From nobody Sat Jul 25 18:03:21 2026 Received: from smtpbg150.qq.com (smtpbg150.qq.com [18.132.163.193]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 573D43B52FA; Wed, 15 Jul 2026 05:21:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=18.132.163.193 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784092877; cv=none; b=jtsmwsoZ00KnF9bRS5xFMf4tdHRe42mC24x6CK37fODFyy2QHr+PCXbGDxBJk3za/lIN3nHzbyqiVf6i5fcs/7cE4bA+sCPhQvw8Z6MwCFARptz3r8UP8YoKvqm3Cz+rOKjMUeCdzlX1ymHAdedd+oIIlD/XcFam0qoAuuvmuzc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784092877; c=relaxed/simple; bh=UskOnhAJ3PJfX8vaF7y/hm6wQQhhAkrHP607HMIk2DU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ARRL4C6zIgPF9zvuY7BccIZldFqU1gnEOzBjhA09Kq8Zn7YKdUK9GrWOqr83UT0uKxE9fzM2+etYLAeb256F25ajA7/HPbOznpHIGh4/Xl2IT8fWeu5wRt+7VphHyBSbW2b2CsVcOdeqe7JhGKEbBBjBBmp5c+XNImdLX/LD13s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=A6gKR5O2; arc=none smtp.client-ip=18.132.163.193 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="A6gKR5O2" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1784092834; bh=X3rlK1OH4GMTJFOVgoo19DChU6gJsQrW+yP6jj7cu/A=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=A6gKR5O2qT5nHeRzG/h/gj9ydxh7JoOB5rnIu6em87A1O68dODLEsCBbriZAFwzj9 k/8YtVw1ddxQmp4OVJ8gDTy8kTxf0crWVGXcx2R9dKk+D4HjinvWJnrlE+IwY/lFAs mkOyL1dp1OFMYMiqVLFfCTPrH3jDUVnNB9L+sPC0= X-QQ-mid: esmtpsz16t1784092815t67c72903 X-QQ-Originating-IP: F0KctZUHAvhagG6uEuuhs73hGZjgQDOB+EqBDAMm7eo= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Wed, 15 Jul 2026 13:20:12 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 16544311245530067291 EX-QQ-RecipientCnt: 9 From: Yichong Chen To: ecryptfs@vger.kernel.org Cc: Tyler Hicks , Thorsten Blum , Christian Brauner , Eric Biggers , Kees Cook , Andrew Morton , linux-kernel@vger.kernel.org, Yichong Chen Subject: [PATCH v2 1/3] ecryptfs: pass packet set buffer size to parser Date: Wed, 15 Jul 2026 13:20:04 +0800 Message-Id: <6ebc85d160ace730618d7998933d3676860480ee.1784081896.git.chenyichong@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: esmtpsz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: MGdqTfTgRENC/hJBj0t4oTIRZM82xs8Pix97N0aJ9P0tu7/bwfgaj/L0 Pd5kOfa//4fK67wni1kCf8qlF74aIBuUX0TQ7YndxXjMbsWtmBpSWztyDaSRvMBz54LiElA Wz9f0VG+kvtInZvQsIxD27FqR5kNRgO0UKObZo1BcsH0TI2rrII6LmezpvGfdVJtMM2D4GC 020B4/YzZDiAy11hrKm4Nbq/O4svwL4W6/2SyUxQ1B5f7zucXDItU3hgCA682eEMZaL4Mqc 833I78mDBDzbgNJsOnbeKCh+qv9gRFMPNE5P52mnRDbrvF3TL04Puw+wu2jH1r9+7fNOC9q XPgb5luPNb6BWIMRVEifnEtM5jJ46gDqOB4WiJflwx34/8woTSadk1nZr9mnnXI1JZW3NRr xfxSumvHZebgEfOlZvswKzcUvvtUBu6oye6QXXIRHWlxj4kgLIrsNWQTEgsejCCBw7ovjQD QTx0Anjqt74jUrsxSK5+ni2bGyj9JbaMp6nXV5qcIUfpUS1UdQZTXLw17cMQVi56xlqCLus pG3/A7AQYJlw87yAqfyMdIWXveYCR7/gBgTZTW2zLKi9tSsECLzab3rOXoe6jnUeJ9cnkPD /iX78lApZl+5Z/wD0intG+IZKn6DjZfYJLwVYI+UL0RLsI9AA6bx2tYTGp/XP4XErmjj6UN TZa4gJmX+TOraO8M8MTb9tc+AyGNcOdTpSbuhXLpSf1LBZsnho34gR9JjZhtOoiLrmMHTMa b8K6Y8x4EMwf/Zl++RNhwd5LyDdzwk5jhlEt6k5P1tMilQ9T09fq74Cc1k7QLgMlSk4s//A LQFuuo/IvhPrhprblzOtruQ3NOUDuNEO10spvr+/98lTHgudQMq6Kr8uG02A5jaAXphRzCa vkVUfjrBfrQsWrRNmOiGtNQ1S8hWcdbGfkYAT1TAytnuXUy8+JB3G9f7KwwnjSdkvkhFtrS iS5mtTSFDXR7E3Ga2w+lZO1srp3sScLOck6sRvrqjUpLjaWRcDsqXoGimcBaziU+iHyfTZL FJ+3dyJ0/WIed5RfWjJDnxUMu+wZ1NNoPkpG55dvDtdxm2tLwO X-QQ-XMRINFO: NS+P29fieYNwqS3WCnRCOn9D1NpZuCnCRA== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" ecryptfs_parse_packet_set() receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE_SIZE - 8. For version 1 headers the packet set starts later in the header, so this can overstate the available buffer. Pass the actual packet set buffer length from the caller and calculate per-packet limits from the remaining bytes in that buffer. Recompute the remaining length after consuming a tag 3 packet before parsing the following tag 11 packet. Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig") Signed-off-by: Yichong Chen --- fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 ++- fs/ecryptfs/keystore.c | 23 ++++++++++++++++++++--- 3 files changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c index 74b02b5..e67119b 100644 --- a/fs/ecryptfs/crypto.c +++ b/fs/ecryptfs/crypto.c @@ -1197,7 +1197,7 @@ static int ecryptfs_read_headers_virt(char *page_virt, } else set_default_header_data(crypt_stat); rc =3D ecryptfs_parse_packet_set(crypt_stat, (page_virt + offset), - ecryptfs_dentry); + PAGE_SIZE - offset, ecryptfs_dentry); out: return rc; } diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h index f4f56a9..7d2488a 100644 --- a/fs/ecryptfs/ecryptfs_kernel.h +++ b/fs/ecryptfs/ecryptfs_kernel.h @@ -580,7 +580,8 @@ int ecryptfs_generate_key_packet_set(char *dest_base, size_t *len, size_t max); int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat, - unsigned char *src, struct dentry *ecryptfs_dentry); + unsigned char *src, size_t src_size, + struct dentry *ecryptfs_dentry); int ecryptfs_truncate(struct dentry *dentry, loff_t new_length); ssize_t ecryptfs_getxattr_lower(struct dentry *lower_dentry, struct inode *lower_i= node, diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c index ebebc95..90c2b80 100644 --- a/fs/ecryptfs/keystore.c +++ b/fs/ecryptfs/keystore.c @@ -1704,6 +1704,7 @@ out: * ecryptfs_parse_packet_set * @crypt_stat: The cryptographic context * @src: Virtual address of region of memory containing the packets + * @src_size: Size of the packet set buffer * @ecryptfs_dentry: The eCryptfs dentry associated with the packet set * * Get crypt_stat to have the file's session key if the requisite key @@ -1714,7 +1715,7 @@ out: * conditions. */ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat, - unsigned char *src, + unsigned char *src, size_t src_size, struct dentry *ecryptfs_dentry) { size_t i =3D 0; @@ -1736,7 +1737,11 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_= stat *crypt_stat, * added the our &auth_tok_list */ next_packet_is_auth_tok_packet =3D 1; while (next_packet_is_auth_tok_packet) { - size_t max_packet_size =3D ((PAGE_SIZE - 8) - i); + size_t max_packet_size; + + if (i >=3D src_size) + break; + max_packet_size =3D src_size - i; =20 switch (src[i]) { case ECRYPTFS_TAG_3_PACKET_TYPE: @@ -1751,12 +1756,16 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt= _stat *crypt_stat, goto out_wipe_list; } i +=3D packet_size; + if (i > src_size) { + rc =3D -EIO; + goto out_wipe_list; + } rc =3D parse_tag_11_packet((unsigned char *)&src[i], sig_tmp_space, ECRYPTFS_SIG_SIZE, &tag_11_contents_size, &tag_11_packet_size, - max_packet_size); + src_size - i); if (rc) { ecryptfs_printk(KERN_ERR, "No valid " "(ecryptfs-specific) literal " @@ -1768,6 +1777,10 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_= stat *crypt_stat, goto out_wipe_list; } i +=3D tag_11_packet_size; + if (i > src_size) { + rc =3D -EIO; + goto out_wipe_list; + } if (ECRYPTFS_SIG_SIZE !=3D tag_11_contents_size) { ecryptfs_printk(KERN_ERR, "Expected " "signature of size [%d]; " @@ -1793,6 +1806,10 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_= stat *crypt_stat, goto out_wipe_list; } i +=3D packet_size; + if (i > src_size) { + rc =3D -EIO; + goto out_wipe_list; + } crypt_stat->flags |=3D ECRYPTFS_ENCRYPTED; break; case ECRYPTFS_TAG_11_PACKET_TYPE: --=20 2.51.0 From nobody Sat Jul 25 18:03:21 2026 Received: from smtpbgeu2.qq.com (smtpbgeu2.qq.com [18.194.254.142]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C7CA93B5839; Wed, 15 Jul 2026 05:21:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=18.194.254.142 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784092877; cv=none; b=M5bQR40T2qrL0hgkKyi1LDIB77MiBk8x26K1L6ZxyTfvod0KvcjUrCa8DgbU2xlWoiFEGJQcfEyGc5u3kbAm+hgWItpFLF8UMbAajI91Qf6kYyKLg5LnssfGQ//Te1uOLnuyRTdIXAJpyEb99nrWmsQg05nOjBnO9+Or5Ikxr4g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784092877; c=relaxed/simple; bh=n4XUXUIpzzOBEUqyenPVs9cokPBC09a0gKVSXG6QnNw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=aSRB5NMWhD7WNSKIJZrlHyL5OwFDvea9+WXEWbMJZFP9VxFE1WDLyvElqD9wPU9EPMjMlXvDlA8oTVW2CWR8N4w8K6NNHAdmLiZeNR3v9yalcIAMFURTpKG+bN1LqBhCABNIp1ONUXoJGrxV3bdqrX03B5jQzZoUJazM8UM4sZU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=n6yNJ3r9; arc=none smtp.client-ip=18.194.254.142 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="n6yNJ3r9" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1784092838; bh=uV5uGd0S/c0RvU1SUv/SFk0bXcnV6jdmYgylj/TptMs=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=n6yNJ3r9FemSXTeAEIHeLU4mbgFc0dvD0q5ZsfnHm04lrVR/vu/t8FCpMEAkrWh6M JnKvgutBqPnUCcd2/4wBGjze7IeCYMnvUADzPgZ/PGiNSxKO+TFwgCj8xoFQRljK80 YkXLjfuGVZCIDDkf9Zocmugbbki4uESWi7yFa4Aw= X-QQ-mid: esmtpsz16t1784092820tc3466601 X-QQ-Originating-IP: LQ3R1jm83F+BD+YxVKiBghag1f46Hb5LgAWLZA5DU2w= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Wed, 15 Jul 2026 13:20:17 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 9908912495004679430 EX-QQ-RecipientCnt: 9 From: Yichong Chen To: ecryptfs@vger.kernel.org Cc: Tyler Hicks , Thorsten Blum , Christian Brauner , Eric Biggers , Kees Cook , Andrew Morton , linux-kernel@vger.kernel.org, Yichong Chen Subject: [PATCH v2 2/3] ecryptfs: fix tag 11 packet exact-fit size check Date: Wed, 15 Jul 2026 13:20:05 +0800 Message-Id: <32b0cb3aedf9f2352f66183039196980d46daa3d.1784081896.git.chenyichong@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: esmtpsz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: MeFNLUIt+GJ0QwWWKkJ7k0nzpFziiCOXAmQiRA1qcReN00HZxSjBRjxC x+y1AWrr7efYlxRmfvSqp1lTDa8mAk9LTbatSLYyTXpRB06bUSbMI2h1PfbZCo5rd0I6NXw BWzaSvrMdwzFjxy8vjclzvnzIucAghXM3x95Oho0xIUUyMkMqdi47kRmf7+EWm050TH3kPO SPfqHRKxZa82HcCBtZexjsJ/Z1YB1G4+5akQ1lV2GqD5Wv9vRBsrBjX6UMn0MeN4KhSt5cO 1oGGSv9ZlpzPMLWgPGkADlryLoek50vcLyYXzwNvbqmVlvAW3R4jaIs4hPmfcc1RTE3toxt 0q1vxzitf49/+pP/1I2qs0GJqO4RN3Huse/Ak+l2weMXHG5qxGnGavvBnAjESRdlEaQbB6R VATYclWq6KWn/2sah119BXUnYv5SQHdljJygjlZJif5DduNxE4eCoXpXEQD3ujSa007cmou RZm3EnJJxBCqgzcvhgWaBrmuyOuzHpiBBn8Yy3Kk6PCcS2KNElaCTdugI2KCoKJs4I5gF6t TBH4CyPLjaEyL1+UKaR5Ic4YowLpab42qLWQ4oGuDOX5yJRxbvUKYfP642cBmlXypKpfxay SJ4rcmeoaww3VmkjyKizQhdB66x77G40B8uQ/D2/rikZKD6I+ZH2azHOnv7aeHdF+qIBYY1 CbjdaiSWuAZEqur791KE0e25m4v+hXWY8LXDz+UnvXh0O+wYlLwgWODtBoWrxVOKNQPZDSa Q4roIDEkWolQIz9Z6/oMRGJpREZseGo1jMwhLmxPKncUVRlOp1IV8Y1P8lPdA6mhVjMXpjT HWDpoBY1VFPP//tuskN+hqbidhlvJEr7Kpg/H6uIzvAzbGFdWEKhiSPfJ33Fb/wFDPkN36R gjVf1g7oh4grsfZhDcAPlIVPK/sWY/h+kODe1h2s1ebdijkCLuEjZmgIhrWkXD8+Hikmdec GUiZf23lvNfE9gR2+4trhmhNwhRIUQqLLu4jNd3i8jmc1Foy15fQmJPyWEqyaBfSmQXL1yF ZmY4v7p8OzGAzmFF7f+C5/uHddMxgD43iIjKLzvJpmzFibFTUyJiU3EQPQ08w= X-QQ-XMRINFO: OWPUhxQsoeAVwkVaQIEGSKwwgKCxK/fD5g== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" parse_tag_11_packet() rejects a packet when the already-consumed tag and length bytes plus the packet body exceed the caller supplied maximum packet size. The check currently adds one extra byte, even though *packet_size already includes the tag byte before the length is parsed. Remove the extra byte so a tag 11 packet that exactly fits the available buffer is accepted while oversized packets are still rejected. Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig") Signed-off-by: Yichong Chen --- fs/ecryptfs/keystore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c index 90c2b80..02b5d77 100644 --- a/fs/ecryptfs/keystore.c +++ b/fs/ecryptfs/keystore.c @@ -1537,7 +1537,7 @@ parse_tag_11_packet(unsigned char *data, unsigned cha= r *contents, } (*packet_size) +=3D length_size; (*tag_11_contents_size) =3D (body_size - 14); - if (unlikely((*packet_size) + body_size + 1 > max_packet_size)) { + if (unlikely((*packet_size) + body_size > max_packet_size)) { printk(KERN_ERR "Packet size exceeds max\n"); rc =3D -EINVAL; goto out; --=20 2.51.0 From nobody Sat Jul 25 18:03:21 2026 Received: from smtpbguseast2.qq.com (smtpbguseast2.qq.com [54.204.34.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AB20D3B5854; Wed, 15 Jul 2026 05:21:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=54.204.34.130 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784092890; cv=none; b=nru0YwMNR+dNpJp91o8mtWfdmSPShanIJjA/2tX/e5xPGVS+7tJb8xVL0cLXOoZ4EdfGxZjB5baRLvNNqBbl/N72IedQiRDxUsuBTt734FLsjT9iU1/AWQvcv0hp5kg0m0Z2TezyoJAlhx+m7FtCibe2MmTPNKmYpiLeJMQFL8I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784092890; c=relaxed/simple; bh=QTD39YOTQptiaIHylilwDz2RZxD9N/9RwKyJDQTQOfU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=sJt65N9+k0MJXDSnTmM1WfhSMXxoi82XgYhXp5cBP2DVrEpnmkxelEKn9pYstzh6cZxtDawxjxtKemkBMqMmPOret0Mj0TFDURoR2V1DpM5HFoNrt4+4FinIy32W/0eq4XqSQ3zA05uQntPUV2qMGjCADsvM8Sq7vo6zMw8M9oc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=TWf2bKuZ; arc=none smtp.client-ip=54.204.34.130 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="TWf2bKuZ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1784092842; bh=VFYv6SVUxgTl3IH1Il5m6Lw6uwCALWN7Qm2KUslpPLg=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=TWf2bKuZ142CKjuTFJz1Ra1o9ZaQ5nh9vOlb10tfdXosD2XiAe0knelW51k84Q/1i YC8x9R6MgcSWAQrtAoFGATuLS6PtlSTuv57p7MGdyY37Dwl7V9LVLyHZ07TSEwJ+9/ NG//wB9vHwwW9qvpmGPVNlU5eALj7Fq1+CuneISw= X-QQ-mid: esmtpsz16t1784092825t2f5cd86a X-QQ-Originating-IP: aocFq+llOLD8qlWzw9LFNVNLL/RdEUnqWFKVLETDgn0= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Wed, 15 Jul 2026 13:20:22 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 7522504236989646418 EX-QQ-RecipientCnt: 9 From: Yichong Chen To: ecryptfs@vger.kernel.org Cc: Tyler Hicks , Thorsten Blum , Christian Brauner , Eric Biggers , Kees Cook , Andrew Morton , linux-kernel@vger.kernel.org, Yichong Chen Subject: [PATCH v2 3/3] ecryptfs: reject too-small tag 70 packets Date: Wed, 15 Jul 2026 13:20:06 +0800 Message-Id: X-Mailer: git-send-email 2.20.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: esmtpsz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: NCzI/oQKSQE0UIY/0Co6MK6/VaB5L4CuOZlKTd+ZAJvIT4vQh/argH4T zuy3rcXomXdhXRKUfQK10Pe+FEQaZTuZMRX1scjGA3V8L8XkEKG+ZaMSfH5Entg/IaXK0qz 285NTFqf1eLcdunC+8K11RaKKB8JyljrU+s2C+l+xmJjhg8+xIT34PNRkiIov2xj29O+nvp DIGTG5RQTRUuY1DCmpEz3jxIE8JARnOlLks8CU+GGnoeHC2mC1wpTUuyhTEXYyCHk3Mep1W atFlP34CPEcE3C0kBmDozsuSKz+6i2LgbNxev4+nd6AllSyDRnrIDeZBncUYSszozzxT9kA qnFrCGkmZ9RDlL8qG0bP3CiJcJaWg2sHtK3yBBoHb/Ak0HXKWzhCde/Ih/meFLd3JqJB2FF BhBYTtvU2oUwPH/VRnPJAxrIzpb5kGlzmNJ2/chB1NBpJMjdsru7gH9kibssmdVeW0AYZIg HuneVichiu8G3DXy23wNY3Ys3XlP4oHG1U7pdd6ZJUIbx0UedhxNnlxbOBfoWhZI7VBU77p hK6jih/g7M8vN00aA3tcJMVDxylapPcVT3Cr/8CrSV/XylZCNqgqACY4Q1AjJVqzYlMzCQp vnRHU8rzhgx+NyeUawSrxCy+r6MEDCSkegYLzEU6hgMpcubYu0hat20OK4dKe/Nu5jgxIK+ FlNOUuJDA4Vp1tDpWXqQC+noXaFNlYEGUwsEMiRsHHr68Bdnirio1e7+N0Sc7TBEVNeMFWo Y4QMQfZgO/QyuNAA0B1fM1UtrHNGigqTeqfco39sc0ffVRs7CoMvsCABPNk4IhkIhxXhYto pIDOseEbk7yG1gpD4BmhT0R0h7zpoMfVI0Imyt2JgD86oosesP0BwhboIapUI0gaK9E7s2o nxnhHWPuh/RbWceCOIaZAauIVjye20fgB6bpidN0uVRW5/R6ZrJl7VpSKTuQ1EmtosZtYhH OhiZPsbHWjpLRnb/pXOylL8arhpJId4ZA2vq1lau9EOLmJDu8obe8KxE0iKCI32Hv/PuL24 c3odiTfxjrsAAvIYdXXYlCPmYQHByOEM+92++XS4Zqsrvx1aek1QDwSG4XHkw= X-QQ-XMRINFO: NS+P29fieYNwqS3WCnRCOn9D1NpZuCnCRA== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" ecryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed fields can underflow that size calculation. Reject tag 70 packets before the subtraction unless the body contains the signature, cipher code, and at least one byte of encrypted filename data. Fixes: 9c79f34f7ee7 ("eCryptfs: Filename Encryption: Tag 70 packets") Signed-off-by: Yichong Chen --- fs/ecryptfs/keystore.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c index 02b5d77..a525a8c 100644 --- a/fs/ecryptfs/keystore.c +++ b/fs/ecryptfs/keystore.c @@ -894,6 +894,12 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *= filename_size, "rc =3D [%d]\n", __func__, rc); goto out; } + if (s->parsed_tag_70_packet_size < (ECRYPTFS_SIG_SIZE + 2)) { + ecryptfs_printk(KERN_WARNING, "Invalid packet size [%zd]\n", + s->parsed_tag_70_packet_size); + rc =3D -EINVAL; + goto out; + } s->block_aligned_filename_size =3D (s->parsed_tag_70_packet_size - ECRYPTFS_SIG_SIZE - 1); if ((1 + s->packet_size_len + s->parsed_tag_70_packet_size) --=20 2.51.0