[PATCH] ecryptfs: release message context on send failure

[PATCH] ecryptfs: release message context on send failure

[Yichong Chen]

ecryptfs_send_message_locked() moves a message context from the free
list to the allocated list before sending the request to the userspace
daemon.

If ecryptfs_send_miscdev() fails, the context is left on the
allocated list and cannot be reused. Move it back to the free list on
failure and clear the caller's pointer.

Fixes: 624ae5284516 ("eCryptfs: remove netlink transport")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
---
 fs/ecryptfs/messaging.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
index 03c60f0850ca..d53c21e82365 100644
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -284,9 +284,16 @@ ecryptfs_send_message_locked(char *data, int data_len, u8 msg_type,
 	mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
 	rc = ecryptfs_send_miscdev(data, data_len, *msg_ctx, msg_type, 0,
 				   daemon);
-	if (rc)
+	if (rc) {
 		printk(KERN_ERR "%s: Error attempting to send message to "
 		       "userspace daemon; rc = [%d]\n", __func__, rc);
+		mutex_lock(&ecryptfs_msg_ctx_lists_mux);
+		mutex_lock(&(*msg_ctx)->mux);
+		ecryptfs_msg_ctx_alloc_to_free(*msg_ctx);
+		mutex_unlock(&(*msg_ctx)->mux);
+		mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
+		*msg_ctx = NULL;
+	}
 out:
 	return rc;
 }
-- 
2.51.0

Re: [PATCH] ecryptfs: release message context on send failure

[Tyler Hicks]

On 2026-06-27 17:01:26, Yichong Chen wrote:
> ecryptfs_send_message_locked() moves a message context from the free
> list to the allocated list before sending the request to the userspace
> daemon.
> 
> If ecryptfs_send_miscdev() fails, the context is left on the
> allocated list and cannot be reused. Move it back to the free list on
> failure and clear the caller's pointer.

Hi - Thanks for the fix!

> 
> Fixes: 624ae5284516 ("eCryptfs: remove netlink transport")

I think the correct Fixes tag is:

Fixes: f66e883eb618 ("eCryptfs: integrate eCryptfs device handle into the module.")

Do you agree that is when this bug was first introduced?

The rest of the patch looks good to me.

Tyler

> Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
> ---
>  fs/ecryptfs/messaging.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
> index 03c60f0850ca..d53c21e82365 100644
> --- a/fs/ecryptfs/messaging.c
> +++ b/fs/ecryptfs/messaging.c
> @@ -284,9 +284,16 @@ ecryptfs_send_message_locked(char *data, int data_len, u8 msg_type,
>  	mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
>  	rc = ecryptfs_send_miscdev(data, data_len, *msg_ctx, msg_type, 0,
>  				   daemon);
> -	if (rc)
> +	if (rc) {
>  		printk(KERN_ERR "%s: Error attempting to send message to "
>  		       "userspace daemon; rc = [%d]\n", __func__, rc);
> +		mutex_lock(&ecryptfs_msg_ctx_lists_mux);
> +		mutex_lock(&(*msg_ctx)->mux);
> +		ecryptfs_msg_ctx_alloc_to_free(*msg_ctx);
> +		mutex_unlock(&(*msg_ctx)->mux);
> +		mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
> +		*msg_ctx = NULL;
> +	}
>  out:
>  	return rc;
>  }
> -- 
> 2.51.0
> 

Re: [PATCH] ecryptfs: release message context on send failure

[Yichong Chen]

Hi Tyler,

Yes, I agree. I rechecked the history and f66e883eb618 is where the
miscdev send path was introduced into ecryptfs_send_message_locked().
I'll send a v2 with the corrected Fixes tag.

Thanks for catching this.

Yichong