kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-01 18:21:29 +00:00
Code Issues Releases Packages Activity
linux/drivers/crypto/qat
History
Giovanni Cabiddu dc3809f390 crypto: qat - fix out-of-bounds read 
commit f6044cc303 upstream.

When preparing an AER-CTR request, the driver copies the key provided by
the user into a data structure that is accessible by the firmware.
If the target device is QAT GEN4, the key size is rounded up by 16 since
a rounded up size is expected by the device.
If the key size is rounded up before the copy, the size used for copying
the key might be bigger than the size of the region containing the key,
causing an out-of-bounds read.

Fix by doing the copy first and then update the keylen.

This is to fix the following warning reported by KASAN:

	[  138.150574] BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat]
	[  138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgr_test/2340

	[  138.150651] CPU: 15 PID: 2340 Comm: cryptomgr_test Not tainted 6.2.0-rc1+ #45
	[  138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13.2208261706 08/26/2022
	[  138.150663] Call Trace:
	[  138.150668]  <TASK>
	[  138.150922]  kasan_check_range+0x13a/0x1c0
	[  138.150931]  memcpy+0x1f/0x60
	[  138.150940]  qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat]
	[  138.151006]  qat_alg_skcipher_init_sessions+0xc1/0x240 [intel_qat]
	[  138.151073]  crypto_skcipher_setkey+0x82/0x160
	[  138.151085]  ? prepare_keybuf+0xa2/0xd0
	[  138.151095]  test_skcipher_vec_cfg+0x2b8/0x800

Fixes: 67916c9516 ("crypto: qat - add AES-CTR support for QAT GEN4 devices")
Cc: <stable@vger.kernel.org>
Reported-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Reviewed-by: Vladis Dronov <vdronov@redhat.com>
Tested-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2023-03-10 09:34:19 +01:00
..
qat_4xxx crypto: qat - fix error return code in adf_probe 2022-12-31 13:32:36 +01:00
qat_c3xxx crypto: qat - fix ETR sources enabled by default on GEN2 devices 2022-04-15 16:34:26 +08:00
qat_c3xxxvf crypto: qat - config VFs based on ring-to-svc mapping 2021-12-24 14:18:27 +11:00
qat_c62x crypto: qat - fix ETR sources enabled by default on GEN2 devices 2022-04-15 16:34:26 +08:00
qat_c62xvf crypto: qat - config VFs based on ring-to-svc mapping 2021-12-24 14:18:27 +11:00
qat_common crypto: qat - fix out-of-bounds read 2023-03-10 09:34:19 +01:00
qat_dh895xcc crypto: qat - replace disable_vf2pf_interrupts() 2022-04-15 16:34:27 +08:00
qat_dh895xccvf crypto: qat - config VFs based on ring-to-svc mapping 2021-12-24 14:18:27 +11:00
Kconfig crypto: qat - Removes the x86 dependency on the QAT drivers 2022-06-24 17:12:29 +08:00
Makefile crypto: qat - add qat_4xxx driver 2020-11-20 14:45:34 +11:00