Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 19 Jul 2022 11:14:45 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     ap420073@gmail.com
Cc:     linux-crypto@vger.kernel.org
Subject: [bug report] crypto: aria - Implement ARIA symmetric cipher algorithm
Message-ID: <YtZn9YdHZDDBWzoC@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?DE7jP6oNYUjQZDEVs0epjdA1Aud4AZQJRd1mT03KK5AYxmksTe5viAh8Jdgi?=
 =?us-ascii?Q?yluhQXWCBABTKdYlhW+anTk39LBW/tUPXIautrnccZnMywQ3pyBCszTlPVs6?=
 =?us-ascii?Q?6PKLyo9fP1eLMq4Z9EEkqpsp5ih2S0CU1TLvMK3u9TaLjsPJKBW9m3ExMK1d?=
 =?us-ascii?Q?uaO+mEAJEqUrMGvEyjqPH+olV4jxB2C5qVhykJL5fbH44/Z2/0monw4zU9fY?=
 =?us-ascii?Q?2fXZC/uAqn2nqxaYIsLYnudx7eJcxB5oUAXNZ6td6zZW/qxDaO53X8PEzS08?=
 =?us-ascii?Q?nG6t01tsxx7DhQquh6590/UY7mSKh/wOW3PWwqUB+AvjtvTskpShZB11u7Sn?=
 =?us-ascii?Q?ejGHMsNcA/eEn6wo+eE07kI/mbAiIn/jmf2Tl+kT0STee0tfdtXrlRhwo3ll?=
 =?us-ascii?Q?wtu8ZuGm2ouKNeGyyZmGNug8FImhZSOx3mi1cKY3ONvc1350LkaVBr9P2MNg?=
 =?us-ascii?Q?tKjc3jZX9rgunDwEj2HH2AJgY9sDvTB7Te+IjxHeIH8OKGiXZXFNURwv3x7n?=
 =?us-ascii?Q?vvUQrBG8y9BmEdblLYM4gKcg71ibbDeEgnQWOTxLzaHBeyaLReNypsBvvSH+?=
 =?us-ascii?Q?F/CXi9J93ksBcBFAHHe+zdUwQyqd3Q0XTN0uIOSRdVMUiVWNat6xGvQm0UOH?=
 =?us-ascii?Q?IJX93AS6RWDaYQO6EgQe6bGSoFz2pkDWoyB4Nbk8BKqV5lrkyeu4vbkIfNUc?=
 =?us-ascii?Q?bXSbUvC6fZufJhOx1p//k1CqfxGnKtvzFImQESX9844pBPTtskBbrN+ySQc7?=
 =?us-ascii?Q?QNiCOweGuPFIUwhSkaRhcVde8BUfmVdKrgqorsy63KDEhpoB0Vz7tlQKAevE?=
 =?us-ascii?Q?utdikWVFlVBdKsPXVaLM1vigRhnL7X9jHIDk0CT4qp9bqZ0R1TaSGHtH4vJA?=
 =?us-ascii?Q?pC3g92OGv/ukWM8Hw6LqR+6+cRcGZfRmee6v9ZPSFmfQmOUFIwMeFZ/9W7hv?=
 =?us-ascii?Q?+CjRrsTINnvavyPUYR0tODsqU4RX2TQDCpnoT3CNDz94oRLD1J2J9Q0n5i/y?=
 =?us-ascii?Q?1T8jeShAukKclRvXeV/WUCFM+C2KsR1n1xo1v/YO5LkDKVaWMsqi50Cw9Q9J?=
 =?us-ascii?Q?Y1TDLNgzuTXJYqo/03RiMRyKKSru+wA5ivrsM+tuMajICK2pjc/oVHJwbMTO?=
 =?us-ascii?Q?40+sT/aVbUHoDNROvI5jntSdLOf9JXGfYV4IuMJeRUQqb06sL+VDk6gQJ4QE?=
 =?us-ascii?Q?QudiuJF0E/G++elsp46QLvpu4k0vR1MI3H2/v3KNuLkw0KqOJfLFzYMNvuJn?=
 =?us-ascii?Q?V/bcMHw4HWPt64BQ4Qji43VRdw7XhAeALaZSdSRB8TP5S2CKEUjSJWr9mCLu?=
 =?us-ascii?Q?Kv+ZFgDZY4rjJCilSt/qTMnBW3noLW2nwilF1gcq+8nAYtnkv+PEblsuaIw4?=
 =?us-ascii?Q?RkopXKvg1BKiaNtfjyt+IuXuWBbOdjeoiFSeZ9XtIpANRlSUjNe1P8tU4CyO?=
 =?us-ascii?Q?XHrMyrMyTtKSFMN1TxZ+Bnyms9dXPHLFrcO5Ll9T5hJUEUgvPy0HDKU4biwo?=
 =?us-ascii?Q?I+bZ35nN3OdF2TPipJFJeawOMgeoIoH/WTEZZyuhQeoOXXYgxVfN+0wPeEGw?=
 =?us-ascii?Q?W9eJmxPg73PJtwYyqnHLyOkIbwcD6SjYNVeKcIesu3Z94gDtz7ZoeqITFtUX?=
 =?us-ascii?Q?1A=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: da873109-4d63-4bb4-c13d-08da695ec263
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jul 2022 08:14:53.9099
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: gaLl9RrD1NmVQj0Y7oJQ35K2swQPeK1hn1qhPL4FSZ9zEZCk0R8kSc/T3/ugqpmKBhEMU0zuvos5F4qGH6T+oKLbXTTiqUBAnGU0CRfFQT0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR10MB3029
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-07-18_22,2022-07-18_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0
 mlxlogscore=999 malwarescore=0 adultscore=0 mlxscore=0 spamscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2206140000 definitions=main-2207190035
X-Proofpoint-GUID: gOt_nSCECd94pilCuzY82qCk6_giQ-8O
X-Proofpoint-ORIG-GUID: gOt_nSCECd94pilCuzY82qCk6_giQ-8O
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Hello Taehee Yoo,

The patch e4e712bbbd6d: "crypto: aria - Implement ARIA symmetric
cipher algorithm" from Jul 4, 2022, leads to the following Smatch
static checker warning:

crypto/aria.c:69 aria_set_encrypt_key() error: buffer overflow 'ck' 4 <= 4
crypto/aria.c:70 aria_set_encrypt_key() error: buffer overflow 'ck' 4 <= 5
crypto/aria.c:71 aria_set_encrypt_key() error: buffer overflow 'ck' 4 <= 6
crypto/aria.c:72 aria_set_encrypt_key() error: buffer overflow 'ck' 4 <= 7
crypto/aria.c:86 aria_set_encrypt_key() error: buffer overflow 'ck' 4 <= 8
crypto/aria.c:87 aria_set_encrypt_key() error: buffer overflow 'ck' 4 <= 9
crypto/aria.c:88 aria_set_encrypt_key() error: buffer overflow 'ck' 4 <= 10
crypto/aria.c:89 aria_set_encrypt_key() error: buffer overflow 'ck' 4 <= 11

crypto/aria.c
    19 static void aria_set_encrypt_key(struct aria_ctx *ctx, const u8 *in_key,
    20                                  unsigned int key_len)
    21 {
    22         const __be32 *key = (const __be32 *)in_key;
    23         u32 w0[4], w1[4], w2[4], w3[4];
    24         u32 reg0, reg1, reg2, reg3;
    25         const u32 *ck;
    26         int rkidx = 0;
    27 
    28         ck = &key_rc[(key_len - 16) / 8][0];

key_rc is declared like this:

static const u32 key_rc[5][4] = {

    29 
    30         w0[0] = be32_to_cpu(key[0]);
    31         w0[1] = be32_to_cpu(key[1]);
    32         w0[2] = be32_to_cpu(key[2]);
    33         w0[3] = be32_to_cpu(key[3]);
    34 
    35         reg0 = w0[0] ^ ck[0];
    36         reg1 = w0[1] ^ ck[1];
    37         reg2 = w0[2] ^ ck[2];
    38         reg3 = w0[3] ^ ck[3];
    39 
    40         aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
    41 
    42         if (key_len > 16) {
    43                 w1[0] = be32_to_cpu(key[4]);
    44                 w1[1] = be32_to_cpu(key[5]);
    45                 if (key_len > 24) {
    46                         w1[2] = be32_to_cpu(key[6]);
    47                         w1[3] = be32_to_cpu(key[7]);
    48                 } else {
    49                         w1[2] = 0;
    50                         w1[3] = 0;
    51                 }
    52         } else {
    53                 w1[0] = 0;
    54                 w1[1] = 0;
    55                 w1[2] = 0;
    56                 w1[3] = 0;
    57         }
    58 
    59         w1[0] ^= reg0;
    60         w1[1] ^= reg1;
    61         w1[2] ^= reg2;
    62         w1[3] ^= reg3;
    63 
    64         reg0 = w1[0];
    65         reg1 = w1[1];
    66         reg2 = w1[2];
    67         reg3 = w1[3];
    68 
--> 69         reg0 ^= ck[4];

So 4 and above is out of bounds.

    70         reg1 ^= ck[5];
    71         reg2 ^= ck[6];
    72         reg3 ^= ck[7];
    73 
    74         aria_subst_diff_even(&reg0, &reg1, &reg2, &reg3);
    75 
    76         reg0 ^= w0[0];
    77         reg1 ^= w0[1];
    78         reg2 ^= w0[2];
    79         reg3 ^= w0[3];
    80 
    81         w2[0] = reg0;
    82         w2[1] = reg1;
    83         w2[2] = reg2;
    84         w2[3] = reg3;
    85 
    86         reg0 ^= ck[8];
    87         reg1 ^= ck[9];
    88         reg2 ^= ck[10];
    89         reg3 ^= ck[11];
    90 
    91         aria_subst_diff_odd(&reg0, &reg1, &reg2, &reg3);
    92 
    93         w3[0] = reg0 ^ w1[0];
    94         w3[1] = reg1 ^ w1[1];
    95         w3[2] = reg2 ^ w1[2];
    96         w3[3] = reg3 ^ w1[3];
    97 
    98         aria_gsrk(ctx->enc_key[rkidx], w0, w1, 19);
    99         rkidx++;
    100         aria_gsrk(ctx->enc_key[rkidx], w1, w2, 19);
    101         rkidx++;
    102         aria_gsrk(ctx->enc_key[rkidx], w2, w3, 19);
    103         rkidx++;
    104         aria_gsrk(ctx->enc_key[rkidx], w3, w0, 19);
    105 
    106         rkidx++;
    107         aria_gsrk(ctx->enc_key[rkidx], w0, w1, 31);
    108         rkidx++;
    109         aria_gsrk(ctx->enc_key[rkidx], w1, w2, 31);
    110         rkidx++;
    111         aria_gsrk(ctx->enc_key[rkidx], w2, w3, 31);
    112         rkidx++;
    113         aria_gsrk(ctx->enc_key[rkidx], w3, w0, 31);
    114 
    115         rkidx++;
    116         aria_gsrk(ctx->enc_key[rkidx], w0, w1, 67);
    117         rkidx++;
    118         aria_gsrk(ctx->enc_key[rkidx], w1, w2, 67);
    119         rkidx++;
    120         aria_gsrk(ctx->enc_key[rkidx], w2, w3, 67);
    121         rkidx++;
    122         aria_gsrk(ctx->enc_key[rkidx], w3, w0, 67);
    123 
    124         rkidx++;
    125         aria_gsrk(ctx->enc_key[rkidx], w0, w1, 97);
    126         if (key_len > 16) {
    127                 rkidx++;
    128                 aria_gsrk(ctx->enc_key[rkidx], w1, w2, 97);
    129                 rkidx++;
    130                 aria_gsrk(ctx->enc_key[rkidx], w2, w3, 97);
    131 
    132                 if (key_len > 24) {
    133                         rkidx++;
    134                         aria_gsrk(ctx->enc_key[rkidx], w3, w0, 97);
    135 
    136                         rkidx++;
    137                         aria_gsrk(ctx->enc_key[rkidx], w0, w1, 109);
    138                 }
    139         }
    140 }

regards,
dan carpenter