Re: [PATCH v2] eCryptfs: bound the packet-length peek to the user buffer

[Tyler Hicks]

On Mon, 20 Jul 2026 19:56:24 +0800, Pengpeng Hou wrote:
> ecryptfs_miscdev_write() accepts the minimum one-byte packet-length
> encoding, but always copies the maximum two-byte encoding from userspace
> before parsing it. A six-byte message therefore reads one byte beyond the
> submitted user buffer.
> 
> Zero-initialize the peek buffer and copy only the packet-length bytes
> present. The existing exact packet-size check still rejects truncated
> two-byte encodings after the parser determines their encoded length.
> 
> [...]

Thank you! This has been applied to the next branch of the tyhicks/ecryptfs.git tree.

You can find a direct link below but please be aware that the commit hash is
unstable and, therefore, the URL may not be valid in the future.

[1/1] eCryptfs: bound the packet-length peek to the user buffer
      https://git.kernel.org/tyhicks/ecryptfs/c/95540462e630edbc8504e9537d16453d6942d143

Tyler