Re: [PATCH v2 2/6] s390/crypto: Fix missing scrub of temp buffers with PAES algorithm

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Missing memory scrub on stack temporary bounce buffer in `ctr_aes_crypt()`.
- [Medium] Missing memory scrub on stack bounce buffers in `gcm_aes_crypt()`.
--

--- Patch [2]: [PATCH v2 2/6] s390/crypto: Fix missing scrub of temp buffers with PAES algorithm ---
commit 517f415eda900d45f7871a3da2f51b851e06642f
Author: Harald Freudenberger <freude@linux.ibm.com>

s390/crypto: Fix missing scrub of temp buffers with PAES algorithm

This patch explicitly scrubs the stack bounce buffer used for partial block
processing in ctr_paes_do_crypt(). It also updates __xts_2keys_prep_param()
to scrub the entire pcc_param structure rather than just the key field,
preventing inadvertent exposure of sensitive cryptographic material.

> diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
> index ccc7da106c3a0..d075b0241f1f5 100644
> --- a/arch/s390/crypto/paes_s390.c
> +++ b/arch/s390/crypto/paes_s390.c
> @@ -1044,6 +1044,7 @@ static int ctr_paes_do_crypt(struct s390_paes_ctx *ctx,
>  	}
>  
>  out:
> +	memzero_explicit(buf, sizeof(buf));

[Severity: Medium]
This is a pre-existing issue, but does ctr_aes_crypt() in
arch/s390/crypto/aes_s390.c have the same missing scrub on its temporary
bounce buffer?

Like the PAES algorithm fixed here, intermediate cryptographic data
appears to be left on the kernel stack when an AES-CTR operation
processes a final partial block that is not a multiple of AES_BLOCK_SIZE:

arch/s390/crypto/aes_s390.c:ctr_aes_crypt() {
    ...
	if (nbytes) {
		memset(buf, 0, AES_BLOCK_SIZE);
		memcpy(buf, walk.src.virt.addr, nbytes);
		cpacf_kmctr(sctx->fc, sctx->key, buf, buf,
			    AES_BLOCK_SIZE, walk.iv);
		memcpy(walk.dst.virt.addr, buf, nbytes);
		crypto_inc(walk.iv, AES_BLOCK_SIZE);
		ret = skcipher_walk_done(&walk, 0);
	}

	return ret;
}

>  	pr_debug("rc=%d\n", rc);
>  	return rc;
>  }
> @@ -1377,7 +1378,7 @@ static inline int __xts_2keys_prep_param(struct s390_pxts_ctx *ctx,
>  		memcpy(param->init, pcc_param.xts, 16);
>  	}
>  
> -	memzero_explicit(pcc_param.key, sizeof(pcc_param.key));
> +	memzero_explicit(&pcc_param, sizeof(pcc_param));

[Severity: Medium]
This is also a pre-existing issue, but does gcm_aes_crypt() in
arch/s390/crypto/aes_s390.c also need its stack bounce buffers scrubbed?

It explicitly scrubs the param structure, but seems to omit scrubbing
gw_in and gw_out. This leaves intermediate cryptographic data on the stack
when an AES-GCM operation with scattered or unaligned data uses the internal
bounce buffers:

arch/s390/crypto/aes_s390.c:gcm_aes_crypt() {
    ...
	struct gcm_sg_walk gw_in, gw_out;
    ...
	memzero_explicit(&param, sizeof(param));
	return ret;
}

>  	return rc;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260817104203.74033-1-freude@linux.ibm.com?part=2