[PATCH] ecryptfs: validate key payload size before using it as an auth_tok

[Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>]

ecryptfs_get_key_payload_data() casts the payload of a "user" or
"encrypted" key straight to struct ecryptfs_auth_tok. The payload size is
chosen by whoever added the key, so a payload shorter than the struct
makes later accesses run past the allocation. For example, a 712-byte
"user" key makes write_tag_3_packet() read the password signature beyond
the end of the kmalloc-1k object:

  BUG: KASAN: slab-out-of-bounds in ecryptfs_from_hex+0x18c/0x1d0
  Read of size 1
   write_tag_3_packet+0x145/0x1430
   ecryptfs_generate_key_packet_set+0x7ae/0x1880
   ecryptfs_write_metadata+0x590/0x930
   ecryptfs_create+0x393/0x550

Reject payloads smaller than struct ecryptfs_auth_tok with -EINVAL. The
callers already propagate errors from this helper, so mounting with such
a key now fails cleanly.

Reported-by: syzbot+dc50906b100ac7a1c34d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dc50906b100ac7a1c34d
Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig")
Cc: stable@vger.kernel.org
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
Notes (not for the commit log):
syzbot reports "KASAN: slab-out-of-bounds Read in ecryptfs_from_hex". The
reproducer adds a 712-byte "user" key whose description matches
ecryptfs_sig=; the mount succeeds and the first create makes
write_tag_3_packet() read the signature past the end of the kmalloc-1k
object. Tested in QEMU with syzbot's KASAN config: base kernel hits the
KASAN report, patched kernel fails the mount with -EINVAL. Fixes points at
the initial ecryptfs commit since the history here is grafted; happy to
retarget.

 fs/ecryptfs/ecryptfs_kernel.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 58165928ed1e..863761b3847a 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -88,6 +88,9 @@ ecryptfs_get_encrypted_key_payload_data(struct key *key)
 	if (!payload)
 		return ERR_PTR(-EKEYREVOKED);
 
+	if (payload->decrypted_datalen < sizeof(struct ecryptfs_auth_tok))
+		return ERR_PTR(-EINVAL);
+
 	return (struct ecryptfs_auth_tok *)payload->payload_data;
 }
 
@@ -124,6 +127,9 @@ ecryptfs_get_key_payload_data(struct key *key)
 	if (!ukp)
 		return ERR_PTR(-EKEYREVOKED);
 
+	if (ukp->datalen < sizeof(struct ecryptfs_auth_tok))
+		return ERR_PTR(-EINVAL);
+
 	return (struct ecryptfs_auth_tok *)ukp->data;
 }
 
-- 
2.43.0