[PATCH] crypto/ipsec_mb: fix Null ptr dereference in set_mb_job_params()

[PATCH] crypto/ipsec_mb: fix Null ptr dereference in set_mb_job_params()

[Alexander Konyukhov]

From: Konyukhov Aleksandr <Alexander.Konyukhov@kaspersky.com>

In function set_mb_job_params pmd_aesni_mb.c:1742 check
(cipher_mode == IMB_CIPHER_NULL && oop)
is not enath to garanteed job->dst != 0, which in turn could lead to
NULL ptr dereference.

Add new check for (sgl == 0) to be shure that job->dst
was set in pmd_aesni_mb.c:1610

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 03944ff5e3df ("crypto/ipsec_mb: support null auth/cipher for aesni_mb")
Cc: roy.fan.zhang@intel.com

Signed-off-by: Konyukhov Aleksandr <Alexander.Konyukhov@kaspersky.com>
---
 drivers/crypto/ipsec_mb/pmd_aesni_mb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
index 05dc1a039f..57d8925a87 100644
--- a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
+++ b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
@@ -1738,7 +1738,7 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp,
 		job->msg_len_to_cipher_in_bytes = op->sym->cipher.data.length;
 	}
 
-	if (cipher_mode == IMB_CIPHER_NULL && oop) {
+	if (cipher_mode == IMB_CIPHER_NULL && oop && !sgl) {
 		memcpy(job->dst + job->cipher_start_src_offset_in_bytes,
 			job->src + job->cipher_start_src_offset_in_bytes,
 			job->msg_len_to_cipher_in_bytes);
-- 
2.55.0.windows.2

[PATCH] crypto/ipsec_mb: fix Null ptr dereference in set_mb_job_params()

[Konyukhov Aleksandr]

In function set_mb_job_params pmd_aesni_mb.c:1742 check
(cipher_mode == IMB_CIPHER_NULL && oop)
is not enath to garanteed job->dst != 0, which in turn could lead to
NULL ptr dereference.

Add new check for (sgl == 0) to be shure that job->dst
was set in pmd_aesni_mb.c:1610

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 03944ff5e3df ("crypto/ipsec_mb: support null auth/cipher for aesni_mb")
Cc: roy.fan.zhang@intel.com

Signed-off-by: Konyukhov Aleksandr <Alexander.Konyukhov@kaspersky.com>
---
 drivers/crypto/ipsec_mb/pmd_aesni_mb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
index 05dc1a039f..57d8925a87 100644
--- a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
+++ b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
@@ -1738,7 +1738,7 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp,
 		job->msg_len_to_cipher_in_bytes = op->sym->cipher.data.length;
 	}
 
-	if (cipher_mode == IMB_CIPHER_NULL && oop) {
+	if (cipher_mode == IMB_CIPHER_NULL && oop && !sgl) {
 		memcpy(job->dst + job->cipher_start_src_offset_in_bytes,
 			job->src + job->cipher_start_src_offset_in_bytes,
 			job->msg_len_to_cipher_in_bytes);
-- 
2.55.0.windows.2

Re: [PATCH] crypto/ipsec_mb: fix Null ptr dereference in set_mb_job_params()

[Radu Nicolau]

On 25-Sep-26 2:17 PM, Konyukhov Aleksandr wrote:
> In function set_mb_job_params pmd_aesni_mb.c:1742 check
> (cipher_mode == IMB_CIPHER_NULL && oop)
> is not enath to garanteed job->dst != 0, which in turn could lead to
> NULL ptr dereference.
>
> Add new check for (sgl == 0) to be shure that job->dst
> was set in pmd_aesni_mb.c:1610
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 03944ff5e3df ("crypto/ipsec_mb: support null auth/cipher for aesni_mb")
> Cc: roy.fan.zhang@intel.com
>
> Signed-off-by: Konyukhov Aleksandr <Alexander.Konyukhov@kaspersky.com>
> ---
>   drivers/crypto/ipsec_mb/pmd_aesni_mb.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
> index 05dc1a039f..57d8925a87 100644
> --- a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
> +++ b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
> @@ -1738,7 +1738,7 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp,
>   		job->msg_len_to_cipher_in_bytes = op->sym->cipher.data.length;
>   	}
>   
> -	if (cipher_mode == IMB_CIPHER_NULL && oop) {
> +	if (cipher_mode == IMB_CIPHER_NULL && oop && !sgl) {
>   		memcpy(job->dst + job->cipher_start_src_offset_in_bytes,
>   			job->src + job->cipher_start_src_offset_in_bytes,
>   			job->msg_len_to_cipher_in_bytes);

An error code should be returned here instead of silently fail the 
memcopy / NULL cipher operation.

Something like this below, make sure job->user_data is set

--- a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
+++ b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
@@ -2142,15 +2142,19 @@ set_mb_job_params(IMB_JOB *job, struct 
ipsec_mb_qp *qp,
                 job->msg_len_to_cipher_in_bytes = 
op->sym->cipher.data.length;
         }

-       if (cipher_mode == IMB_CIPHER_NULL && oop) {
-               memcpy(job->dst + job->cipher_start_src_offset_in_bytes,
-                       job->src + job->cipher_start_src_offset_in_bytes,
-                       job->msg_len_to_cipher_in_bytes);
-       }
-
         /* Set user data to be crypto operation data struct */
         job->user_data = op;

+       if (cipher_mode == IMB_CIPHER_NULL && oop) {
+               if (!sgl) {
+                       memcpy(job->dst + 
job->cipher_start_src_offset_in_bytes,
+                               job->src + 
job->cipher_start_src_offset_in_bytes,
+                               job->msg_len_to_cipher_in_bytes);
+                       } else {
+                               return -1;
+                       }
+       }
+
         if (sgl) {

                 if (lb_sgl)