Patch "ecryptfs: Fix buffer size for tag 66 packet" has been added to the 5.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    ecryptfs: Fix buffer size for tag 66 packet

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ecryptfs-fix-buffer-size-for-tag-66-packet.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fbfce6ee3ad03758b03c634747d36fbb055ef110
Author: Brian Kubisiak <brian@xxxxxxxxxxxx>
Date:   Sun Mar 17 07:46:00 2024 -0700

    ecryptfs: Fix buffer size for tag 66 packet
    
    [ Upstream commit 85a6a1aff08ec9f5b929d345d066e2830e8818e5 ]
    
    The 'TAG 66 Packet Format' description is missing the cipher code and
    checksum fields that are packed into the message packet. As a result,
    the buffer allocated for the packet is 3 bytes too small and
    write_tag_66_packet() will write up to 3 bytes past the end of the
    buffer.
    
    Fix this by increasing the size of the allocation so the whole packet
    will always fit in the buffer.
    
    This fixes the below kasan slab-out-of-bounds bug:
    
      BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0
      Write of size 1 at addr ffff88800afbb2a5 by task touch/181
    
      CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014
      Call Trace:
       <TASK>
       dump_stack_lvl+0x4c/0x70
       print_report+0xc5/0x610
       ? ecryptfs_generate_key_packet_set+0x7d6/0xde0
       ? kasan_complete_mode_report_info+0x44/0x210
       ? ecryptfs_generate_key_packet_set+0x7d6/0xde0
       kasan_report+0xc2/0x110
       ? ecryptfs_generate_key_packet_set+0x7d6/0xde0
       __asan_store1+0x62/0x80
       ecryptfs_generate_key_packet_set+0x7d6/0xde0
       ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10
       ? __alloc_pages+0x2e2/0x540
       ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d]
       ? dentry_open+0x8f/0xd0
       ecryptfs_write_metadata+0x30a/0x550
       ? __pfx_ecryptfs_write_metadata+0x10/0x10
       ? ecryptfs_get_lower_file+0x6b/0x190
       ecryptfs_initialize_file+0x77/0x150
       ecryptfs_create+0x1c2/0x2f0
       path_openat+0x17cf/0x1ba0
       ? __pfx_path_openat+0x10/0x10
       do_filp_open+0x15e/0x290
       ? __pfx_do_filp_open+0x10/0x10
       ? __kasan_check_write+0x18/0x30
       ? _raw_spin_lock+0x86/0xf0
       ? __pfx__raw_spin_lock+0x10/0x10
       ? __kasan_check_write+0x18/0x30
       ? alloc_fd+0xf4/0x330
       do_sys_openat2+0x122/0x160
       ? __pfx_do_sys_openat2+0x10/0x10
       __x64_sys_openat+0xef/0x170
       ? __pfx___x64_sys_openat+0x10/0x10
       do_syscall_64+0x60/0xd0
       entry_SYSCALL_64_after_hwframe+0x6e/0xd8
      RIP: 0033:0x7f00a703fd67
      Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f
      RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
      RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67
      RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c
      RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000
      R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941
      R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040
       </TASK>
    
      Allocated by task 181:
       kasan_save_stack+0x2f/0x60
       kasan_set_track+0x29/0x40
       kasan_save_alloc_info+0x25/0x40
       __kasan_kmalloc+0xc5/0xd0
       __kmalloc+0x66/0x160
       ecryptfs_generate_key_packet_set+0x6d2/0xde0
       ecryptfs_write_metadata+0x30a/0x550
       ecryptfs_initialize_file+0x77/0x150
       ecryptfs_create+0x1c2/0x2f0
       path_openat+0x17cf/0x1ba0
       do_filp_open+0x15e/0x290
       do_sys_openat2+0x122/0x160
       __x64_sys_openat+0xef/0x170
       do_syscall_64+0x60/0xd0
       entry_SYSCALL_64_after_hwframe+0x6e/0xd8
    
    Fixes: dddfa461fc89 ("[PATCH] eCryptfs: Public key; packet management")
    Signed-off-by: Brian Kubisiak <brian@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/5j2q56p6qkhezva6b2yuqfrsurmvrrqtxxzrnp3wqu7xrz22i7@hoecdztoplbl
    Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index f6a17d259db74..afe51b4be1e73 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -300,9 +300,11 @@ write_tag_66_packet(char *signature, u8 cipher_code,
 	 *         | Key Identifier Size      | 1 or 2 bytes |
 	 *         | Key Identifier           | arbitrary    |
 	 *         | File Encryption Key Size | 1 or 2 bytes |
+	 *         | Cipher Code              | 1 byte       |
 	 *         | File Encryption Key      | arbitrary    |
+	 *         | Checksum                 | 2 bytes      |
 	 */
-	data_len = (5 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size);
+	data_len = (8 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size);
 	*packet = kmalloc(data_len, GFP_KERNEL);
 	message = *packet;
 	if (!message) {




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux