From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Wed, 1 Jul 2026 08:58:17 +0000 (-0700)
Subject: client: don't use uninitialized keyid in fscrypt_dummy_encryption
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=d440950eff1302585cc03034b75eb62f841a4d92;p=ceph.git

client: don't use uninitialized keyid in fscrypt_dummy_encryption

When add_fscrypt_key() failed it jumped to the err label, which then
read the uninitialized keyid buffer into a key specifier and issued a
key removal for it. add_fscrypt_key() only populates keyid on success,
so this read uninitialized stack memory. Return the error directly
instead, since no key was added and there is nothing to remove.

Also stop overwriting the original error with remove_fscrypt_key()'s
return value on the policy-set failure path, so the real failure is
reported to the caller.

Fixes: https://tracker.ceph.com/issues/78246
Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---

diff --git a/src/client/Client.cc b/src/client/Client.cc
index fcac11545e7..a12c8647a0e 100644
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -7372,7 +7372,9 @@ int Client::fscrypt_dummy_encryption() {
     char keyid[FSCRYPT_KEY_IDENTIFIER_SIZE];
     int r = add_fscrypt_key(key, sizeof(key), keyid);
     if (r < 0) {
-      goto err;
+      // The key was not added, so keyid is not populated and there is
+      // nothing to remove.
+      return r;
     }
 
     // set dummy encryption policy
@@ -7386,6 +7388,7 @@ int Client::fscrypt_dummy_encryption() {
     memcpy(policy.master_key_identifier, keyid, FSCRYPT_KEY_IDENTIFIER_SIZE);
     r = ll_set_fscrypt_policy_v2(root.get(), policy);
     if (r < 0) {
+      ldout(cct, 0) << __func__ << "(): failed to set dummy encryption policy: r=" << r << dendl;
       goto err;
     }
 
@@ -7398,7 +7401,11 @@ int Client::fscrypt_dummy_encryption() {
     memcpy(key_spec.u.identifier, keyid, FSCRYPT_KEY_IDENTIFIER_SIZE);
     arg.removal_status_flags = 0;
     arg.key_spec = key_spec;
-    r = remove_fscrypt_key(&arg);
+    // Preserve the original failure; don't mask it with the removal result.
+    int r2 = remove_fscrypt_key(&arg);
+    if (r2 < 0) {
+      ldout(cct, 0) << __func__ << "(): failed to remove fscrypt key: r=" << r2 << dendl;
+    }
     return r;
 }
 #endif