[PATCH] Reject LUKS2 header with out-of-range encryption sector size.

[Itai Handler <itai.handler@gmail.com>]

LUKS2 keeps the encryption sector size in the segment metadata.
MAX_SECTOR_SIZE (4096 bytes, the smallest page size among the platforms
cryptsetup runs on) is the largest value the format allows, because a
LUKS device has to remain openable on all of them.

Writing a header enforces that, through LUKS2_check_encryption_sector(),
so cryptsetup never produces one that exceeds it. Reading a header does
not: hdr_validate_crypt_segment() only requires "sector_size" to be
non-zero and 512-aligned. A header carrying a larger value - after
metadata corruption, or from anything that wrote it other than
cryptsetup - therefore loads without complaint, and luksDump reports it
as a valid LUKS device:

	sector: 65536 [bytes]

Activating it then fails, but only because dm-crypt applies a 4096-byte
limit of its own. A constraint of the LUKS2 format is in effect being
enforced by an implementation detail of one kernel target, which is the
wrong place for it and leaves the tools reporting such a device as
valid.

Check the limit where the rest of the header is checked, so that the
same rule applies to a header being read as to one being written.

This cannot reject anything cryptsetup has written. LUKS1 is unaffected,
its encryption sector size is always 512 bytes.

Assisted-by: LLM
---
 lib/luks2/luks2_json_metadata.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/luks2/luks2_json_metadata.c b/lib/luks2/luks2_json_metadata.c
index c532576..bb88846 100644
--- a/lib/luks2/luks2_json_metadata.c
+++ b/lib/luks2/luks2_json_metadata.c
@@ -555,7 +555,7 @@ static int hdr_validate_crypt_segment(struct crypt_device *cd, json_object *jobj
 	}
 
 	sector_size = crypt_jobj_get_uint32(jobj_sector_size);
-	if (!sector_size || MISALIGNED_512(sector_size)) {
+	if (!sector_size || MISALIGNED_512(sector_size) || sector_size > MAX_SECTOR_SIZE) {
 		log_dbg(cd, "Illegal sector size: %" PRIu32, sector_size);
 		return 1;
 	}
-- 
2.34.1