[PATCH v2] ecryptfs: validate auth tok payload size

[PATCH v2] ecryptfs: validate auth tok payload size

[Adriano Cordova]

Validate that a key payload is large enough to hold a struct
ecryptfs_auth_tok, and that the password token's
session_key_encryption_key_bytes fits within
session_key_encryption_key[], before the payload is dereferenced.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+03c68e42ce4b33f7ce9b@syzkaller.appspotmail.com
Reported-by: Nguyen Duy Nhat Anh <neganhat@gmail.com>
Tested-by: syzbot+03c68e42ce4b33f7ce9b@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=03c68e42ce4b33f7ce9b
Signed-off-by: Adriano Cordova <adrianox@gmail.com>
---
Changes in v2:
- Add Reported-by tag.

 fs/ecryptfs/ecryptfs_kernel.h | 6 ++++++
 fs/ecryptfs/keystore.c        | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 58165928ed1e..4315c18ba1cd 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -88,6 +88,9 @@ ecryptfs_get_encrypted_key_payload_data(struct key *key)
 	if (!payload)
 		return ERR_PTR(-EKEYREVOKED);
 
+	if (payload->payload_datalen < sizeof(struct ecryptfs_auth_tok))
+		return ERR_PTR(-EINVAL);
+
 	return (struct ecryptfs_auth_tok *)payload->payload_data;
 }
 
@@ -124,6 +127,9 @@ ecryptfs_get_key_payload_data(struct key *key)
 	if (!ukp)
 		return ERR_PTR(-EKEYREVOKED);
 
+	if (ukp->datalen < sizeof(struct ecryptfs_auth_tok))
+		return ERR_PTR(-EINVAL);
+
 	return (struct ecryptfs_auth_tok *)ukp->data;
 }
 
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 51651314b7a6..7f2dbc81fcbc 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -477,6 +477,13 @@ ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key,
 		rc = -EINVAL;
 		goto out;
 	}
+	if ((*auth_tok)->token_type == ECRYPTFS_PASSWORD
+	    && (*auth_tok)->token.password.session_key_encryption_key_bytes
+	       > ECRYPTFS_MAX_KEY_BYTES) {
+		printk(KERN_ERR "Invalid password auth_tok sKEK size\n");
+		rc = -EINVAL;
+		goto out;
+	}
 out:
 	return rc;
 }
-- 
2.51.0

Re: [PATCH v2] ecryptfs: validate auth tok payload size

[Tyler Hicks]

On 2026-10-04 09:37:55, Adriano Cordova wrote:
> Validate that a key payload is large enough to hold a struct
> ecryptfs_auth_tok, and that the password token's
> session_key_encryption_key_bytes fits within
> session_key_encryption_key[], before the payload is dereferenced.

Hi Adriano - Thank you for the fixes!

> 
> Cc: <stable@vger.kernel.org>
> Reported-by: syzbot+03c68e42ce4b33f7ce9b@syzkaller.appspotmail.com
> Reported-by: Nguyen Duy Nhat Anh <neganhat@gmail.com>
> Tested-by: syzbot+03c68e42ce4b33f7ce9b@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=03c68e42ce4b33f7ce9b

Change this tag from `Link:` to `Closes:`, please.

> Signed-off-by: Adriano Cordova <adrianox@gmail.com>
> ---
> Changes in v2:
> - Add Reported-by tag.
> 
>  fs/ecryptfs/ecryptfs_kernel.h | 6 ++++++
>  fs/ecryptfs/keystore.c        | 7 +++++++
>  2 files changed, 13 insertions(+)
> 
> diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
> index 58165928ed1e..4315c18ba1cd 100644
> --- a/fs/ecryptfs/ecryptfs_kernel.h
> +++ b/fs/ecryptfs/ecryptfs_kernel.h
> @@ -88,6 +88,9 @@ ecryptfs_get_encrypted_key_payload_data(struct key *key)
>  	if (!payload)
>  		return ERR_PTR(-EKEYREVOKED);
>  
> +	if (payload->payload_datalen < sizeof(struct ecryptfs_auth_tok))
> +		return ERR_PTR(-EINVAL);
> +

This change should be in its own patch with the following Fixes tag:

  Fixes: 1252cc3b232e ("eCryptfs: added support for the encrypted key type")

>  	return (struct ecryptfs_auth_tok *)payload->payload_data;
>  }
>  
> @@ -124,6 +127,9 @@ ecryptfs_get_key_payload_data(struct key *key)
>  	if (!ukp)
>  		return ERR_PTR(-EKEYREVOKED);
>  
> +	if (ukp->datalen < sizeof(struct ecryptfs_auth_tok))
> +		return ERR_PTR(-EINVAL);
> +

Nguyen Duy Nhat Anh submitted this fix prior to your v1 so it is best if
I take that initial patch. Please drop this change.

>  	return (struct ecryptfs_auth_tok *)ukp->data;
>  }
>  
> diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
> index 51651314b7a6..7f2dbc81fcbc 100644
> --- a/fs/ecryptfs/keystore.c
> +++ b/fs/ecryptfs/keystore.c
> @@ -477,6 +477,13 @@ ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key,
>  		rc = -EINVAL;
>  		goto out;
>  	}
> +	if ((*auth_tok)->token_type == ECRYPTFS_PASSWORD
> +	    && (*auth_tok)->token.password.session_key_encryption_key_bytes
> +	       > ECRYPTFS_MAX_KEY_BYTES) {
> +		printk(KERN_ERR "Invalid password auth_tok sKEK size\n");
> +		rc = -EINVAL;
> +		goto out;
> +	}

This change should be in its own patch with the following Fixes tag:

  Fixes: 9c79f34f7ee7 ("eCryptfs: Filename Encryption: Tag 70 packets")  

Thanks again!

Tyler

>  out:
>  	return rc;
>  }
> -- 
> 2.51.0
>