |  2 +-
 fs/ecryptfs/ecryptfs_kernel.h |  3 ++-
 fs/ecryptfs/keystore.c        | 31 +++++++++++++++++++++++++++----
 3 files changed, 30 insertions(+), 6 deletions(-)

-- 
2.51.0

On Wed, 15 Jul 2026 13:20:03 +0800, Yichong Chen wrote:
> This v2 splits the packet parser hardening into three separate fixes as
> requested by Tyler Hicks:
> 
>   1. pass the actual packet set buffer size into ecryptfs_parse_packet_set()
>   2. fix the tag 11 exact-fit size check
>   3. reject too-small tag 70 packet bodies before size subtraction
> 
> [...]

Thank you! They've been applied to the next branch of the tyhicks/ecryptfs.git tree.

You can find a direct link below but please be aware that the commit hash is
unstable and, therefore, the URL may not be valid in the future.

[1/3] ecryptfs: pass packet set buffer size to parser
      https://git.kernel.org/tyhicks/ecryptfs/c/2602b79c5b3e2f6fce12e38a670f8e3fda4e46a2
[2/3] ecryptfs: fix tag 11 packet exact-fit size check
      https://git.kernel.org/tyhicks/ecryptfs/c/8b2ec0f56f55477f547d332526c9ae2a8fabc0a5
[3/3] ecryptfs: reject too-small tag 70 packets
      https://git.kernel.org/tyhicks/ecryptfs/c/e97bbe1b2bd82ec2ae37ad2e4965b4d3e78bbf7f

Tyler