Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33;
From:   Yuran Pereira <yuran.pereira@hotmail.com>
To:     linux-crypto@vger.kernel.org, herbert@gondor.apana.org.au
Cc:     Yuran Pereira <yuran.pereira@hotmail.com>, davem@davemloft.net,
        tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
        dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com,
        linux-kernel@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org
Subject: [PATCH 7/7] crypto: Fixes uninitialized skcipher_walk use in aria_gfni_avx512_glue
Date:   Thu,  2 Nov 2023 09:39:31 +0530
Message-ID: <DB3PR10MB68357FC2BB716211CB846DBFE8A6A@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM>
In-Reply-To: <20231102040931.1556061-1-yuran.pereira@hotmail.com>
References: <DB3PR10MB683562E7BD2DC73A48BEA3C8E8A6A@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM>
 <20231102040931.1556061-1-yuran.pereira@hotmail.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB3PR10MB6835:EE_|GV1PR10MB5868:EE_
X-MS-Office365-Filtering-Correlation-Id: 0ba7efec-bbbb-456b-100e-08dbdb59a94f
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: oyy60I2u8CRqhb7c52SHBJgS896bopYObtB+JvUU5lEcGta/aO7Rve/9/DgIUw9TOWrMtR80SfjC71V0GhOjbMONdJwHLH6O8Wn0mbl45DZNnNXD55BLgzUYxqW6GXYVw02C5iz2ySVemrgWRxdy38/4rXlut6efzWQyR3lHhxS40k5WUEmmHkgXrlkRknWTR9j28dqtTysvtZKd2bi+1DMLt7M5G3f/sT0d7uAHFQM4RsyhB2d9Cf/GGNKRcD7vv6h458SDEIr2T6EnpeLiLneDXX94kSd7NY/uLnNfxCaa5YH0DBBxjz8Lm+rGB0HKsc3dYXy5JGCV2QqTDRMwvXffaRv56z5+9oDNwrFdgyrd0pv5zucndwykKiH1o7bzZGEeJ2Wg/3Oh6HowgU6XOpCNqrsY2tI01gYker/xWD5tymtnfz0z8vN+fDCW0EpVbHj8wDa5MZ8mmPG3Tm6is1fqGfoJ3Y06d0bzFOx/h4EVas9F+cZHLwLlaA4Hf6Tw8ZnbX5X0L2Xjflr4OS1jsJArWJy3A9oQFg1jJd+/6Bxu1SvsD8elkugrJpIQrGi6Y3x0w9M0Ue+nRULULdR6r3l/3tlansg+81qWcgT16Wd+2Gx/Jd/HbZ7J3TZSxJch
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?3mnrAZBn3Jfe+bYhCiGDBLIi05dNocamSJHC0POx9kmIcripDyqGkcU5Fn9i?=
 =?us-ascii?Q?Z9ns+iRaXLkYLLxdXsnFsnQs00rdal/iezOdwxt9iIJKiEq4l4+FFuKSEevJ?=
 =?us-ascii?Q?DjDu+KEfP0vKNjF2JX0mFnAUmM8xea0KjT7pjNhuty5kPk5dpN+sCsSgUiHo?=
 =?us-ascii?Q?Nn1ihw7bWnT8hXaGwTOs7w1D9c+wOqvZYxjFTZaD6lsQO8g7NBH2IbKpl68U?=
 =?us-ascii?Q?Kpwien9NxZaAq6iy2usgWg030i4z4UjWXadEbYTIi23LZXsQa/YFHB/DPQBI?=
 =?us-ascii?Q?HmEOVRo/nfCvRxm30/kDnbf5BX+FEMN34opAv35tIrH2yHBet3dtCCoxBflm?=
 =?us-ascii?Q?gcVJ7t0YqBX+u55at6rAiJa79HllameLi96UNrf3pO+4YEi+XyLc+Di++9a2?=
 =?us-ascii?Q?hhRZAW2nwz0YmHXkt5g6vQCu71LaNSsJSE/ow850Dt2ccwVRmXhoGzaVKtTp?=
 =?us-ascii?Q?EWB4r63BjYRL30chrcait6M1T/wjBAnqxRH5GjEKB/BRxR8CF3oERaVGSeHc?=
 =?us-ascii?Q?aFluDXdyXURFvvHdd/y2OSU9/tw7Tk++58oWW41lk/Jjrff/5UKHjcr9S3v5?=
 =?us-ascii?Q?EW466iDN2QlYS7376SwZsKuaMwwRcgqy2cTXpczR6yeg3stbwgX8wF7S1Wau?=
 =?us-ascii?Q?AcPmHmHJlv8hJ7NUbF/g/jVWNCXo3wgxb6NEW17A3gz63fun6ctMrn62t9Se?=
 =?us-ascii?Q?I0Cub1y3j83lMHmtzbgCfi0YLTvNDv5FV9vitM6yik0Uce+KuqUPV0HZli3W?=
 =?us-ascii?Q?qK9HCAf2w8+zv61olEAmdHhW/BI6OUsrHrCu7rvxoG+CZxi4zGOIdDX5yXJr?=
 =?us-ascii?Q?7Jjhqln7BG0f3mr5rsdH5KP9yQzRcf98i10T9ui/14oanZXPi4epznJMmYn3?=
 =?us-ascii?Q?GhgjmC8hEzfssJycuOgCMBdV06CIL6M+HWjTfCr6i6jX2LV94GEL3JlY0vq8?=
 =?us-ascii?Q?kRmZjtPXXY+Uc2vCUBelyYlPiCqgce4VoAOCLPeHq60dnFs0BGY24aIeZTu0?=
 =?us-ascii?Q?9onsEDO20ImW82LPs2YyBoveW5BPuvncCYsSOT5vDfLr408d/nTyN8EuVT5g?=
 =?us-ascii?Q?eKjK/s2xCaIHYftB3S9ZmbsfHhAEn1G1Ix6W1yZdYFbRcjDFboB9EtJBGoI6?=
 =?us-ascii?Q?eawc7W8DwzswYvuVS+uNCuTroRIZe+vWIaVQuEAyeZN0Fncoq+weiJOj9Z70?=
 =?us-ascii?Q?oZV6bkLmbsEAyZ/e2lzX1/MK8eRiLIv02l0NmjxkFbHfylKd1xVU86cEobg?=
 =?us-ascii?Q?=3D?=
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-6b909.templateTenant
X-MS-Exchange-CrossTenant-Network-Message-Id: 0ba7efec-bbbb-456b-100e-08dbdb59a94f
X-MS-Exchange-CrossTenant-AuthSource: DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2023 04:10:34.7547
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR10MB5868
X-Spam-Status: No, score=0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,FORGED_HOTMAIL_RCVD2,FREEMAIL_FORGED_FROMDOMAIN,
	FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=no
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Wed, 01 Nov 2023 21:11:32 -0700 (PDT)

In `aria_avx512_ctr_encrypt`, `struct skcipher_walk *walk` is not fully
initialized before its use.

Although the call to `skcipher_walk_virt()` and subsequent functions
that this function calls seem to initialize some fields of this struct,

there is a chance that `skcipher_walk_virt()` returns
without fully clearing or properly initializing the `->flags` field
which means that the following flags:
`SKCIPHER_WALK_DIFF`, `SKCIPHER_WALK_COPY`, `SKCIPHER_WALK_SLOW`
could be storing junk values by the time `skcipher_walk_done()` is called.

This could lead to buggy or undefined behaviour since these flags
are checked in `skcipher_walk_done()`:

```C
int skcipher_walk_done(struct skcipher_walk *walk, int err)
{
	...
    if (likely(!(walk->flags & (SKCIPHER_WALK_PHYS |
        SKCIPHER_WALK_SLOW |
        SKCIPHER_WALK_COPY |
        SKCIPHER_WALK_DIFF)))) {
    ...
}
```

To prevent this, this patch ensures that instances of
`struct skcipher_walk` are correctly initialized prior to their use.

Addresses-Coverity-IDs: 15916159 ("Unintialized scalar variable")
Signed-off-by: Yuran Pereira <yuran.pereira@hotmail.com>
---
 arch/x86/crypto/aria_gfni_avx512_glue.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/crypto/aria_gfni_avx512_glue.c b/arch/x86/crypto/aria_gfni_avx512_glue.c
index f4a2208d2638..cf689cc880df 100644
--- a/arch/x86/crypto/aria_gfni_avx512_glue.c
+++ b/arch/x86/crypto/aria_gfni_avx512_glue.c
@@ -12,6 +12,7 @@
 #include <linux/err.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/string.h>
 
 #include "ecb_cbc_helpers.h"
 #include "aria-avx.h"
@@ -81,6 +82,7 @@ static int aria_avx512_ctr_encrypt(struct skcipher_request *req)
 	unsigned int nbytes;
 	int err;
 
+	memset(&walk, 0, sizeof(walk));
 	err = skcipher_walk_virt(&walk, req, false);
 
 	while ((nbytes = walk.nbytes) > 0) {
-- 
2.25.1