[PATCH] ecryptfs: check the message wait timeout at load time

[Yingjie Wang]

ecryptfs_wait_for_response() multiplies the ecryptfs_message_wait_timeout
module parameter by HZ and passes the result to
schedule_timeout_interruptible(). The parameter is a signed long with no
semantic range check. Negative and sufficiently large positive values can
produce an invalid timeout when multiplied by HZ. A negative result makes
schedule_timeout() print "wrong timeout value" with a stack dump and return
at once. Requests to ecryptfsd then fail with -EIO without waiting for its
reply. On x86-64 with HZ=1000, -1 and 9223372036854776 made creating a file
in a private-key mount fail within 10 ms although the daemon answered after
0.7 seconds.

The parameter cannot be changed after load, so validate it once in
ecryptfs_init_messaging(). Warn and restore the three-second default for
values below zero or above MAX_JIFFY_OFFSET / HZ, following the load-time
normalization pattern already used for ecryptfs_number_of_users.

Fixes: dddfa461fc89 ("[PATCH] eCryptfs: Public key; packet management")
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---

Notes:
    Tested on x86-64 (HZ=1000) in QEMU by loading the module with each
    value and creating a file in a mount that uses a private-key auth token;
    a test program held /dev/ecryptfs and answered the tag 66 request after
    700 ms. With the patch, -1, 9223372036854776, 9223372036854775 and
    4611686018427388 log the new warning, fall back to 3 seconds, and the
    create succeeds; 2 and 4611686018427387 behave the same on both
    kernels. Also built for i386 with W=1.

 fs/ecryptfs/messaging.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
index 73c7b8215e66..80f53bcb9079 100644
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -371,6 +371,13 @@ int __init ecryptfs_init_messaging(void)
 		       "too large, defaulting to [%d] users\n", __func__,
 		       ecryptfs_number_of_users);
 	}
+	/* ecryptfs_wait_for_response() multiplies this by HZ */
+	if (ecryptfs_message_wait_timeout < 0 ||
+	    ecryptfs_message_wait_timeout > MAX_JIFFY_OFFSET / HZ) {
+		ecryptfs_message_wait_timeout = ECRYPTFS_MAX_MSG_CTX_TTL / HZ;
+		pr_warn("%s: Message wait timeout out of range, defaulting to [%ld] seconds\n",
+			__func__, ecryptfs_message_wait_timeout);
+	}
 	mutex_lock(&ecryptfs_daemon_hash_mux);
 	ecryptfs_hash_bits = 1;
 	while (ecryptfs_number_of_users >> ecryptfs_hash_bits)

base-commit: 8f6626bd6594a78f454d02b27b74a580c890cab9
-- 
2.43.0