ecryptfs_get_key_payload_data() casts the payload of a "user" or "encrypted" key straight to struct ecryptfs_auth_tok. The payload size is chosen by whoever added the key, so a payload shorter than the struct makes later accesses run past the allocation. For example, a 712-byte "user" key makes write_tag_3_packet() read the password signature beyond the end of the kmalloc-1k object: BUG: KASAN: slab-out-of-bounds in ecryptfs_from_hex+0x18c/0x1d0 Read of size 1 write_tag_3_packet+0x145/0x1430 ecryptfs_generate_key_packet_set+0x7ae/0x1880 ecryptfs_write_metadata+0x590/0x930 ecryptfs_create+0x393/0x550 Reject payloads smaller than struct ecryptfs_auth_tok with -EINVAL. The callers already propagate errors from this helper, so mounting with such a key now fails cleanly. Reported-by: syzbot+dc50906b100ac7a1c34d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=dc50906b100ac7a1c34d Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig") Cc: stable@vger.kernel.org Signed-off-by: Nguyen Ngoc Thang --- Notes (not for the commit log): syzbot reports "KASAN: slab-out-of-bounds Read in ecryptfs_from_hex". The reproducer adds a 712-byte "user" key whose description matches ecryptfs_sig=; the mount succeeds and the first create makes write_tag_3_packet() read the signature past the end of the kmalloc-1k object. Tested in QEMU with syzbot's KASAN config: base kernel hits the KASAN report, patched kernel fails the mount with -EINVAL. Fixes points at the initial ecryptfs commit since the history here is grafted; happy to retarget. fs/ecryptfs/ecryptfs_kernel.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h index 58165928ed1e..863761b3847a 100644 --- a/fs/ecryptfs/ecryptfs_kernel.h +++ b/fs/ecryptfs/ecryptfs_kernel.h @@ -88,6 +88,9 @@ ecryptfs_get_encrypted_key_payload_data(struct key *key) if (!payload) return ERR_PTR(-EKEYREVOKED); + if (payload->decrypted_datalen < sizeof(struct ecryptfs_auth_tok)) + return ERR_PTR(-EINVAL); + return (struct ecryptfs_auth_tok *)payload->payload_data; } @@ -124,6 +127,9 @@ ecryptfs_get_key_payload_data(struct key *key) if (!ukp) return ERR_PTR(-EKEYREVOKED); + if (ukp->datalen < sizeof(struct ecryptfs_auth_tok)) + return ERR_PTR(-EINVAL); + return (struct ecryptfs_auth_tok *)ukp->data; } -- 2.43.0