Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) client-ip=2620:137:e000::3:3;
From:   Yuran Pereira <yuran.pereira@hotmail.com>
To:     linux-crypto@vger.kernel.org, herbert@gondor.apana.org.au
Cc:     Yuran Pereira <yuran.pereira@hotmail.com>, davem@davemloft.net,
        tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
        dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com,
        linux-kernel@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org
Subject: [PATCH 5/7] crypto: Fixes uninitialized skcipher_walk use in aria_aesni_avx2_glue
Date:   Thu,  2 Nov 2023 09:39:29 +0530
Message-ID: <DB3PR10MB68352FC6A4C266DBF7ECEBD4E8A6A@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM>
In-Reply-To: <20231102040931.1556061-1-yuran.pereira@hotmail.com>
References: <DB3PR10MB683562E7BD2DC73A48BEA3C8E8A6A@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM>
 <20231102040931.1556061-1-yuran.pereira@hotmail.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB3PR10MB6835:EE_|GV1PR10MB5868:EE_
X-MS-Office365-Filtering-Correlation-Id: 21f3d836-d820-4e3c-da47-08dbdb59a4f0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: z/Pb3e3Q+LurF8MF7/MF7wZpHA+hLNP77ggyVwuysWq5R1ukJLktt2nlMJXIxCmAR8cHQL74kpjlDfeKm1CNFYwlRceGJr6GcLdr88v4FZ6zosnbGkt0oljUk7NpwxXG4IdonTQcKnx5HCBqLRVGqrdmenhx6xSD7ZZzbrkKcuh7Kcmwwz+S51PGxPdV6fxal785z5HIWVRGovlKRGfQ/iQW1MBS3lv3NIK134R9trB8i1ajims8lj6byndMQ/Fbjc6gG4g0kfJFWl4A/i4cw2hOFPu9rNrbQka6Sea/REsmycNW308xKWTgWc1VooCqrTimNVIM2mcrjFaq00xaRH2Hn33yVdsafXHqTgePm+Ys5YGl8wdRfY+vJ6qL9EOz1+qPuYnqqZglcpbKvkzJ7tICzpUAcBIfJrwWEOBGkehA7BQBO41KR9flzK0C0S/aTDO0fIyeuBIr+dUEOTXRpVRb0b7f+vcBh0l7hRaJdIrW851pcfIUWCqIOlvXKbNo3YLvk+D4OkFQ2GyJq077luiPKPhUekelfWJzFvGSsPYp6nrKOsPdXhOxF7Lvw6YLL/a5dcOo/uDLIUTDurk71WalcJ8PyZ3dPeX7gepmuOTLHM+/lHzvSZRcjMwtoljM
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+M65OmRVKqTw+dHqAFB9ugBeT82L1jnq7sDEnbYhTtOoIGmRV9yIsM1KxLO5?=
 =?us-ascii?Q?KZMZRAlTUYW5Eh0YlqCvJ8vILiqzr5L9pof6z3WcZVLgzXfpZuHfD2aHkjH/?=
 =?us-ascii?Q?weHbjO08AkKTbL+JXt+ECwcSlCHW3Ox03+f4JFqSs4vjmrkOvL7X8Wq+YOty?=
 =?us-ascii?Q?80IJsS48VDitPZslsCqcZ0b+4o2riw7zRBeh1RRB4t8XOhLnx4eCv3HYouNI?=
 =?us-ascii?Q?vwXcREunAhP5UflHhIbONLpCZZDJGpB45EajeZP1eRR3Xa4qUr0lO3jHYpns?=
 =?us-ascii?Q?dwynyObjfSouyCBtWIj3l0AkEZ00++bnfHY4vhdXJVc8ngDOiR+kJqXh9Kfs?=
 =?us-ascii?Q?eHqygUTZCIxysCjctdcP+SecWtaqiO7g9BTndAyWoZvmvh7A1XlAZJ+yA9Uk?=
 =?us-ascii?Q?52hxOiB/50FOZWEqpWJHrFe7/EGVXv/Wc4SUMw7Xe8Wr7UMUyKvDubUfY9Lf?=
 =?us-ascii?Q?FN/ff7+JdhnVh7ERgFgiakxoIDTrqVNTYxdExDpzlQfU//BjZtb5GkC4ZX/3?=
 =?us-ascii?Q?Knj1fbvHV5MZHGRUH6eIJ+FMFnuZPUI9f3NimzMkApYLj9lFh9VUHrg8iNWC?=
 =?us-ascii?Q?MvjdtaVPaZmkRj8dFtvCrsUa9Ej04cpOjB+hdlKm21aIzNwC6+7HS9iOkWy9?=
 =?us-ascii?Q?aXkUyM6hc+huw+OP0E4JHSubeMBiu0AY7JDOuz62ZxJU3LDZJaZHknNZ3dDo?=
 =?us-ascii?Q?5m+IAE3CIjsYsZ+54yRHeIKVQMvyosMtrnB3ZQfTNH80Tcp2frMy+ehadekh?=
 =?us-ascii?Q?OzHytT1jkHhANTlzLE2B5nWPZnlZ20xuWw+bGfHpDdV1i/sYPp/PigqRdfA1?=
 =?us-ascii?Q?V5Hg0P88WMBNCTU4lemFaPLwDgHRdpzu03KV0y1A6P8S/oH/YZTGZrDvmmUC?=
 =?us-ascii?Q?sBymyXEUo5dxa0fT3wNzLZD7VvuKCkwyPH42HMsa7T8mKOzlHMBY2ACFr4Ey?=
 =?us-ascii?Q?NfUjToNpN/FoLfOpewHAHqBJHRnzN2nwbBz4/Qtucp4bgpw2F9hERLStUcga?=
 =?us-ascii?Q?nA2u20qEBnAobXHv8LmoSVLrnEJBXGzamy+oDLSmMiswzUJJsMMHLBAVm9JH?=
 =?us-ascii?Q?vUMw/noEU5N7PwGFLl2FMxjJ8GP1EsWtMF/1wCHlYEE4qwi1odb1EVfHzAg5?=
 =?us-ascii?Q?PRWJvEhXwbe7Vbli/3nM5gVIcN9pBLt/C6FgTlWsrJKRs0zuudS9rhjy9pWF?=
 =?us-ascii?Q?9ddL3vPT+ZE3OSJnkmKjVA9ForMch4ZjbsLyod3c9r8NkqpGcP/G69flgZk?=
 =?us-ascii?Q?=3D?=
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-6b909.templateTenant
X-MS-Exchange-CrossTenant-Network-Message-Id: 21f3d836-d820-4e3c-da47-08dbdb59a4f0
X-MS-Exchange-CrossTenant-AuthSource: DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2023 04:10:27.2100
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR10MB5868
X-Spam-Status: No, score=0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,FORGED_HOTMAIL_RCVD2,FREEMAIL_FORGED_FROMDOMAIN,
	FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=no
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Wed, 01 Nov 2023 21:11:00 -0700 (PDT)

In `aria_avx2_ctr_encrypt()`, `struct skcipher_walk *walk` is not fully
initialized before its use.

Although the call to `skcipher_walk_virt()` and subsequent functions
that this function calls seem to initialize some fields of this struct,

there is a chance that `skcipher_walk_virt()` returns
without fully clearing or properly initializing the `->flags` field
which means that the following flags:
`SKCIPHER_WALK_DIFF`, `SKCIPHER_WALK_COPY`, `SKCIPHER_WALK_SLOW`
could be storing junk values by the time `skcipher_walk_done()` is called.

This could lead to buggy or undefined behaviour since these flags
are checked in `skcipher_walk_done()`:

```C
int skcipher_walk_done(struct skcipher_walk *walk, int err)
{
	...
    if (likely(!(walk->flags & (SKCIPHER_WALK_PHYS |
        SKCIPHER_WALK_SLOW |
        SKCIPHER_WALK_COPY |
        SKCIPHER_WALK_DIFF)))) {
    ...
}
```

To prevent this, this patch ensures that instances of
`struct skcipher_walk` are correctly initialized prior to their use.

Addresses-Coverity-IDs: 1521842 ("Unintialized scalar variable")
Signed-off-by: Yuran Pereira <yuran.pereira@hotmail.com>
---
 arch/x86/crypto/aria_aesni_avx2_glue.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/crypto/aria_aesni_avx2_glue.c b/arch/x86/crypto/aria_aesni_avx2_glue.c
index 87a11804fc77..d5a8077f9f96 100644
--- a/arch/x86/crypto/aria_aesni_avx2_glue.c
+++ b/arch/x86/crypto/aria_aesni_avx2_glue.c
@@ -12,6 +12,7 @@
 #include <linux/err.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/string.h>
 
 #include "ecb_cbc_helpers.h"
 #include "aria-avx.h"
@@ -94,6 +95,7 @@ static int aria_avx2_ctr_encrypt(struct skcipher_request *req)
 	unsigned int nbytes;
 	int err;
 
+	memset(&walk, 0, sizeof(walk));
 	err = skcipher_walk_virt(&walk, req, false);
 
 	while ((nbytes = walk.nbytes) > 0) {
-- 
2.25.1