Reject payloads too short to hold a struct ecryptfs_auth_tok, as a key created with a non-ecryptfs format is shorter than the struct, so the payload gets dereferenced past its end. Fixes: 1252cc3b232e ("eCryptfs: added support for the encrypted key type") Cc: Signed-off-by: Adriano Cordova --- Changes in v3: - Split the v2 patch. - Remove Nguyen Duy Nhat Anh change and its Reported-by tag. Changes in v2: - Add Reported-by tag. fs/ecryptfs/ecryptfs_kernel.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h index 58165928ed1e..d4fef71738b0 100644 --- a/fs/ecryptfs/ecryptfs_kernel.h +++ b/fs/ecryptfs/ecryptfs_kernel.h @@ -88,6 +88,9 @@ ecryptfs_get_encrypted_key_payload_data(struct key *key) if (!payload) return ERR_PTR(-EKEYREVOKED); + if (payload->payload_datalen < sizeof(struct ecryptfs_auth_tok)) + return ERR_PTR(-EINVAL); + return (struct ecryptfs_auth_tok *)payload->payload_data; } -- 2.51.0