[PATCH] dm-crypt: reject the lmk IV mode with AEAD ciphers

[PATCH] dm-crypt: reject the lmk IV mode with AEAD ciphers

[Ben Cressey]

A "capi:" table line that pairs an AEAD cipher with the lmk IV mode,
for example "capi:gcm(aes)-lmk" with the integrity:28:aead option,
causes an oops when it is loaded. lmk sets tfms_count to 64, but
crypt_alloc_tfms_aead only allocates one transform, so crypt_setkey
reads past the end of the tfms_aead array and calls crypto_aead_setkey
on the values it finds there.

lmk exists for compatibility with Loop-AES, which uses CBC, so refuse
it with an AEAD cipher rather than allocate 64 AEAD transforms. The
check cannot go in crypt_iv_lmk_ctr with the other lmk checks, because
the IV constructor runs after crypt_set_key.

Fixes: 33d2f09fcb35 ("dm crypt: introduce new format of cipher with "capi:" prefix")
Cc: stable@vger.kernel.org
Signed-off-by: Ben Cressey <ben@cressey.dev>
Assisted-by: LLM
---
To reproduce, with slub_debug=P: dmsetup create x --table "0 <n> crypt
capi:gcm(aes)-lmk <32-byte key> 0 /dev/ram0 0 1 integrity:28:aead".
No integrity profile is needed on the underlying device; crypt_setkey
runs before dm-crypt checks for one.
---
 drivers/md/dm-crypt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 9e170de50ad32..0bd22bda3e2de 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2894,8 +2894,13 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key
 		}
 	}
 
-	if (*ivmode && !strcmp(*ivmode, "lmk"))
+	if (*ivmode && !strcmp(*ivmode, "lmk")) {
+		if (crypt_integrity_aead(cc)) {
+			ti->error = "AEAD transforms not supported for LMK";
+			return -EINVAL;
+		}
 		cc->tfms_count = 64;
+	}
 
 	if (*ivmode && !strcmp(*ivmode, "essiv")) {
 		if (!*ivopts) {

---
base-commit: df2908090cda368b01ff43709f51890076c56157
change-id: 20260915-dm-crypt-lmk-aead-2e36abe57e55

Re: [PATCH] dm-crypt: reject the lmk IV mode with AEAD ciphers

[Mikulas Patocka]

Hi

Accepted, thanks.

Mikulas


On Tue, 15 Sep 2026, Ben Cressey wrote:

> A "capi:" table line that pairs an AEAD cipher with the lmk IV mode,
> for example "capi:gcm(aes)-lmk" with the integrity:28:aead option,
> causes an oops when it is loaded. lmk sets tfms_count to 64, but
> crypt_alloc_tfms_aead only allocates one transform, so crypt_setkey
> reads past the end of the tfms_aead array and calls crypto_aead_setkey
> on the values it finds there.
> 
> lmk exists for compatibility with Loop-AES, which uses CBC, so refuse
> it with an AEAD cipher rather than allocate 64 AEAD transforms. The
> check cannot go in crypt_iv_lmk_ctr with the other lmk checks, because
> the IV constructor runs after crypt_set_key.
> 
> Fixes: 33d2f09fcb35 ("dm crypt: introduce new format of cipher with "capi:" prefix")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ben Cressey <ben@cressey.dev>
> Assisted-by: LLM
> ---
> To reproduce, with slub_debug=P: dmsetup create x --table "0 <n> crypt
> capi:gcm(aes)-lmk <32-byte key> 0 /dev/ram0 0 1 integrity:28:aead".
> No integrity profile is needed on the underlying device; crypt_setkey
> runs before dm-crypt checks for one.
> ---
>  drivers/md/dm-crypt.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
> index 9e170de50ad32..0bd22bda3e2de 100644
> --- a/drivers/md/dm-crypt.c
> +++ b/drivers/md/dm-crypt.c
> @@ -2894,8 +2894,13 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key
>  		}
>  	}
>  
> -	if (*ivmode && !strcmp(*ivmode, "lmk"))
> +	if (*ivmode && !strcmp(*ivmode, "lmk")) {
> +		if (crypt_integrity_aead(cc)) {
> +			ti->error = "AEAD transforms not supported for LMK";
> +			return -EINVAL;
> +		}
>  		cc->tfms_count = 64;
> +	}
>  
>  	if (*ivmode && !strcmp(*ivmode, "essiv")) {
>  		if (!*ivopts) {
> 
> ---
> base-commit: df2908090cda368b01ff43709f51890076c56157
> change-id: 20260915-dm-crypt-lmk-aead-2e36abe57e55
>