Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38;
From:   Yuran Pereira <yuran.pereira@hotmail.com>
To:     linux-crypto@vger.kernel.org, herbert@gondor.apana.org.au
Cc:     Yuran Pereira <yuran.pereira@hotmail.com>, davem@davemloft.net,
        tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
        dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com,
        linux-kernel@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org
Subject: [PATCH 1/7] crypto: Fixes uninitialized skcipher_walk use in sm4_aesni_avx_glue
Date:   Thu,  2 Nov 2023 09:39:25 +0530
Message-ID: <DB3PR10MB683563927062940224A92AA3E8A6A@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM>
In-Reply-To: <DB3PR10MB683562E7BD2DC73A48BEA3C8E8A6A@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM>
References: <DB3PR10MB683562E7BD2DC73A48BEA3C8E8A6A@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB3PR10MB6835:EE_|GV1PR10MB5868:EE_
X-MS-Office365-Filtering-Correlation-Id: db7faf61-55ca-461c-bf97-08dbdb599c80
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: FljDe8Yq3hSPZXikv7PwhCQDD/eECjeYoepF9TC7B6/8dSZFhH5uOCQ+C/wkHhq+he/sr9DoFQJUNgWjUp5DWfp79LSIlsJZMw8gOtK70yfhoacdZAADQaKnjLz93rP+vDvVSJwx3TAnTluqxttXgJ9JjEDvUFIV6QweiHOC0fXMwSrOUMcCsb1CCivUywTa9aBz909tX/R0+e8hbPQXg3jM1kpdk41p+fhsH6g4ARZk4Esi2Q0oB/wyRzFjs9hdy/XjQn42ttA0x2SKheKn38pqLnWoxaDnHmJc+zIOi0osb7rbzxR+S4rzrqfQ3BFaLGfX/hK92jA7Ei5rppInAFcZqLTH2gMVT4f4+A4MmTDtH13QKepBvX0jflKnxrLa6mxfpikvZHrLTvEhfG5oLVVcqJBBbbw1ItU9HAnC1Jdy5n3vPG9hyA/b13EyWP7RxAMAIROPBfq9T0IgNP+8zfKlF3bhVXAWsCzLKBaj6JZ3E6f8j95wizqCMgcgki5C+zrIimzvNPeuzyM8toK1XiO0qp176hsCHdifrlIJF9EuG67HbEa6L+fpewAGjxaloQKyWGfe1UH6zcfsdDAcJ0gDvNXGLIGi107FcpcgHCLitRX2btXQVwAc4VERXDAY
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?EPrxYWE/6lN1hFzYvbF6PaKvmr7LAZ+ygmEEGytO8lCs0Rb5JppVVZYwFIl4?=
 =?us-ascii?Q?oMy1SjOtiOaWxIZWc4p6cUjZGcMp/8DyHCInGBxe7ZIlheBooWBNN+YdcNTG?=
 =?us-ascii?Q?jXo4TDqpi6uP7xpUgutkDP9OyKzC/L5d3UjhPihxDgox6s/la6CoKpOHM/xA?=
 =?us-ascii?Q?Q6urHzajqGz7uEcC/wfdTKl/Y7Brt9Vn47ff74eR/w0Y0fpugk6KriNwxov/?=
 =?us-ascii?Q?uwZ3y+p9gKJxjoGavlYFpqPNGPI/vTgAdmWtdPklEQvlBwk/Gfihj3Yh2wwL?=
 =?us-ascii?Q?mBVHUcSag6hJSwY+dUkPyw7xE9Qrouwo+X/+cbYoGaLOI2R/qSJ2aMeZdBqI?=
 =?us-ascii?Q?jk11TwaNJ2fsdnVbN+gSdGlmmSk5uUMVuzTMrJZPI5oP062BpZJSsRsJ1EMz?=
 =?us-ascii?Q?agwIdnQUshPYKiapStwvXxg+/SgRqdRYPfzJAJw/7lBSsM3EsqslT1drQVlC?=
 =?us-ascii?Q?8vKHwfCUO2Ku7/Z2k2LrLvd+JjY4EehLPq7LB8b09BFDeI6PQjSVFFcwZDeC?=
 =?us-ascii?Q?TVITo/W6/saBZvS8ziF6LZzAlS80cN5/qLi4hSAO6ZspI47imiRU5p8+mQDY?=
 =?us-ascii?Q?EUcZJeiAPVJktMl7SExB/oyEYiVjlNVQdpfe4Q/lVUn9tInzLP1BGe6rVhXS?=
 =?us-ascii?Q?fKz9b3V/hZho4CAtHA23+D6wrMKB/yzqfmUMzgBOQVYRVoeCc3oaVHr7ipD0?=
 =?us-ascii?Q?6dAnnrKhEPMpZn4nc7zlvd1jyyun0T3VGb4HgDW6pvMpHtzg5llgj8TE85Lv?=
 =?us-ascii?Q?kVbpkySJ1l1SOgNGxgp6BBW5i9XlJyzTPXBrqQ1cN/QZCA83UC1BcjbZATa2?=
 =?us-ascii?Q?oNm+YD22nHN9R+4fTPSA7DdAvZ7u96qf61a/i163mzo/ZqMh2Dv5Tr0XYZ/k?=
 =?us-ascii?Q?H1heF391liB47RTKl6bvwHMtzWsM9mdYed+IchXob6Ja5KWN5EnltjHUMLNM?=
 =?us-ascii?Q?vKatWR4osOxLW0lsuvoXdXbTQd3y+TXgmj8IQXEILCnqyJNW4ZIO8Os3egD2?=
 =?us-ascii?Q?bQrnmjAJH60TpaBhAVvuzkFGXk8YSXYHtmJLRLERiWxaYqtJyLTRKjxqTXpD?=
 =?us-ascii?Q?UIifUz9Xjllqhxn66TBMvfwou1dR7bS8+7CLZtHR4sntnv6i6JfuSH6Warhl?=
 =?us-ascii?Q?Q9UpQauiIibplTwhHhqZBg4Plukx9ycqN/c/OYSpsczrIzV8jGHTgSE7Mnd/?=
 =?us-ascii?Q?mWPy8+fgZqV5zGUwm+wbqfQdzWefCl8eJ4n5aW7bidBJ2VzeErANAUCpdHM?=
 =?us-ascii?Q?=3D?=
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-6b909.templateTenant
X-MS-Exchange-CrossTenant-Network-Message-Id: db7faf61-55ca-461c-bf97-08dbdb599c80
X-MS-Exchange-CrossTenant-AuthSource: DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2023 04:10:13.2634
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR10MB5868
X-Spam-Status: No, score=0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,FORGED_HOTMAIL_RCVD2,FREEMAIL_FORGED_FROMDOMAIN,
	FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=no
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on fry.vger.email
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (fry.vger.email [0.0.0.0]); Wed, 01 Nov 2023 21:10:33 -0700 (PDT)

In the following functions:
 - `sm4_avx_ctr_crypt`
 - `sm4_avx_cfb_decrypt`
 - `sm4_cfb_encrypt`
 - `sm4_cbc_encrypt`
 - `sm4_avx_cbc_decrypt`
 - `ecb_do_crypt`

`struct skcipher_walk *walk` is not fully initialized before its use.

Although the call to `skcipher_walk_virt()` and subsequent functions
that this function calls seem to initialize some fields of this struct,

there is a chance that `skcipher_walk_virt()` returns
without fully clearing or properly initializing the `->flags` field
which means that the following flags:
`SKCIPHER_WALK_DIFF`, `SKCIPHER_WALK_COPY`, `SKCIPHER_WALK_SLOW`
could be storing junk values by the time `skcipher_walk_done()` is called.

This could lead to buggy or undefined behaviour since these flags
are checked in `skcipher_walk_done()`:

```C
int skcipher_walk_done(struct skcipher_walk *walk, int err)
{
	...
    if (likely(!(walk->flags & (SKCIPHER_WALK_PHYS |
        SKCIPHER_WALK_SLOW |
        SKCIPHER_WALK_COPY |
        SKCIPHER_WALK_DIFF)))) {
    ...
}
```

To prevent this, this patch ensures that instances of `struct skcipher_walk`
are correctly initialized prior to their use.

Addresses-Coverity-IDs: 1491520, 1491533, 1491610, 1491651, 1491715,
                        1491774 ("Unintialized scalar variable")
Signed-off-by: Yuran Pereira <yuran.pereira@hotmail.com>
---
 arch/x86/crypto/sm4_aesni_avx_glue.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/crypto/sm4_aesni_avx_glue.c b/arch/x86/crypto/sm4_aesni_avx_glue.c
index 7800f77d68ad..4117c6f787e2 100644
--- a/arch/x86/crypto/sm4_aesni_avx_glue.c
+++ b/arch/x86/crypto/sm4_aesni_avx_glue.c
@@ -11,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/crypto.h>
 #include <linux/kernel.h>
+#include <linux/string.h>
 #include <asm/simd.h>
 #include <crypto/internal/simd.h>
 #include <crypto/internal/skcipher.h>
@@ -44,6 +45,7 @@ static int ecb_do_crypt(struct skcipher_request *req, const u32 *rkey)
 	unsigned int nbytes;
 	int err;
 
+	memset(&walk, 0, sizeof(walk));
 	err = skcipher_walk_virt(&walk, req, false);
 
 	while ((nbytes = walk.nbytes) > 0) {
@@ -98,6 +100,7 @@ int sm4_cbc_encrypt(struct skcipher_request *req)
 	unsigned int nbytes;
 	int err;
 
+	memset(&walk, 0, sizeof(walk));
 	err = skcipher_walk_virt(&walk, req, false);
 
 	while ((nbytes = walk.nbytes) > 0) {
@@ -132,6 +135,7 @@ int sm4_avx_cbc_decrypt(struct skcipher_request *req,
 	unsigned int nbytes;
 	int err;
 
+	memset(&walk, 0, sizeof(walk));
 	err = skcipher_walk_virt(&walk, req, false);
 
 	while ((nbytes = walk.nbytes) > 0) {
@@ -196,6 +200,7 @@ int sm4_cfb_encrypt(struct skcipher_request *req)
 	unsigned int nbytes;
 	int err;
 
+	memset(&walk, 0, sizeof(walk));
 	err = skcipher_walk_virt(&walk, req, false);
 
 	while ((nbytes = walk.nbytes) > 0) {
@@ -238,6 +243,7 @@ int sm4_avx_cfb_decrypt(struct skcipher_request *req,
 	unsigned int nbytes;
 	int err;
 
+	memset(&walk, 0, sizeof(walk));
 	err = skcipher_walk_virt(&walk, req, false);
 
 	while ((nbytes = walk.nbytes) > 0) {
@@ -307,6 +313,7 @@ int sm4_avx_ctr_crypt(struct skcipher_request *req,
 	unsigned int nbytes;
 	int err;
 
+	memset(&walk, 0, sizeof(walk));
 	err = skcipher_walk_virt(&walk, req, false);
 
 	while ((nbytes = walk.nbytes) > 0) {
-- 
2.25.1