Date:   Fri, 3 Feb 2023 09:04:59 +0800
From:   Herbert Xu <herbert@gondor.apana.org.au>
To:     Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Cc:     linux-crypto@vger.kernel.org, qat-linux@intel.com,
        stable@vger.kernel.org, Vladis Dronov <vdronov@redhat.com>,
        Fiona Trahe <fiona.trahe@intel.com>
Subject: Re: [PATCH] crypto: qat - fix out-of-bounds read
Message-ID: <Y9xduyjbaxFdaCUT@gondor.apana.org.au>
References: <20230201155944.23379-1-giovanni.cabiddu@intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230201155944.23379-1-giovanni.cabiddu@intel.com>
Precedence: bulk

On Wed, Feb 01, 2023 at 03:59:44PM +0000, Giovanni Cabiddu wrote:
.
> @@ -435,8 +435,8 @@ static void qat_alg_skcipher_init_com(struct qat_alg_skcipher_ctx *ctx,
>  	} else if (aes_v2_capable && mode == ICP_QAT_HW_CIPHER_CTR_MODE) {
>  		ICP_QAT_FW_LA_SLICE_TYPE_SET(header->serv_specif_flags,
>  					     ICP_QAT_FW_LA_USE_UCS_SLICE_TYPE);
> -		keylen = round_up(keylen, 16);
>  		memcpy(cd->ucs_aes.key, key, keylen);
> +		keylen = round_up(keylen, 16);

Now cd->ucs_aes.key contains potentially unitialised data, should
we zero them?

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt