Re: [PATCH] fsverity: reject short BPF digest buffers
Eric Biggers <[email protected]>
| Newsgroups | dev.linux.lists.fsverity,org.kernel.vger.bpf,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <20260805195013.GD3438@quark> |
On Wed, Aug 05, 2026 at 03:56:55PM +0800, Yichong Chen wrote:
> bpf_get_fsverity_digest() reports the digest size as the full hash digest
> size. However, when the provided dynptr only has room for part of the
> digest, the helper currently copies the truncated digest and still returns
> success.
>
> Returning success with a digest_size that is larger than the actual copied
> digest is misleading for integrity policy code. Match the ioctl
> measurement path and reject too-small output buffers with -EOVERFLOW.
>
> Fixes: 67814c00de31 ("bpf, fsverity: Add kfunc bpf_get_fsverity_digest")
> Signed-off-by: Yichong Chen <[email protected]>
> ---
> fs/verity/measure.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Already handled by https://lore.kernel.org/bpf/[email protected]/
- Eric