[PATCH] x86: crypto: fix Using uninitialized value walk.flags

[PATCH] x86: crypto: fix Using uninitialized value walk.flags

[chinayanlei2002]

From: Yan Lei <yan_lei@dahuatech.com>

----------------------------------------------------------
Using uninitialized value "walk.flags" when calling "skcipher_walk_virt".

Signed-off-by: Yan Lei <yan_lei@dahuatech.com>
---
 arch/x86/crypto/sm4_aesni_avx_glue.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/x86/crypto/sm4_aesni_avx_glue.c b/arch/x86/crypto/sm4_aesni_avx_glue.c
index 7800f77d6..417e3bbfe 100644
--- a/arch/x86/crypto/sm4_aesni_avx_glue.c
+++ b/arch/x86/crypto/sm4_aesni_avx_glue.c
@@ -40,7 +40,7 @@ static int sm4_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key,
 
 static int ecb_do_crypt(struct skcipher_request *req, const u32 *rkey)
 {
-	struct skcipher_walk walk;
+	struct skcipher_walk walk = { 0 };
 	unsigned int nbytes;
 	int err;
 
@@ -94,7 +94,7 @@ int sm4_cbc_encrypt(struct skcipher_request *req)
 {
 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 	struct sm4_ctx *ctx = crypto_skcipher_ctx(tfm);
-	struct skcipher_walk walk;
+	struct skcipher_walk walk = { 0 };
 	unsigned int nbytes;
 	int err;
 
@@ -128,7 +128,7 @@ int sm4_avx_cbc_decrypt(struct skcipher_request *req,
 {
 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 	struct sm4_ctx *ctx = crypto_skcipher_ctx(tfm);
-	struct skcipher_walk walk;
+	struct skcipher_walk walk = { 0 };
 	unsigned int nbytes;
 	int err;
 
@@ -192,7 +192,7 @@ int sm4_cfb_encrypt(struct skcipher_request *req)
 {
 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 	struct sm4_ctx *ctx = crypto_skcipher_ctx(tfm);
-	struct skcipher_walk walk;
+	struct skcipher_walk walk = { 0 };
 	unsigned int nbytes;
 	int err;
 
@@ -234,7 +234,7 @@ int sm4_avx_cfb_decrypt(struct skcipher_request *req,
 {
 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 	struct sm4_ctx *ctx = crypto_skcipher_ctx(tfm);
-	struct skcipher_walk walk;
+	struct skcipher_walk walk = { 0 };
 	unsigned int nbytes;
 	int err;
 
@@ -303,7 +303,7 @@ int sm4_avx_ctr_crypt(struct skcipher_request *req,
 {
 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 	struct sm4_ctx *ctx = crypto_skcipher_ctx(tfm);
-	struct skcipher_walk walk;
+	struct skcipher_walk walk = { 0 };
 	unsigned int nbytes;
 	int err;
 
-- 
2.30.0

Re: [PATCH] x86: crypto: fix Using uninitialized value walk.flags

[Eric Biggers]

On Sun, Apr 10, 2022 at 02:07:57PM +0800, chinayanlei2002@163.com wrote:
> From: Yan Lei <yan_lei@dahuatech.com>
> 
> ----------------------------------------------------------
> Using uninitialized value "walk.flags" when calling "skcipher_walk_virt".
> 
> Signed-off-by: Yan Lei <yan_lei@dahuatech.com>
> ---
>  arch/x86/crypto/sm4_aesni_avx_glue.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/x86/crypto/sm4_aesni_avx_glue.c b/arch/x86/crypto/sm4_aesni_avx_glue.c
> index 7800f77d6..417e3bbfe 100644
> --- a/arch/x86/crypto/sm4_aesni_avx_glue.c
> +++ b/arch/x86/crypto/sm4_aesni_avx_glue.c
> @@ -40,7 +40,7 @@ static int sm4_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key,
>  
>  static int ecb_do_crypt(struct skcipher_request *req, const u32 *rkey)
>  {
> -	struct skcipher_walk walk;
> +	struct skcipher_walk walk = { 0 };
>  	unsigned int nbytes;
>  	int err;
>  

This caller is no different from any other caller of skcipher_walk_virt().  So
this is not the proper place to fix this.  Can you do the following instead?

	1. Audit all callers of skcipher_walk_virt() to verify that they would be
	   okay with walk->flags being initialized to 0.  I.e., verify that no
	   callers are intentionally initializing the flags to something else.

	2. Update skcipher_walk_virt() to initialize walk->flags to 0, rather
	   than doing 'walk->flags &= ~SKCIPHER_WALK_PHYS' as it does currently.

- Eric