[PATCH] ecryptfs: validate auth_tok key payload size before use

[PATCH] ecryptfs: validate auth_tok key payload size before use

[Deepanshu Kartikey]

ecryptfs_verify_auth_tok_from_key() casts a "user" type key's raw
payload directly to struct ecryptfs_auth_tok without checking that
the key actually holds enough data to back that struct. Since a
user-type key's payload length is fully attacker-controlled via
add_key(2), an undersized key whose description matches
global_default_fnek_sig lets later code (e.g.
ecryptfs_write_tag_70_packet()) read fields such as
session_key_encryption_key/session_key_encryption_key_bytes past the
end of the actual allocation, causing a slab-out-of-bounds read.

Reject the key up front if its datalen is smaller than
sizeof(struct ecryptfs_auth_tok).

Fixes: 0e1fc5ef470cc ("eCryptfs: verify authentication tokens before their use")
Reported-by: syzbot+e4391e0d6e7c89b8c84e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e4391e0d6e7c89b8c84e
Tested-by: syzbot+e4391e0d6e7c89b8c84e@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 fs/ecryptfs/keystore.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 51651314b7a6..81768a0e43b1 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -462,6 +461,14 @@ ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key,
 		goto out;
 	}
 
+	if (auth_tok_key->datalen < sizeof(struct ecryptfs_auth_tok)) {
+		printk(KERN_ERR "Auth tok key payload too small (have %d bytes; need %zu)\n",
+		       auth_tok_key->datalen, sizeof(struct ecryptfs_auth_tok));
+		rc = -EINVAL;
+		*auth_tok = NULL;
+		goto out;
+	}
+
 	if (ecryptfs_verify_version((*auth_tok)->version)) {
 		printk(KERN_ERR "Data structure version mismatch. Userspace "
 		       "tools must match eCryptfs kernel module with major "
-- 
2.43.0

Re: [PATCH] ecryptfs: validate auth_tok key payload size before use

[Tyler Hicks]

On 2026-09-22 10:14:00, Deepanshu Kartikey wrote:
> ecryptfs_verify_auth_tok_from_key() casts a "user" type key's raw
> payload directly to struct ecryptfs_auth_tok without checking that
> the key actually holds enough data to back that struct. Since a
> user-type key's payload length is fully attacker-controlled via
> add_key(2), an undersized key whose description matches
> global_default_fnek_sig lets later code (e.g.
> ecryptfs_write_tag_70_packet()) read fields such as
> session_key_encryption_key/session_key_encryption_key_bytes past the
> end of the actual allocation, causing a slab-out-of-bounds read.
> 
> Reject the key up front if its datalen is smaller than
> sizeof(struct ecryptfs_auth_tok).
> 
> Fixes: 0e1fc5ef470cc ("eCryptfs: verify authentication tokens before their use")
> Reported-by: syzbot+e4391e0d6e7c89b8c84e@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=e4391e0d6e7c89b8c84e
> Tested-by: syzbot+e4391e0d6e7c89b8c84e@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>

Hello and thank you for the patch. Unfortunately, someone else sent a
fix for the same bug before you and I've applied their patch. You can
see that email thread here:

  https://lore.kernel.org/ecryptfs/20260917044558.41677-1-neganhat@gmail.com/

Thanks again!

Tyler

> ---
>  fs/ecryptfs/keystore.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
> index 51651314b7a6..81768a0e43b1 100644
> --- a/fs/ecryptfs/keystore.c
> +++ b/fs/ecryptfs/keystore.c
> @@ -462,6 +461,14 @@ ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key,
>  		goto out;
>  	}
>  
> +	if (auth_tok_key->datalen < sizeof(struct ecryptfs_auth_tok)) {
> +		printk(KERN_ERR "Auth tok key payload too small (have %d bytes; need %zu)\n",
> +		       auth_tok_key->datalen, sizeof(struct ecryptfs_auth_tok));
> +		rc = -EINVAL;
> +		*auth_tok = NULL;
> +		goto out;
> +	}
> +
>  	if (ecryptfs_verify_version((*auth_tok)->version)) {
>  		printk(KERN_ERR "Data structure version mismatch. Userspace "
>  		       "tools must match eCryptfs kernel module with major "
> -- 
> 2.43.0
>