Date:   Fri, 3 Feb 2023 06:36:22 +0000
From:   Giovanni Cabiddu <giovanni.cabiddu@intel.com>
To:     Herbert Xu <herbert@gondor.apana.org.au>
CC:     <linux-crypto@vger.kernel.org>, <qat-linux@intel.com>,
        <stable@vger.kernel.org>, Vladis Dronov <vdronov@redhat.com>,
        Fiona Trahe <fiona.trahe@intel.com>
Subject: Re: [PATCH] crypto: qat - fix out-of-bounds read
Message-ID: <Y9yrZk9KnICxqkZp@gcabiddu-mobl1.ger.corp.intel.com>
References: <20230201155944.23379-1-giovanni.cabiddu@intel.com>
 <Y9xduyjbaxFdaCUT@gondor.apana.org.au>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <Y9xduyjbaxFdaCUT@gondor.apana.org.au>
Organization: Intel Research and Development Ireland Ltd - Co. Reg. #308263 -
 Collinstown Industrial Park, Leixlip, County Kildare - Ireland
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?KFpTnlrR5ZMwe+YAlk/8K1FB7qZHSLFhqDTvjlnO2l/XgD8nTKCp98XLy3J1?=
 =?us-ascii?Q?6iOm15CQmKJXeKrT0WaI1iYB7eHlTmtr9ZWyMKoNp/AuZ1vWPF1NVAaUAls+?=
 =?us-ascii?Q?hW9iMK/h1d/aDCy52YlhSMvOkMHNf3jby4eNAaP7PJfEnEBCqIV/M/+cdV/q?=
 =?us-ascii?Q?NdVg3JyDXomr7RwADSGPOkZC0hnrrk4x7tc8ZoEzDJ6+KxwaY4oapBH2IZLC?=
 =?us-ascii?Q?ssBGvL6TBrkpHTIZUCGEiMW9DPaUccebH0OPutG7qDk/H3mJrjV+80RjO9R0?=
 =?us-ascii?Q?AMGWfOt4VGeE51XGPf3IfdF7IW3uts7TAIF3jq3Ovwz+wpBJ17AvGrGgO/k8?=
 =?us-ascii?Q?0jHOCmaejw+4sgUHT8EMdF+gz94FRfP72Vb202f3iu27BzQBv+Yg64l5hAgj?=
 =?us-ascii?Q?/c1vrei6tic54q1woDmKz2A2GKqCEgFVsUhB7O1UgtI78Jq117hLFXNQqbIK?=
 =?us-ascii?Q?BRLl3SZ/Mh3MhkTCV5Xtpsp7mJ4LM4t/2++MceOWLCjdbbyNQDAgTbjbiMZE?=
 =?us-ascii?Q?1j7+Sye2G5IBFf57Hkx7NetGp3SslCtQ1yTv2tfJr4M5d67jX0dkFWa0bPCb?=
 =?us-ascii?Q?DcMpYtjNEopI8lVHwS9LAk13j+/NrrvQoUJq4AC0f+wBnGhspZ1vvK3b7IAC?=
 =?us-ascii?Q?ySavJr/bR6asTGsVkKLZCFT4BV/LrcQmtUvOE1dWSwWZxs1pyH40kaHnidA/?=
 =?us-ascii?Q?mIiCZmOOZc8/dNRBmsOTLY288FfXNEffnVGv3YOYKaNBNZbycDcB1vDSvZac?=
 =?us-ascii?Q?MnA4XsEECW8fg+dfNtgV+ihLqx4g7mrG2gDTKgLM93bVfj54QOM7+uwbdOn5?=
 =?us-ascii?Q?PDq9yi2iPpOEaaSyrwSr93a7Cx5fgUVWQ0YFmOJt7EbzoG0Pdep+qeoF74Wv?=
 =?us-ascii?Q?UAA1Qdztq74sEy8da3N/J/Djaikepc/v9reL6dj0JHYu0n+Uzo0ZkbdiLopo?=
 =?us-ascii?Q?wT9crjLRFan8c7F35BA06YclgngyZ+iuyJ1S9Vs1h7lF7ivbsJDk81hDleoi?=
 =?us-ascii?Q?5Pjg7G/ikb2wdS16JEaQhGOWJvy3yHgqVyEa+cq1RpuTL2vfKu8zAvno/j6W?=
 =?us-ascii?Q?aRwi7lSQThSKoKTjyI1FlGfp5uwm725w5kOP+qTVLZbqOzKJmCU/HoVikkv2?=
 =?us-ascii?Q?QJfpRUP4WrqM1xdSNJDhuqMNnpiw0EbrgpFc4q6x1LVPx9LdHVEVi+h4aPq+?=
 =?us-ascii?Q?B+c4QLmSWCMDnttDgZl9VwyvKRtdgBXSpPSrJXCS2AdSU5/c5PlCHAyter+s?=
 =?us-ascii?Q?FMzm2azfBtl2MzywYGVxD8HoGujolKt4SdW/7P1HwIKAaVZ1VDoRCcMryvC9?=
 =?us-ascii?Q?MKo95mj3rO5TbYbAXKWlgJXuHcTaEH3d7fo0u0MZ8RRfYJNqdlJQ1Wo/rH4f?=
 =?us-ascii?Q?10W2vjRHKYkUtC4lWLxW1d5Go/x7EFGx7agPxOoB+ngwSI5MRzjGZtQNmIp8?=
 =?us-ascii?Q?B9j8vk+HOUFu9pwIeRKcVyIaWa42MIQiu3syc3rTJgbZobdn5GOXn6UiVj1Q?=
 =?us-ascii?Q?IMWeBJg2PcK87VktZMnRfFpYOa7HD1PB3OTLejzW8grxQp+jbGiaLOtII3md?=
 =?us-ascii?Q?R8C0dn0w/IfV09CZePNikqIfIbvI8wbl+c1/vWZl3DhIfzpEb8vWiyC+5nU7?=
 =?us-ascii?Q?TA=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: b8e5f7b6-96ef-4440-6821-08db05b0fc70
X-MS-Exchange-CrossTenant-AuthSource: CY5PR11MB6366.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Feb 2023 06:36:31.2852
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: kkewUD5lyvTAHpDg8zT8MIK5aVJfijsyuvtgBTayxwU72DmF4iB13iG4+lXVS/mxgQaai6/5Or0fBeYbTkL61zRB8o0hyevNB2k5X3/vhS8=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR11MB6331
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

On Fri, Feb 03, 2023 at 09:04:59AM +0800, Herbert Xu wrote:
> On Wed, Feb 01, 2023 at 03:59:44PM +0000, Giovanni Cabiddu wrote:
> .
> > @@ -435,8 +435,8 @@ static void qat_alg_skcipher_init_com(struct qat_alg_skcipher_ctx *ctx,
> >  	} else if (aes_v2_capable && mode == ICP_QAT_HW_CIPHER_CTR_MODE) {
> >  		ICP_QAT_FW_LA_SLICE_TYPE_SET(header->serv_specif_flags,
> >  					     ICP_QAT_FW_LA_USE_UCS_SLICE_TYPE);
> > -		keylen = round_up(keylen, 16);
> >  		memcpy(cd->ucs_aes.key, key, keylen);
> > +		keylen = round_up(keylen, 16);
> 
> Now cd->ucs_aes.key contains potentially unitialised data, should
> we zero them?
The content descriptor structure (cd) is already initialized to zero
before the function qat_alg_skcipher_init_com() is called.
This is done in
  (1) qat_alg_skcipher_newkey() implicitly by dma_alloc_coherent(),
      the first time setkey() is called for a tfm or
  (2) qat_alg_skcipher_rekey() explicitly, for subsequent calls to
      sekey().

Regards,

-- 
Giovanni