All of lore.kernel.org
 help / color / mirror / Atom feed
From: Herbert Xu <herbert@gondor.apana.org.au>
To: syzbot <syzbot+8ffb0839a24e9c6bfa76@syzkaller.appspotmail.com>
Cc: davem@davemloft.net, linux-crypto@vger.kernel.org,
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	Edward Adam Davis <eadavis@qq.com>
Subject: [PATCH] crypto: skcipher - Pass statesize for simple lskcipher instances
Date: Thu, 21 Dec 2023 10:42:57 +0800	[thread overview]
Message-ID: <ZYOmMW9bwehnl+NT@gondor.apana.org.au> (raw)
In-Reply-To: <000000000000d52e14060cc9c551@google.com>

On Mon, Dec 18, 2023 at 06:43:27AM -0800, syzbot wrote:
> 
> syzbot found the following issue on:
> 
> HEAD commit:    17cb8a20bde6 Add linux-next specific files for 20231215
> git tree:       linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1129f3b6e80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ec104439b5dbc583
> dashboard link: https://syzkaller.appspot.com/bug?extid=8ffb0839a24e9c6bfa76
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17d23c01e80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14cfe021e80000

---8<---
When ecb is used to wrap an lskcipher, the statesize isn't set
correctly.  Fix this by making the simple instance creator set
the statesize.

Reported-by: syzbot+8ffb0839a24e9c6bfa76@syzkaller.appspotmail.com
Reported-by: Edward Adam Davis <eadavis@qq.com>
Fixes: 662ea18d089b ("crypto: skcipher - Make use of internal state")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/lskcipher.c b/crypto/lskcipher.c
index a06008e112f3..0b6dd8aa21f2 100644
--- a/crypto/lskcipher.c
+++ b/crypto/lskcipher.c
@@ -642,6 +642,7 @@ struct lskcipher_instance *lskcipher_alloc_instance_simple(
 	inst->alg.co.min_keysize = cipher_alg->co.min_keysize;
 	inst->alg.co.max_keysize = cipher_alg->co.max_keysize;
 	inst->alg.co.ivsize = cipher_alg->co.base.cra_blocksize;
+	inst->alg.co.statesize = cipher_alg->co.statesize;
 
 	/* Use struct crypto_lskcipher * by default, can be overridden */
 	inst->alg.co.base.cra_ctxsize = sizeof(struct crypto_lskcipher *);
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

      parent reply	other threads:[~2023-12-21  2:42 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-12-18 14:43 [syzbot] [crypto?] KASAN: slab-out-of-bounds Read in arc4_crypt syzbot
2023-12-19 11:53 ` Edward Adam Davis
2023-12-19 12:09   ` syzbot
2023-12-20  3:49 ` Edward Adam Davis
2023-12-20  4:22   ` syzbot
2023-12-20  6:07 ` Edward Adam Davis
2023-12-20  6:16   ` syzbot
2023-12-20  6:34 ` Edward Adam Davis
2023-12-20  6:43   ` syzbot
2023-12-20  6:56 ` Edward Adam Davis
2023-12-20  7:22   ` syzbot
2023-12-20 10:19 ` Edward Adam Davis
2023-12-20 10:46   ` syzbot
2023-12-20 12:51 ` Edward Adam Davis
2023-12-20 13:16   ` syzbot
2023-12-20 13:37 ` Edward Adam Davis
2023-12-20 14:11   ` syzbot
2023-12-20 15:32 ` Edward Adam Davis
2023-12-20 16:17   ` syzbot
2023-12-20 15:53 ` [PATCH next] crypto: fix oob " Edward Adam Davis
2023-12-21  0:19   ` Herbert Xu
2023-12-21  1:32   ` Herbert Xu
2023-12-24 18:54   ` kernel test robot
2023-12-21  2:42 ` Herbert Xu [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZYOmMW9bwehnl+NT@gondor.apana.org.au \
    --to=herbert@gondor.apana.org.au \
    --cc=davem@davemloft.net \
    --cc=eadavis@qq.com \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+8ffb0839a24e9c6bfa76@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.