[PATCH v3 1/2] ecryptfs: reject short encrypted key payloads

[PATCH v3 1/2] ecryptfs: reject short encrypted key payloads

[Adriano Cordova]

Reject payloads too short to hold a struct ecryptfs_auth_tok,
as a key created with a non-ecryptfs format is shorter than
the struct, so the payload gets dereferenced past its end.

Fixes: 1252cc3b232e ("eCryptfs: added support for the encrypted key type")
Cc: <stable@vger.kernel.org>
Signed-off-by: Adriano Cordova <adrianox@gmail.com>
---
Changes in v3:
- Split the v2 patch.
- Remove Nguyen Duy Nhat Anh change and its Reported-by tag.

Changes in v2:
- Add Reported-by tag.

 fs/ecryptfs/ecryptfs_kernel.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 58165928ed1e..d4fef71738b0 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -88,6 +88,9 @@ ecryptfs_get_encrypted_key_payload_data(struct key *key)
 	if (!payload)
 		return ERR_PTR(-EKEYREVOKED);
 
+	if (payload->payload_datalen < sizeof(struct ecryptfs_auth_tok))
+		return ERR_PTR(-EINVAL);
+
 	return (struct ecryptfs_auth_tok *)payload->payload_data;
 }
 
-- 
2.51.0

[PATCH v3 2/2] ecryptfs: bound session_key_encryption_key_bytes in auth tok

[Adriano Cordova]

Let ecryptfs_verify_auth_tok_from_key() validate the password's
session_key_encryption_key_bytes length. When it is larger than
ECRYPTFS_MAX_KEY_BYTES, md5() reads past session_key_encryption_key[].
Reject such auth toks.

Fixes: 9c79f34f7ee7 ("eCryptfs: Filename Encryption: Tag 70 packets")
Cc: <stable@vger.kernel.org>
Reported-by: syzbot+03c68e42ce4b33f7ce9b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=03c68e42ce4b33f7ce9b
Tested-by: syzbot+03c68e42ce4b33f7ce9b@syzkaller.appspotmail.com
Signed-off-by: Adriano Cordova <adrianox@gmail.com>
---
Changes in v3:
- Split the v2 patch.
- Change the Link: tag to Closes:.
- Remove Nguyen Duy Nhat Anh change and its Reported-by tag.

 fs/ecryptfs/keystore.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 51651314b7a6..c2ba230c71fd 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -477,6 +477,13 @@ ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key,
 		rc = -EINVAL;
 		goto out;
 	}
+	if ((*auth_tok)->token_type == ECRYPTFS_PASSWORD &&
+	    (*auth_tok)->token.password.session_key_encryption_key_bytes >
+	    ECRYPTFS_MAX_KEY_BYTES) {
+		printk(KERN_ERR "Invalid password auth_tok session key size\n");
+		rc = -EINVAL;
+		goto out;
+	}
 out:
 	return rc;
 }
-- 
2.51.0