From 5babe9c177c364521e3e682b949c5a8c47f4a441 Mon Sep 17 00:00:00 2001 From: HanQuan Date: Tue, 14 Jul 2026 00:57:03 +0000 Subject: [PATCH 01/11] ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body without bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size > 64, decrypt_passphrase_encrypted_session_key() sets decrypted_key_size = encrypted_key_size and performs two out-of-bounds writes: 1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into decrypted_key[64] via scatterlist, overflowing into the parent ecryptfs_auth_tok struct. 2. memcpy(crypt_stat->key, decrypted_key, decrypted_key_size) writes into crypt_stat->key[64], corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. Only AES-192 (cipher code 0x08) enables this because it sets crypt_stat->key_size = 24 independently of encrypted_key_size, allowing crypto_skcipher_setkey() to succeed while encrypted_key_size exceeds ECRYPTFS_MAX_KEY_BYTES. The PKI decryption path (parse_tag_65_packet) already validates decrypted_key_size <= ECRYPTFS_MAX_KEY_BYTES; the passphrase path omits this check. Bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also protects the 512-byte encrypted_key[] buffer, so the former 512-byte check is removed as redundant. Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig") Cc: Signed-off-by: HanQuan [tyhicks: Adjust the code comment to refer to macros representing the buffer sizes rather than mentioning the buffer size values since they may change in the future] Signed-off-by: Tyler Hicks --- fs/ecryptfs/keystore.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c index ebebc9551f1f..e200ab0eba16 100644 --- a/fs/ecryptfs/keystore.c +++ b/fs/ecryptfs/keystore.c @@ -1384,10 +1384,20 @@ parse_tag_3_packet(struct ecryptfs_crypt_stat *crypt_stat, } (*new_auth_tok)->session_key.encrypted_key_size = (body_size - (ECRYPTFS_SALT_SIZE + 5)); + /* + * Although encrypted_key_size is copied into the + * encrypted_key[ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES] buffer here, + * it later bounds operations on a smaller buffer: + * decrypt_passphrase_encrypted_session_key() sets decrypted_key_size = + * encrypted_key_size and decrypts into + * decrypted_key[ECRYPTFS_MAX_KEY_BYTES], then memcpy's into + * crypt_stat->key[ECRYPTFS_MAX_KEY_BYTES]. Limit to + * ECRYPTFS_MAX_KEY_BYTES to protect those smaller buffers. + */ if ((*new_auth_tok)->session_key.encrypted_key_size - > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) { + > ECRYPTFS_MAX_KEY_BYTES) { printk(KERN_WARNING "Tag 3 packet contains key larger " - "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n"); + "than ECRYPTFS_MAX_KEY_BYTES\n"); rc = -EINVAL; goto out_free; } From 219644a3ad5518217b2d62cad6d2c36a2308c949 Mon Sep 17 00:00:00 2001 From: Yichong Chen Date: Wed, 1 Jul 2026 13:34:06 +0800 Subject: [PATCH 02/11] ecryptfs: release message context on send failure ecryptfs_send_message_locked() moves a message context from the free list to the allocated list before sending the request to the userspace daemon. If ecryptfs_send_miscdev() fails, the context is left on the allocated list and cannot be reused. Move it back to the free list on failure and clear the caller's pointer. Fixes: f66e883eb618 ("eCryptfs: integrate eCryptfs device handle into the module.") Cc: Signed-off-by: Yichong Chen Signed-off-by: Tyler Hicks --- fs/ecryptfs/messaging.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c index 03c60f0850ca..d53c21e82365 100644 --- a/fs/ecryptfs/messaging.c +++ b/fs/ecryptfs/messaging.c @@ -284,9 +284,16 @@ ecryptfs_send_message_locked(char *data, int data_len, u8 msg_type, mutex_unlock(&ecryptfs_msg_ctx_lists_mux); rc = ecryptfs_send_miscdev(data, data_len, *msg_ctx, msg_type, 0, daemon); - if (rc) + if (rc) { printk(KERN_ERR "%s: Error attempting to send message to " "userspace daemon; rc = [%d]\n", __func__, rc); + mutex_lock(&ecryptfs_msg_ctx_lists_mux); + mutex_lock(&(*msg_ctx)->mux); + ecryptfs_msg_ctx_alloc_to_free(*msg_ctx); + mutex_unlock(&(*msg_ctx)->mux); + mutex_unlock(&ecryptfs_msg_ctx_lists_mux); + *msg_ctx = NULL; + } out: return rc; } From 779972513c2fa8c7938e54976f686091dafff22f Mon Sep 17 00:00:00 2001 From: Yichong Chen Date: Sun, 28 Jun 2026 11:37:25 +0800 Subject: [PATCH 03/11] ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs_exorcise_daemon() drops queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists_mux, but ecryptfs_msg_ctx_alloc_to_free() requires that lock. Take the list lock while moving the queued contexts back to the free list to avoid racing with other global msg ctx list users. Fixes: f66e883eb618 ("eCryptfs: integrate eCryptfs device handle into the module.") Cc: Signed-off-by: Yichong Chen Signed-off-by: Tyler Hicks --- fs/ecryptfs/messaging.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c index d53c21e82365..73c7b8215e66 100644 --- a/fs/ecryptfs/messaging.c +++ b/fs/ecryptfs/messaging.c @@ -166,6 +166,7 @@ int ecryptfs_exorcise_daemon(struct ecryptfs_daemon *daemon) mutex_unlock(&daemon->mux); goto out; } + mutex_lock(&ecryptfs_msg_ctx_lists_mux); list_for_each_entry_safe(msg_ctx, msg_ctx_tmp, &daemon->msg_ctx_out_queue, daemon_out_list) { list_del(&msg_ctx->daemon_out_list); @@ -174,6 +175,7 @@ int ecryptfs_exorcise_daemon(struct ecryptfs_daemon *daemon) "the out queue of a dying daemon\n", __func__); ecryptfs_msg_ctx_alloc_to_free(msg_ctx); } + mutex_unlock(&ecryptfs_msg_ctx_lists_mux); hlist_del(&daemon->euid_chain); mutex_unlock(&daemon->mux); kfree_sensitive(daemon); From 2602b79c5b3e2f6fce12e38a670f8e3fda4e46a2 Mon Sep 17 00:00:00 2001 From: Yichong Chen Date: Wed, 15 Jul 2026 13:20:04 +0800 Subject: [PATCH 04/11] ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE_SIZE - 8. For version 1 headers the packet set starts later in the header, so this can overstate the available buffer. Pass the actual packet set buffer length from the caller and calculate per-packet limits from the remaining bytes in that buffer. Recompute the remaining length after consuming a tag 3 packet before parsing the following tag 11 packet. Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig") Cc: Signed-off-by: Yichong Chen Signed-off-by: Tyler Hicks --- fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 ++- fs/ecryptfs/keystore.c | 23 ++++++++++++++++++++--- 3 files changed, 23 insertions(+), 5 deletions(-) diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c index 74b02b55e3f6..e67119b6029c 100644 --- a/fs/ecryptfs/crypto.c +++ b/fs/ecryptfs/crypto.c @@ -1197,7 +1197,7 @@ static int ecryptfs_read_headers_virt(char *page_virt, } else set_default_header_data(crypt_stat); rc = ecryptfs_parse_packet_set(crypt_stat, (page_virt + offset), - ecryptfs_dentry); + PAGE_SIZE - offset, ecryptfs_dentry); out: return rc; } diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h index f4f56a92bd56..7d2488a10b17 100644 --- a/fs/ecryptfs/ecryptfs_kernel.h +++ b/fs/ecryptfs/ecryptfs_kernel.h @@ -580,7 +580,8 @@ int ecryptfs_generate_key_packet_set(char *dest_base, size_t *len, size_t max); int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat, - unsigned char *src, struct dentry *ecryptfs_dentry); + unsigned char *src, size_t src_size, + struct dentry *ecryptfs_dentry); int ecryptfs_truncate(struct dentry *dentry, loff_t new_length); ssize_t ecryptfs_getxattr_lower(struct dentry *lower_dentry, struct inode *lower_inode, diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c index e200ab0eba16..6402c0cdb7f4 100644 --- a/fs/ecryptfs/keystore.c +++ b/fs/ecryptfs/keystore.c @@ -1714,6 +1714,7 @@ decrypt_passphrase_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok, * ecryptfs_parse_packet_set * @crypt_stat: The cryptographic context * @src: Virtual address of region of memory containing the packets + * @src_size: Size of the packet set buffer * @ecryptfs_dentry: The eCryptfs dentry associated with the packet set * * Get crypt_stat to have the file's session key if the requisite key @@ -1724,7 +1725,7 @@ decrypt_passphrase_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok, * conditions. */ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat, - unsigned char *src, + unsigned char *src, size_t src_size, struct dentry *ecryptfs_dentry) { size_t i = 0; @@ -1746,7 +1747,11 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat, * added the our &auth_tok_list */ next_packet_is_auth_tok_packet = 1; while (next_packet_is_auth_tok_packet) { - size_t max_packet_size = ((PAGE_SIZE - 8) - i); + size_t max_packet_size; + + if (i >= src_size) + break; + max_packet_size = src_size - i; switch (src[i]) { case ECRYPTFS_TAG_3_PACKET_TYPE: @@ -1761,12 +1766,16 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat, goto out_wipe_list; } i += packet_size; + if (i > src_size) { + rc = -EIO; + goto out_wipe_list; + } rc = parse_tag_11_packet((unsigned char *)&src[i], sig_tmp_space, ECRYPTFS_SIG_SIZE, &tag_11_contents_size, &tag_11_packet_size, - max_packet_size); + src_size - i); if (rc) { ecryptfs_printk(KERN_ERR, "No valid " "(ecryptfs-specific) literal " @@ -1778,6 +1787,10 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat, goto out_wipe_list; } i += tag_11_packet_size; + if (i > src_size) { + rc = -EIO; + goto out_wipe_list; + } if (ECRYPTFS_SIG_SIZE != tag_11_contents_size) { ecryptfs_printk(KERN_ERR, "Expected " "signature of size [%d]; " @@ -1803,6 +1816,10 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat, goto out_wipe_list; } i += packet_size; + if (i > src_size) { + rc = -EIO; + goto out_wipe_list; + } crypt_stat->flags |= ECRYPTFS_ENCRYPTED; break; case ECRYPTFS_TAG_11_PACKET_TYPE: From 8b2ec0f56f55477f547d332526c9ae2a8fabc0a5 Mon Sep 17 00:00:00 2001 From: Yichong Chen Date: Wed, 15 Jul 2026 13:20:05 +0800 Subject: [PATCH 05/11] ecryptfs: fix tag 11 packet exact-fit size check parse_tag_11_packet() rejects a packet when the already-consumed tag and length bytes plus the packet body exceed the caller supplied maximum packet size. The check currently adds one extra byte, even though *packet_size already includes the tag byte before the length is parsed. Remove the extra byte so a tag 11 packet that exactly fits the available buffer is accepted while oversized packets are still rejected. Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig") Cc: Signed-off-by: Yichong Chen Signed-off-by: Tyler Hicks --- fs/ecryptfs/keystore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c index 6402c0cdb7f4..19bccba74c82 100644 --- a/fs/ecryptfs/keystore.c +++ b/fs/ecryptfs/keystore.c @@ -1547,7 +1547,7 @@ parse_tag_11_packet(unsigned char *data, unsigned char *contents, } (*packet_size) += length_size; (*tag_11_contents_size) = (body_size - 14); - if (unlikely((*packet_size) + body_size + 1 > max_packet_size)) { + if (unlikely((*packet_size) + body_size > max_packet_size)) { printk(KERN_ERR "Packet size exceeds max\n"); rc = -EINVAL; goto out; From e97bbe1b2bd82ec2ae37ad2e4965b4d3e78bbf7f Mon Sep 17 00:00:00 2001 From: Yichong Chen Date: Wed, 15 Jul 2026 13:20:06 +0800 Subject: [PATCH 06/11] ecryptfs: reject too-small tag 70 packets ecryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed fields can underflow that size calculation. Reject tag 70 packets before the subtraction unless the body contains the signature, cipher code, and at least one byte of encrypted filename data. Fixes: 9c79f34f7ee7 ("eCryptfs: Filename Encryption: Tag 70 packets") Cc: Signed-off-by: Yichong Chen Signed-off-by: Tyler Hicks --- fs/ecryptfs/keystore.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c index 19bccba74c82..51651314b7a6 100644 --- a/fs/ecryptfs/keystore.c +++ b/fs/ecryptfs/keystore.c @@ -894,6 +894,12 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size, "rc = [%d]\n", __func__, rc); goto out; } + if (s->parsed_tag_70_packet_size < (ECRYPTFS_SIG_SIZE + 2)) { + ecryptfs_printk(KERN_WARNING, "Invalid packet size [%zd]\n", + s->parsed_tag_70_packet_size); + rc = -EINVAL; + goto out; + } s->block_aligned_filename_size = (s->parsed_tag_70_packet_size - ECRYPTFS_SIG_SIZE - 1); if ((1 + s->packet_size_len + s->parsed_tag_70_packet_size) From 95540462e630edbc8504e9537d16453d6942d143 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Mon, 20 Jul 2026 19:56:24 +0800 Subject: [PATCH 07/11] eCryptfs: bound the packet-length peek to the user buffer ecryptfs_miscdev_write() accepts the minimum one-byte packet-length encoding, but always copies the maximum two-byte encoding from userspace before parsing it. A six-byte message therefore reads one byte beyond the submitted user buffer. Zero-initialize the peek buffer and copy only the packet-length bytes present. The existing exact packet-size check still rejects truncated two-byte encodings after the parser determines their encoded length. Fixes: 8bf2debd5f7b ("eCryptfs: introduce device handle for userspace daemon communications") Cc: Signed-off-by: Pengpeng Hou Signed-off-by: Tyler Hicks --- fs/ecryptfs/miscdev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c index 5a7d08149922..68804399a5df 100644 --- a/fs/ecryptfs/miscdev.c +++ b/fs/ecryptfs/miscdev.c @@ -360,7 +360,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf, u32 seq; size_t packet_size, packet_size_length; char *data; - unsigned char packet_size_peek[ECRYPTFS_MAX_PKT_LEN_SIZE]; + unsigned char packet_size_peek[ECRYPTFS_MAX_PKT_LEN_SIZE] = { }; ssize_t rc; if (count == 0) { @@ -376,7 +376,8 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf, } if (copy_from_user(packet_size_peek, &buf[PKT_LEN_OFFSET], - sizeof(packet_size_peek))) { + min_t(size_t, count - PKT_LEN_OFFSET, + sizeof(packet_size_peek)))) { printk(KERN_WARNING "%s: Error while inspecting packet size\n", __func__); return -EFAULT; From 496ec2d0852a02d2e631771b5c439130b9c7dce7 Mon Sep 17 00:00:00 2001 From: Yichong Chen Date: Thu, 2 Jul 2026 13:29:58 +0800 Subject: [PATCH 08/11] ecryptfs: show filename encryption options ecryptfs_show_options() prints most user-visible mount options but omits the filename encryption cipher and key size. Print ecryptfs_fn_cipher and ecryptfs_fn_key_bytes when filename encryption is enabled so that the displayed mount options reflect the active filename encryption settings. Fixes: 87c94c4df014 ("eCryptfs: Filename Encryption: mount option") Cc: Signed-off-by: Yichong Chen Signed-off-by: Tyler Hicks --- fs/ecryptfs/super.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c index 3bc21d677564..686b2b4a9cb5 100644 --- a/fs/ecryptfs/super.c +++ b/fs/ecryptfs/super.c @@ -150,6 +150,13 @@ static int ecryptfs_show_options(struct seq_file *m, struct dentry *root) if (mount_crypt_stat->global_default_cipher_key_size) seq_printf(m, ",ecryptfs_key_bytes=%zd", mount_crypt_stat->global_default_cipher_key_size); + if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) { + seq_printf(m, ",ecryptfs_fn_cipher=%s", + mount_crypt_stat->global_default_fn_cipher_name); + if (mount_crypt_stat->global_default_fn_cipher_key_bytes) + seq_printf(m, ",ecryptfs_fn_key_bytes=%zd", + mount_crypt_stat->global_default_fn_cipher_key_bytes); + } if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) seq_printf(m, ",ecryptfs_passthrough"); if (mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) From 8fafd7c86fc35bd11eb34d4ab2d6282b3354f30f Mon Sep 17 00:00:00 2001 From: Yichong Chen Date: Tue, 30 Jun 2026 11:08:00 +0800 Subject: [PATCH 09/11] ecryptfs: avoid heap allocation for inode size write ecryptfs_write_inode_size_to_header() allocates an 8-byte buffer only to write the encoded inode size to the lower file header. Use a stack __be64 value instead. This avoids an unnecessary allocation and removes a failure path without changing the data written to disk. Signed-off-by: Yichong Chen Signed-off-by: Tyler Hicks --- fs/ecryptfs/mmap.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c index 2c2b12fedeae..0222f98143ab 100644 --- a/fs/ecryptfs/mmap.c +++ b/fs/ecryptfs/mmap.c @@ -355,24 +355,17 @@ static int ecryptfs_write_begin(const struct kiocb *iocb, */ static int ecryptfs_write_inode_size_to_header(struct inode *ecryptfs_inode) { - char *file_size_virt; + __be64 file_size; int rc; - file_size_virt = kmalloc(sizeof(u64), GFP_KERNEL); - if (!file_size_virt) { - rc = -ENOMEM; - goto out; - } - put_unaligned_be64(i_size_read(ecryptfs_inode), file_size_virt); - rc = ecryptfs_write_lower(ecryptfs_inode, file_size_virt, 0, - sizeof(u64)); - kfree(file_size_virt); + file_size = cpu_to_be64(i_size_read(ecryptfs_inode)); + rc = ecryptfs_write_lower(ecryptfs_inode, (char *)&file_size, 0, + sizeof(file_size)); if (rc < 0) printk(KERN_ERR "%s: Error writing file size to header; " "rc = [%d]\n", __func__, rc); else rc = 0; -out: return rc; } From 21a6287ae2489426d23979e2213033dd204aa9fa Mon Sep 17 00:00:00 2001 From: Aditya Prakash Srivastava Date: Fri, 3 Jul 2026 09:00:44 +0000 Subject: [PATCH 10/11] ecryptfs: use filemap_dirty_folio for address space operations ecryptfs does not use buffer_heads. The legacy block_dirty_folio and block_invalidate_folio mapping operations were only added as a temporary compatibility fallback under CONFIG_BLOCK. Since ecryptfs does not attach private metadata (such as buffer_heads) to its folios, block_dirty_folio is unnecessary. Modernize ecryptfs to use filemap_dirty_folio for its dirty_folio address space operation. This allows removing the block_dirty_folio and block_invalidate_folio fallbacks, removing the buffer_head header include, and removing the CONFIG_BLOCK dependency inside ecryptfs_aops. Signed-off-by: Aditya Prakash Srivastava Reviewed-by: Christoph Hellwig Signed-off-by: Tyler Hicks --- fs/ecryptfs/mmap.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c index 0222f98143ab..07a6c8448100 100644 --- a/fs/ecryptfs/mmap.c +++ b/fs/ecryptfs/mmap.c @@ -503,21 +503,8 @@ static sector_t ecryptfs_bmap(struct address_space *mapping, sector_t block) return block; } -#include - const struct address_space_operations ecryptfs_aops = { - /* - * XXX: This is pretty broken for multiple reasons: ecryptfs does not - * actually use buffer_heads, and ecryptfs will crash without - * CONFIG_BLOCK. But it matches the behavior before the default for - * address_space_operations without the ->dirty_folio method was - * cleaned up, so this is the best we can do without maintainer - * feedback. - */ -#ifdef CONFIG_BLOCK - .dirty_folio = block_dirty_folio, - .invalidate_folio = block_invalidate_folio, -#endif + .dirty_folio = filemap_dirty_folio, .writepages = ecryptfs_writepages, .read_folio = ecryptfs_read_folio, .write_begin = ecryptfs_write_begin, From f81cb44f9a4b88d73ee5dec4a1ccdb0232fd2e3f Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Tue, 21 Jul 2026 17:08:12 -0700 Subject: [PATCH 11/11] ecryptfs: ecryptfs_kernel.h: clean up kernel-doc comments - don't use "/**" for non-kernel-doc comments - use the struct keyword when describing structs - delete one Excess struct member to prevent the following warnings: Warning: ./fs/ecryptfs/ecryptfs_kernel.h:14 cannot understand function prototype: 'ECRYPTFS_KERNEL_H' Warning: ./fs/ecryptfs/ecryptfs_kernel.h:207 This comment starts with '/**', but isn't a kernel-doc comment. * This is the primary struct associated with each encrypted file. Warning: ./fs/ecryptfs/ecryptfs_kernel.h:275 cannot understand function prototype: 'struct ecryptfs_global_auth_tok' Warning: fs/ecryptfs/ecryptfs_kernel.h:283 Excess struct member 'global_auth_tok' description in 'ecryptfs_global_auth_tok' Warning: ./fs/ecryptfs/ecryptfs_kernel.h:298 cannot understand function prototype: 'struct ecryptfs_key_tfm' Warning: ./fs/ecryptfs/ecryptfs_kernel.h:309 This comment starts with '/**', but isn't a kernel-doc comment. * This struct is to enable a mount-wide passphrase/salt combo. This Signed-off-by: Randy Dunlap Signed-off-by: Tyler Hicks --- fs/ecryptfs/ecryptfs_kernel.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h index 7d2488a10b17..58165928ed1e 100644 --- a/fs/ecryptfs/ecryptfs_kernel.h +++ b/fs/ecryptfs/ecryptfs_kernel.h @@ -1,5 +1,5 @@ /* SPDX-License-Identifier: GPL-2.0-or-later */ -/** +/* * eCryptfs: Linux filesystem encryption layer * Kernel declarations. * @@ -204,7 +204,7 @@ struct ecryptfs_filename { char dentry_name[ECRYPTFS_ENCRYPTED_DENTRY_NAME_LEN + 1]; }; -/** +/* * This is the primary struct associated with each encrypted file. * * TODO: cache align/pack? @@ -255,7 +255,8 @@ struct ecryptfs_inode_info { }; /** - * ecryptfs_global_auth_tok - A key used to encrypt all new files under the mountpoint + * struct ecryptfs_global_auth_tok - A key used to encrypt all new files + * under the mountpoint * @flags: Status flags * @mount_crypt_stat_list: These auth_toks hang off the mount-wide * cryptographic context. Every time a new @@ -263,7 +264,6 @@ struct ecryptfs_inode_info { * the auth_toks on that list to the set of * auth_toks on the inode's crypt_stat * @global_auth_tok_key: The key from the user's keyring for the sig - * @global_auth_tok: The key contents * @sig: The key identifier * * ecryptfs_global_auth_tok structs refer to authentication token keys @@ -283,7 +283,7 @@ struct ecryptfs_global_auth_tok { }; /** - * ecryptfs_key_tfm - Persistent key tfm + * struct ecryptfs_key_tfm - Persistent key tfm * @key_tfm: crypto API handle to the key * @key_size: Key size in bytes * @key_tfm_mutex: Mutex to ensure only one operation in eCryptfs is @@ -306,7 +306,7 @@ struct ecryptfs_key_tfm { extern struct mutex key_tfm_list_mutex; -/** +/* * This struct is to enable a mount-wide passphrase/salt combo. This * is more or less a stopgap to provide similar functionality to other * crypto filesystems like EncFS or CFS until full policy support is