[PATCH] fsverity: reject short BPF digest buffers

[PATCH] fsverity: reject short BPF digest buffers

[Yichong Chen]

bpf_get_fsverity_digest() reports the digest size as the full hash digest
size.  However, when the provided dynptr only has room for part of the
digest, the helper currently copies the truncated digest and still returns
success.

Returning success with a digest_size that is larger than the actual copied
digest is misleading for integrity policy code.  Match the ioctl
measurement path and reject too-small output buffers with -EOVERFLOW.

Fixes: 67814c00de31 ("bpf, fsverity: Add kfunc bpf_get_fsverity_digest")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
---
 fs/verity/measure.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/verity/measure.c b/fs/verity/measure.c
index cfe2d5e535f9..4cfadba95488 100644
--- a/fs/verity/measure.c
+++ b/fs/verity/measure.c
@@ -148,9 +148,11 @@ __bpf_kfunc int bpf_get_fsverity_digest(struct file *file, const struct bpf_dynp
 	arg->digest_size = hash_alg->digest_size;
 
 	out_digest_sz = dynptr_sz - sizeof(struct fsverity_digest);
+	if (out_digest_sz < hash_alg->digest_size)
+		return -EOVERFLOW;
 
 	/* copy digest */
-	memcpy(arg->digest, vi->file_digest,  min_t(int, hash_alg->digest_size, out_digest_sz));
+	memcpy(arg->digest, vi->file_digest, hash_alg->digest_size);
 
 	/* fill the extra buffer with zeros */
 	if (out_digest_sz > hash_alg->digest_size)
-- 
2.51.0

Re: [PATCH] fsverity: reject short BPF digest buffers

[Eric Biggers]

On Wed, Aug 05, 2026 at 03:56:55PM +0800, Yichong Chen wrote:
> bpf_get_fsverity_digest() reports the digest size as the full hash digest
> size.  However, when the provided dynptr only has room for part of the
> digest, the helper currently copies the truncated digest and still returns
> success.
> 
> Returning success with a digest_size that is larger than the actual copied
> digest is misleading for integrity policy code.  Match the ioctl
> measurement path and reject too-small output buffers with -EOVERFLOW.
> 
> Fixes: 67814c00de31 ("bpf, fsverity: Add kfunc bpf_get_fsverity_digest")
> Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
> ---
>  fs/verity/measure.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Already handled by https://lore.kernel.org/bpf/20260803181232.14743-1-ebiggers@kernel.org/

- Eric