* [syzbot] [crypto?] KMSAN: uninit-value in des3_ede_decrypt
@ 2024-02-20 14:42 syzbot
2024-02-21 9:07 ` [PATCH] crypto: lskcipher - Copy IV in lskcipher glue code always Herbert Xu
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2024-02-20 14:42 UTC (permalink / raw)
To: davem, herbert, linux-crypto, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 4f5e5092fdbf Merge tag 'net-6.8-rc5' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1679e7b2180000
kernel config: https://syzkaller.appspot.com/x/.config?x=e3dd779fba027968
dashboard link: https://syzkaller.appspot.com/bug?extid=b90b904ef6bdfdafec1d
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/34924e0466d4/disk-4f5e5092.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/29d0b1935c61/vmlinux-4f5e5092.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2e033c3d8679/bzImage-4f5e5092.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b90b904ef6bdfdafec1d@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in des3_ede_decrypt+0x845/0x19a0 lib/crypto/des.c:884
des3_ede_decrypt+0x845/0x19a0 lib/crypto/des.c:884
crypto_des3_ede_decrypt+0x32/0x40 crypto/des_generic.c:82
crypto_ecb_crypt crypto/ecb.c:23 [inline]
crypto_ecb_decrypt2+0x18b/0x2f0 crypto/ecb.c:51
crypto_lskcipher_crypt+0x66d/0x750 crypto/lskcipher.c:160
crypto_lskcipher_decrypt+0x82/0xb0 crypto/lskcipher.c:194
crypto_cbc_decrypt_inplace crypto/cbc.c:108 [inline]
crypto_cbc_decrypt+0x4df/0x8e0 crypto/cbc.c:131
crypto_lskcipher_crypt_sg+0x43f/0x930 crypto/lskcipher.c:229
crypto_lskcipher_decrypt_sg+0x8a/0xc0 crypto/lskcipher.c:258
crypto_skcipher_decrypt+0x10d/0x1c0 crypto/skcipher.c:693
cts_cbc_decrypt+0x51b/0x720 crypto/cts.c:219
crypto_cts_decrypt+0x77f/0x9b0 crypto/cts.c:280
crypto_skcipher_decrypt+0x189/0x1c0 crypto/skcipher.c:695
_skcipher_recvmsg crypto/algif_skcipher.c:199 [inline]
skcipher_recvmsg+0x1691/0x2190 crypto/algif_skcipher.c:221
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg net/socket.c:1068 [inline]
____sys_recvmsg+0x283/0x7f0 net/socket.c:2803
___sys_recvmsg+0x223/0x840 net/socket.c:2845
do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
__sys_recvmmsg net/socket.c:3018 [inline]
__do_sys_recvmmsg net/socket.c:3041 [inline]
__se_sys_recvmmsg net/socket.c:3034 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
memcpy_dir crypto/scatterwalk.c:23 [inline]
scatterwalk_copychunks crypto/scatterwalk.c:38 [inline]
scatterwalk_map_and_copy+0x6dc/0x9a0 crypto/scatterwalk.c:67
cts_cbc_decrypt+0x3e2/0x720 crypto/cts.c:211
crypto_cts_decrypt+0x77f/0x9b0 crypto/cts.c:280
crypto_skcipher_decrypt+0x189/0x1c0 crypto/skcipher.c:695
_skcipher_recvmsg crypto/algif_skcipher.c:199 [inline]
skcipher_recvmsg+0x1691/0x2190 crypto/algif_skcipher.c:221
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg net/socket.c:1068 [inline]
____sys_recvmsg+0x283/0x7f0 net/socket.c:2803
___sys_recvmsg+0x223/0x840 net/socket.c:2845
do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
__sys_recvmmsg net/socket.c:3018 [inline]
__do_sys_recvmmsg net/socket.c:3041 [inline]
__se_sys_recvmmsg net/socket.c:3034 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
cts_cbc_decrypt+0x3a3/0x720 crypto/cts.c:208
crypto_cts_decrypt+0x77f/0x9b0 crypto/cts.c:280
crypto_skcipher_decrypt+0x189/0x1c0 crypto/skcipher.c:695
_skcipher_recvmsg crypto/algif_skcipher.c:199 [inline]
skcipher_recvmsg+0x1691/0x2190 crypto/algif_skcipher.c:221
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg net/socket.c:1068 [inline]
____sys_recvmsg+0x283/0x7f0 net/socket.c:2803
___sys_recvmsg+0x223/0x840 net/socket.c:2845
do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
__sys_recvmmsg net/socket.c:3018 [inline]
__do_sys_recvmmsg net/socket.c:3041 [inline]
__se_sys_recvmmsg net/socket.c:3034 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
__crypto_xor+0x171/0x1310 lib/crypto/utils.c:45
crypto_xor include/crypto/utils.h:31 [inline]
cts_cbc_decrypt+0x2da/0x720 crypto/cts.c:199
crypto_cts_decrypt+0x77f/0x9b0 crypto/cts.c:280
crypto_skcipher_decrypt+0x189/0x1c0 crypto/skcipher.c:695
_skcipher_recvmsg crypto/algif_skcipher.c:199 [inline]
skcipher_recvmsg+0x1691/0x2190 crypto/algif_skcipher.c:221
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg net/socket.c:1068 [inline]
____sys_recvmsg+0x283/0x7f0 net/socket.c:2803
___sys_recvmsg+0x223/0x840 net/socket.c:2845
do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
__sys_recvmmsg net/socket.c:3018 [inline]
__do_sys_recvmmsg net/socket.c:3041 [inline]
__se_sys_recvmmsg net/socket.c:3034 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
memcpy_dir crypto/scatterwalk.c:23 [inline]
scatterwalk_copychunks crypto/scatterwalk.c:38 [inline]
scatterwalk_map_and_copy+0x6dc/0x9a0 crypto/scatterwalk.c:67
cts_cbc_decrypt+0x1b9/0x720 crypto/cts.c:197
crypto_cts_decrypt+0x77f/0x9b0 crypto/cts.c:280
crypto_skcipher_decrypt+0x189/0x1c0 crypto/skcipher.c:695
_skcipher_recvmsg crypto/algif_skcipher.c:199 [inline]
skcipher_recvmsg+0x1691/0x2190 crypto/algif_skcipher.c:221
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg net/socket.c:1068 [inline]
____sys_recvmsg+0x283/0x7f0 net/socket.c:2803
___sys_recvmsg+0x223/0x840 net/socket.c:2845
do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
__sys_recvmmsg net/socket.c:3018 [inline]
__do_sys_recvmmsg net/socket.c:3041 [inline]
__se_sys_recvmmsg net/socket.c:3034 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
__crypto_xor+0x171/0x1310 lib/crypto/utils.c:45
crypto_xor include/crypto/utils.h:31 [inline]
crypto_cbc_decrypt_segment crypto/cbc.c:81 [inline]
crypto_cbc_decrypt+0x2b1/0x8e0 crypto/cbc.c:133
crypto_lskcipher_crypt_sg+0x43f/0x930 crypto/lskcipher.c:229
crypto_lskcipher_decrypt_sg+0x8a/0xc0 crypto/lskcipher.c:258
crypto_skcipher_decrypt+0x10d/0x1c0 crypto/skcipher.c:693
crypto_cts_decrypt+0x704/0x9b0 crypto/cts.c:279
crypto_skcipher_decrypt+0x189/0x1c0 crypto/skcipher.c:695
_skcipher_recvmsg crypto/algif_skcipher.c:199 [inline]
skcipher_recvmsg+0x1691/0x2190 crypto/algif_skcipher.c:221
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg net/socket.c:1068 [inline]
____sys_recvmsg+0x283/0x7f0 net/socket.c:2803
___sys_recvmsg+0x223/0x840 net/socket.c:2845
do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
__sys_recvmmsg net/socket.c:3018 [inline]
__do_sys_recvmmsg net/socket.c:3041 [inline]
__se_sys_recvmmsg net/socket.c:3034 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3819 [inline]
slab_alloc_node mm/slub.c:3860 [inline]
__do_kmalloc_node mm/slub.c:3980 [inline]
__kmalloc+0x919/0xf80 mm/slub.c:3994
kmalloc include/linux/slab.h:594 [inline]
sock_kmalloc+0x134/0x1f0 net/core/sock.c:2685
af_alg_alloc_areq+0xe4/0x3a0 crypto/af_alg.c:1202
_skcipher_recvmsg crypto/algif_skcipher.c:118 [inline]
skcipher_recvmsg+0x4f0/0x2190 crypto/algif_skcipher.c:221
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg net/socket.c:1068 [inline]
____sys_recvmsg+0x283/0x7f0 net/socket.c:2803
___sys_recvmsg+0x223/0x840 net/socket.c:2845
do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
__sys_recvmmsg net/socket.c:3018 [inline]
__do_sys_recvmmsg net/socket.c:3041 [inline]
__se_sys_recvmmsg net/socket.c:3034 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
CPU: 0 PID: 11510 Comm: syz-executor.0 Not tainted 6.8.0-rc4-syzkaller-00180-g4f5e5092fdbf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH] crypto: lskcipher - Copy IV in lskcipher glue code always
2024-02-20 14:42 [syzbot] [crypto?] KMSAN: uninit-value in des3_ede_decrypt syzbot
@ 2024-02-21 9:07 ` Herbert Xu
0 siblings, 0 replies; 2+ messages in thread
From: Herbert Xu @ 2024-02-21 9:07 UTC (permalink / raw)
To: syzbot; +Cc: davem, linux-crypto, linux-kernel, syzkaller-bugs
The lskcipher glue code for skcipher needs to copy the IV every
time rather than only on the first and last request. Otherwise
those algorithms that use IV to perform chaining may break, e.g.,
CBC.
This is because crypto_skcipher_import/export do not include the
IV as part of the saved state.
Reported-by: syzbot+b90b904ef6bdfdafec1d@syzkaller.appspotmail.com
Fixes: 662ea18d089b ("crypto: skcipher - Make use of internal state")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/crypto/lskcipher.c b/crypto/lskcipher.c
index 0b6dd8aa21f2..0f1bd7dcde24 100644
--- a/crypto/lskcipher.c
+++ b/crypto/lskcipher.c
@@ -212,13 +212,12 @@ static int crypto_lskcipher_crypt_sg(struct skcipher_request *req,
ivsize = crypto_lskcipher_ivsize(tfm);
ivs = PTR_ALIGN(ivs, crypto_skcipher_alignmask(skcipher) + 1);
+ memcpy(ivs, req->iv, ivsize);
flags = req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP;
if (req->base.flags & CRYPTO_SKCIPHER_REQ_CONT)
flags |= CRYPTO_LSKCIPHER_FLAG_CONT;
- else
- memcpy(ivs, req->iv, ivsize);
if (!(req->base.flags & CRYPTO_SKCIPHER_REQ_NOTFINAL))
flags |= CRYPTO_LSKCIPHER_FLAG_FINAL;
@@ -234,8 +233,7 @@ static int crypto_lskcipher_crypt_sg(struct skcipher_request *req,
flags |= CRYPTO_LSKCIPHER_FLAG_CONT;
}
- if (flags & CRYPTO_LSKCIPHER_FLAG_FINAL)
- memcpy(req->iv, ivs, ivsize);
+ memcpy(req->iv, ivs, ivsize);
return err;
}
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-02-21 9:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-02-20 14:42 [syzbot] [crypto?] KMSAN: uninit-value in des3_ede_decrypt syzbot
2024-02-21 9:07 ` [PATCH] crypto: lskcipher - Copy IV in lskcipher glue code always Herbert Xu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®