Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53695127 authored by Andrey Markovytch's avatar Andrey Markovytch Committed by Matt Wagantall
Browse files

ecrypt_fs: fix KW issues 



Fix KW issues that appear in ecryptfs code, i.e.
buffer size checks, null checks, etc.

Change-Id: I329ce963a950d76a49625c3c888f2e7ad9a8e770
Signed-off-by: default avatarAndrey Markovytch <andreym@codeaurora.org>
parent 4aae4f63

fs/ecryptfs/ecryptfs_kernel.h

+1 −1
Original line number Diff line number Diff line
@@ -237,7 +237,7 @@ struct ecryptfs_crypt_stat { 
	struct crypto_ablkcipher *tfm;

	struct crypto_hash *hash_tfm; /* Crypto context for generating

				       * the initialization vectors */

	unsigned char cipher[ECRYPTFS_MAX_CIPHER_NAME_SIZE];

	unsigned char cipher[ECRYPTFS_MAX_CIPHER_NAME_SIZE + 1];

	unsigned char key[ECRYPTFS_MAX_KEY_BYTES];

	unsigned char root_iv[ECRYPTFS_MAX_IV_BYTES];

	struct list_head keysig_list;

fs/ecryptfs/inode.c

+1 −1
Original line number Diff line number Diff line
@@ -680,7 +680,7 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd) 
{

	size_t len;

	char *buf = ecryptfs_readlink_lower(dentry, &len);

	if (IS_ERR(buf))

	if (IS_ERR(buf) || NULL == buf)

		goto out;

	fsstack_copy_attr_atime(dentry->d_inode,

				ecryptfs_dentry_to_lower(dentry)->d_inode);

fs/ecryptfs/keystore.c

+24 −4
Original line number Diff line number Diff line
@@ -162,6 +162,7 @@ write_tag_64_packet(char *signature, struct ecryptfs_session_key *session_key, 
	size_t packet_size_len;

	char *message;

	int rc;

	u32 encrypted_key_size = 0;



	/*

	 *              ***** TAG 64 Packet Format *****
@@ -200,8 +201,13 @@ write_tag_64_packet(char *signature, struct ecryptfs_session_key *session_key, 
		goto out;

	}

	i += packet_size_len;



	encrypted_key_size = (session_key->encrypted_key_size <=

				sizeof(session_key->encrypted_key)) ?

				session_key->encrypted_key_size :

				sizeof(session_key->encrypted_key);

	memcpy(&message[i], session_key->encrypted_key,

	       session_key->encrypted_key_size);

			encrypted_key_size);

	i += session_key->encrypted_key_size;

	*packet_len = i;

out:
@@ -810,8 +816,10 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes, 
		if (s->block_aligned_filename[s->j] == '\0')

			s->block_aligned_filename[s->j] = ECRYPTFS_NON_NULL;

	}

	if (NULL != filename)

		memcpy(&s->block_aligned_filename[s->num_rand_bytes], filename,

	       filename_size);



	rc = virt_to_scatterlist(s->block_aligned_filename,

				 s->block_aligned_filename_size, s->src_sg, 2);

	if (rc < 1) {
@@ -1671,6 +1679,7 @@ decrypt_passphrase_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok, 
		.flags = CRYPTO_TFM_REQ_MAY_SLEEP

	};

	int rc = 0;

	u32 decrypted_key_size = 0;



	if (unlikely(ecryptfs_verbosity > 0)) {

		ecryptfs_printk(
@@ -1728,8 +1737,13 @@ decrypt_passphrase_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok, 
		goto out;

	}

	auth_tok->session_key.flags |= ECRYPTFS_CONTAINS_DECRYPTED_KEY;



	decrypted_key_size = (auth_tok->session_key.decrypted_key_size <=

				sizeof(auth_tok->session_key.decrypted_key)) ?

				auth_tok->session_key.decrypted_key_size :

				sizeof(auth_tok->session_key.decrypted_key);

	memcpy(crypt_stat->key, auth_tok->session_key.decrypted_key,

	       auth_tok->session_key.decrypted_key_size);

			decrypted_key_size);

	crypt_stat->flags |= ECRYPTFS_KEY_VALID;

	if (unlikely(ecryptfs_verbosity > 0)) {

		ecryptfs_printk(KERN_DEBUG, "FEK of size [%zd]:\n",
@@ -2196,6 +2210,7 @@ write_tag_3_packet(char *dest, size_t *remaining_bytes, 
		.flags = CRYPTO_TFM_REQ_MAY_SLEEP

	};

	int rc = 0;

	size_t enc_key_size = 0;



	(*packet_size) = 0;

	ecryptfs_from_hex(key_rec->sig, auth_tok->token.password.signature,
@@ -2306,8 +2321,13 @@ write_tag_3_packet(char *dest, size_t *remaining_bytes, 
	if (ecryptfs_verbosity > 0) {

		ecryptfs_printk(KERN_DEBUG, "EFEK of size [%zd]:\n",

				key_rec->enc_key_size);



		enc_key_size = key_rec->enc_key_size <=

				sizeof(key_rec->enc_key) ?

				key_rec->enc_key_size :

				sizeof(key_rec->enc_key);

		ecryptfs_dump_hex(key_rec->enc_key,

				  key_rec->enc_key_size);

				enc_key_size);

	}

encrypted_session_key_set:

	/* This format is inspired by OpenPGP; see RFC 2440