Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] crypto: xts - Add support for Cipher Text Stealing
To:     Pascal van Leeuwen <pascalvanl@gmail.com>,
        linux-crypto@vger.kernel.org
Cc:     rsnel@cube.dyndns.org, herbert@gondor.apana.org.au,
        davem@davemloft.net,
        Pascal van Leeuwen <pvanleeuwen@verimatrix.com>
References: <1565074510-8480-1-git-send-email-pvanleeuwen@verimatrix.com>
From:   Milan Broz <gmazyland@gmail.com>
Openpgp: preference=signencrypt
Message-ID: <5bf9d0be-3ba4-8903-f1b9-93aa32106274@gmail.com>
Date:   Tue, 6 Aug 2019 20:34:46 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <1565074510-8480-1-git-send-email-pvanleeuwen@verimatrix.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-crypto-owner@vger.kernel.org
Precedence: bulk

On 06/08/2019 08:55, Pascal van Leeuwen wrote:
> This adds support for Cipher Text Stealing for data blocks that are not an
> integer multiple of the cipher block size in size, bringing it fully in
> line with the IEEE P1619/D16 standard.
> 
> This has been tested with the AES-XTS test vectors from the IEEE P1619/D16
> specification as well as some additional test vectors supplied to the
> linux_crypto mailing list previously. It has also been fuzzed against
> Inside Secure AES-XTS hardware which has been actively used in the field
> for more than a decade already.
> 
> Signed-off-by: Pascal van Leeuwen <pvanleeuwen@verimatrix.com>

Wow, it was quick... thanks for this! :)

I tried to test with my wrapper through AF_ALG (with the discussed test vectors),
but it crashed my 32bit i686 VM (Linus tree with your patch applied)

To reproduce it, run this "kernel" af_alg branch of extracted cryptsetup vector testsuite:
https://github.com/mbroz/cryptsetup_backend_test/tree/kernel

(output) ...
CIPHER vector 00: [aes-ecb,128bits][serpent-ecb,128bits]
CIPHER vector 01: [aes-cbc,128bits][serpent-cbc,128bits]
CIPHER vector 02: [aes-ecb,256bits][serpent-ecb,256bits]
CIPHER vector 03: [aes-cbc,256bits][serpent-cbc,256bits]
CIPHER vector 04: [aes-xts,256bits][serpent-xts,256bits]
CIPHER vector 05: [aes-xts,512bits][serpent-xts,512bits]
CIPHER vector 06: [xchacha12,aes-adiantum,256bits][xchacha20,aes-adiantum,256bits]
Segmentation fault


(If you cannot reproduce it, I'll check it tomorrow. It is quite possible
I have a bug in wrapper, but it should definitely not OOPS the kernel...
moreover, this crash is possible from a user context)

Thanks,
Milan


OOPS log here:

kernel: detected buffer overflow in memcpy
kernel: ------------[ cut here ]------------
kernel: kernel BUG at lib/string.c:1115!
kernel: invalid opcode: 0000 [#1] PREEMPT SMP
kernel: CPU: 1 PID: 2303 Comm: tst Not tainted 5.3.0-rc3+ #572
kernel: Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018
kernel: EIP: fortify_panic+0xe/0x19
kernel: Code: b6 00 00 00 00 8b 45 e4 83 c4 10 5b 5e 29 f8 5f 5d c3 0f b6 c2 0f b6 f3 29 f0 eb ce 55 89 e5 50 68 70 03 8d c1 e8 cc 27 a6 ff <0f> 0b 90 90 90 90 90 90 90 90 90 55 89 e5 57 56 53 89 d3 83 ec 04
kernel: EAX: 00000022 EBX: f1418dc8 ECX: f40ab784 EDX: 00000001
kernel: ESI: f317a318 EDI: 00000020 EBP: f0c2bdf4 ESP: f0c2bdec
kernel: DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010286
kernel: CR0: 80050033 CR2: b7f543a0 CR3: 30e2a000 CR4: 00140690
kernel: Call Trace:
kernel:  encrypt_finish_cts.cold+0xa/0xa
kernel:  encrypt+0xe7/0x100
kernel:  crypto_skcipher_encrypt+0xe/0x20
kernel:  skcipher_recvmsg+0x2f5/0x390 [algif_skcipher]
kernel:  sock_read_iter+0x86/0xd0
kernel:  __vfs_read+0x140/0x1f0
kernel:  vfs_read+0x8b/0x150
kernel:  ksys_read+0x5c/0xd0
kernel:  sys_read+0x11/0x20
kernel:  do_int80_syscall_32+0x4b/0x1a0
kernel:  entry_INT80_32+0xfb/0xfb
kernel: EIP: 0xb7f64092
kernel: Code: 00 00 00 e9 90 ff ff ff ff a3 24 00 00 00 68 30 00 00 00 e9 80 ff ff ff ff a3 2c 00 00 00 66 90 00 00 00 00 00 00 00 00 cd 80 <c3> 8d b4 26 00 00 00 00 8d b6 00 00 00 00 8b 1c 24 c3 8d b4 26 00
kernel: EAX: ffffffda EBX: 00000004 ECX: bfde1d3c EDX: 00000025
kernel: ESI: b7f57000 EDI: 00000000 EBP: bfde1cb8 ESP: bfde1bcc
kernel: DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000282
kernel: Modules linked in: nhpoly1305 chacha_generic adiantum poly1305_generic serpent_sse2_i586 serpent_generic glue_helper algif_skcipher rmd160 wp512 sha512_generic sha1_generic algif_hash af_alg loop dm_mod pktcdvd crc32_pclmul crc32c_intel aesni_intel aes_i586 crypto_simd cryptd ata_piix
kernel: ---[ end trace 29d18b04feffc139 ]---