Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5;
From:   Yuran Pereira <yuran.pereira@hotmail.com>
To:     linux-crypto@vger.kernel.org, herbert@gondor.apana.org.au
Cc:     Yuran Pereira <yuran.pereira@hotmail.com>, davem@davemloft.net,
        tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
        dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com,
        linux-kernel@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org
Subject: [PATCH 6/7] crypto: Fixes uninitialized skcipher_walk use in aria_aesni_avx_glue
Date:   Thu,  2 Nov 2023 09:39:30 +0530
Message-ID: <DB3PR10MB68351A58094544C38A0AEEA8E8A6A@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM>
In-Reply-To: <20231102040931.1556061-1-yuran.pereira@hotmail.com>
References: <DB3PR10MB683562E7BD2DC73A48BEA3C8E8A6A@DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM>
 <20231102040931.1556061-1-yuran.pereira@hotmail.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DB3PR10MB6835:EE_|GV1PR10MB5868:EE_
X-MS-Office365-Filtering-Correlation-Id: f78b361c-1da0-487e-e9c7-08dbdb59a725
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: 1JxyLjrijro/XqjjJOUoU9gtU33fDRIH9X+KhREFrgastYrhqB3R6mmAznPl1T6U8jMor6YV/2P+wZ2GEllPo/jh6QUVQun3gJP9qIG02ZXYIjhcAikpTwDv/o1jjrCLYnNk5A7HCKFVfng7x1ezLi7yiPtRdb7H76rOU0IlPSzXFa7UltUD5hgTuCGPIb7XQTZ0vxFAwMyhdsxt8vr8wE1icdQVb3C1nImQQAf01AtFlyyQnEqKXe/urXNdYOLSergKJaVvBKddxlXxxeNsArqQpvbgO0LpKSrsYFTF4+sfWr0/gJUzA5yUdVn0/fT0zrSCTwvgxawFJuBVwckWfkQn0IHpLAyxOnkvap9CeqAc23dKd0K9m7IlCpPg3sOKP57IDdzNB0hgQj6LGH+3ulU0U2BjCiaJ3F4qIg1wtgQhRB1MjIZRtBLTT0uhJ0HuCu3P7N81CNO63u/cfN1dg9xRSD7vv6JBv5LKSKgSxszwqEuMh6snycExTpglPY7BrxlOEVdgbdrWP89F4B3khbmASfOWA9DZt7IrDrpkot2bw0qGD6r4fTnq/FhewJAnYCkEJZIhg2tjhAQUYWHa69oIGez7nT5nwbGEztxP3/GAeDo1z8fPok3pHeyI8sMj
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?rtCcf0xLTv7bddXkKuwZCy1vd6VAFTRpuO6lkUs747DYTn8D7f1osrI7m50K?=
 =?us-ascii?Q?Ru73lkM9FI7zz7zSaoeDvsOsXxHk8MN4hrm69l47Wz2wirOmQtWE5NwsvIHD?=
 =?us-ascii?Q?Nl0fcLO26hIn0VsxNArmEi3xIRIV8klNB7prrOL294gX193KG4PO77C3/Gro?=
 =?us-ascii?Q?BNgYRFoMugzURZAUr2rSFBMIoPZxRhvHd16klhYA9mgg3M2oK/IS1ww+Nyb0?=
 =?us-ascii?Q?8PNxh8hty1imP6VlF6fUuZKRnPsWq/sM7SffB9Ixya+dhnCWQ8lww6MaHtoG?=
 =?us-ascii?Q?/BEaHKSrwLks8Avs7ghXGjNovywRk8QJEj2XhTkGS+CZbsPhpsuwG22LtmgV?=
 =?us-ascii?Q?iWPgHAmMHaaP9H/BQC3RKS6w4CpLPIfSFFcnyGgG+m6UK2uY1crkblBkvfCF?=
 =?us-ascii?Q?fKNYTzVKiTWM30ybXfhhu+ZpEsAbH6syxJ/IfSLVp6t95Q8t+sOnJ9ydbmKz?=
 =?us-ascii?Q?z8+vVqx9nZNIzRv+uMovY7SH3JZiRe5aWKYVpZIiBJFTXJGcH9Dh/Hj8ROoq?=
 =?us-ascii?Q?3O+9AqBXfaEwjEHu3QwojhsPnc5oGzIYmzbzYe6iKvsd07Zl1IhpIcOEJmw8?=
 =?us-ascii?Q?IZa92e/nfSNYCxXOsLvI3MVN5GNELFQJXgjvuFxJi6XWV7nNEB8+x1Cmc2Ip?=
 =?us-ascii?Q?NNCdZjzm6hgcgq3HK4ma0kr7AC9etoPDmFwu7HwCedgb8mBbpShwYTiP4p3Z?=
 =?us-ascii?Q?nNe6byGmzJrBNc+haKAP3EyyUQNHbSNoC0u+sAtXozxzFeNnodzgQxHBGM1G?=
 =?us-ascii?Q?uN7JfHd3O7x0Wz8u7Z23tXqBNYsGPq0qf5XjZEnxnM5pQhyOfTkio7672nP2?=
 =?us-ascii?Q?3sJBEGta2HS23xNbBAsjsnenMNHK7SDIFVQeKVz4Eatu4N34wD1qlwNoZ2CJ?=
 =?us-ascii?Q?BQ3ISP8VXkgM3RwCDiYriP/5nmcGR42Jj8pkQH1YjZSQeSUj2XwVLxazDO3U?=
 =?us-ascii?Q?AQK9Hb724mfvc6ggErc/7h5fK/ASmnHmKPQ826/wnP5YN6xipO4/fjFZ9sHr?=
 =?us-ascii?Q?xfWjga6zJhg8bQWwW40M9zop52fCBU9mEXzEFsZdvg/eHSaubOBmlATClLMr?=
 =?us-ascii?Q?qprJsksCjNwy1yPzxHjmK1phyIlD8bFTw7qGgBM3Q5fwsb7EneiiD+5cO3Tr?=
 =?us-ascii?Q?vf5RHO1hUvWqueFRvcCLUx/2zv+EYxui38hpMxJUQ3wEtBJF7lwAPNcg8OsF?=
 =?us-ascii?Q?u7+H988PjLEVNCOJRuuEAjkTuxiLRbuvmW03yt8JaJyLuN8UBQ5n5v06ke0?=
 =?us-ascii?Q?=3D?=
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-6b909.templateTenant
X-MS-Exchange-CrossTenant-Network-Message-Id: f78b361c-1da0-487e-e9c7-08dbdb59a725
X-MS-Exchange-CrossTenant-AuthSource: DB3PR10MB6835.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2023 04:10:31.1214
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR10MB5868
X-Spam-Status: No, score=0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,FORGED_HOTMAIL_RCVD2,FREEMAIL_FORGED_FROMDOMAIN,
	FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=no
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Wed, 01 Nov 2023 21:11:16 -0700 (PDT)

In `aria_avx_ctr_encrypt`, `struct skcipher_walk *walk` is not fully
initialized before its use.

Although the call to `skcipher_walk_virt()` and subsequent functions
that this function calls seem to initialize some fields of this struct,

there is a chance that `skcipher_walk_virt()` returns
without fully clearing or properly initializing the `->flags` field
which means that the following flags:
`SKCIPHER_WALK_DIFF`, `SKCIPHER_WALK_COPY`, `SKCIPHER_WALK_SLOW`
could be storing junk values by the time `skcipher_walk_done()` is called.

This could lead to buggy or undefined behaviour since these flags
are checked in `skcipher_walk_done()`:

```C
int skcipher_walk_done(struct skcipher_walk *walk, int err)
{
	...
    if (likely(!(walk->flags & (SKCIPHER_WALK_PHYS |
        SKCIPHER_WALK_SLOW |
        SKCIPHER_WALK_COPY |
        SKCIPHER_WALK_DIFF)))) {
    ...
}
```

To prevent this, this patch ensures that instances of
`struct skcipher_walk` are correctly initialized prior to their use.

Addresses-Coverity-IDs: 1516269 ("Unintialized scalar variable")
Signed-off-by: Yuran Pereira <yuran.pereira@hotmail.com>
---
 arch/x86/crypto/aria_aesni_avx_glue.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/crypto/aria_aesni_avx_glue.c b/arch/x86/crypto/aria_aesni_avx_glue.c
index 4e1516b76669..71589d58d0d3 100644
--- a/arch/x86/crypto/aria_aesni_avx_glue.c
+++ b/arch/x86/crypto/aria_aesni_avx_glue.c
@@ -12,6 +12,7 @@
 #include <linux/err.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/string.h>
 
 #include "ecb_cbc_helpers.h"
 #include "aria-avx.h"
@@ -92,6 +93,7 @@ static int aria_avx_ctr_encrypt(struct skcipher_request *req)
 	unsigned int nbytes;
 	int err;
 
+	memset(&walk, 0, sizeof(walk));
 	err = skcipher_walk_virt(&walk, req, false);
 
 	while ((nbytes = walk.nbytes) > 0) {
-- 
2.25.1