Re: [RFC PATCH 00/30] crypto: DES/3DES cleanup

[Eric Biggers <ebiggers@kernel.org>]

On Sat, Jun 22, 2019 at 02:30:42AM +0200, Ard Biesheuvel wrote:
> In my effort to remove crypto_alloc_cipher() invocations from non-crypto
> code, i ran into a DES call in the CIFS driver. This is addressed in
> patch #30.
> 
> The other patches are cleanups for the quirky DES interface, and lots
> of duplication of the weak key checks etc.
> 
> Patch #1 adds new helpers to verify DES keys to crypto/internal.des.h
> 
> The next 23 patches move all existing users of DES routines to the
> new interface.
> 
> Patch #25 and #26 are preparatory patches for the new DES library
> introduced in patch #27, which replaces the various DES related
> functions exported to other drivers with a sane library interface.
> 
> Patch #28 switches the x86 asm code to the new librar interface.
> 
> Patch #29 removes code that is no longer used at this point.
> 
> Ard Biesheuvel (30):
>   crypto: des/3des_ede - add new helpers to verify key length
>   crypto: s390/des - switch to new verification routines
>   crypto: sparc/des - switch to new verification routines
>   crypto: atmel/des - switch to new verification routines
>   crypto: bcm/des - switch to new verification routines
>   crypto: caam/des - switch to new verification routines
>   crypto: cpt/des - switch to new verification routines
>   crypto: nitrox/des - switch to new verification routines
>   crypto: ccp/des - switch to new verification routines
>   crypto: ccree/des - switch to new verification routines
>   crypto: hifn/des - switch to new verification routines
>   crypto: hisilicon/des - switch to new verification routines
>   crypto: safexcel/des - switch to new verification routines
>   crypto: ixp4xx/des - switch to new verification routines
>   crypto: cesa/des - switch to new verification routines
>   crypto: n2/des - switch to new verification routines
>   crypto: omap/des - switch to new verification routines
>   crypto: picoxcell/des - switch to new verification routines
>   crypto: qce/des - switch to new verification routines
>   crypto: rk3288/des - switch to new verification routines
>   crypto: stm32/des - switch to new verification routines
>   crypto: sun4i/des - switch to new verification routines
>   crypto: talitos/des - switch to new verification routines
>   crypto: ux500/des - switch to new verification routines
>   crypto: 3des - move verification out of exported routine
>   crypto: des - remove unused function
>   crypto: des - split off DES library from generic DES cipher driver
>   crypto: x86/des - switch to library interface
>   crypto: des - remove now unused __des3_ede_setkey()
>   fs: cifs: move from the crypto cipher API to the new DES library
>     interface

I got the following on boot with this patchset applied:

alg: cipher: des-generic setkey failed on test vector 5; expected_error=-22, actual_error=-126, flags=0x100100
==================================================================
BUG: KASAN: global-out-of-bounds in des3_ede_expand_key+0x1a4/0x1b0 lib/crypto/des.c:829
Read of size 24 at addr ffffffff82b74a50 by task cryptomgr_test/114
CPU: 0 PID: 114 Comm: cryptomgr_test Not tainted 5.2.0-rc1-00155-g94bc260c0580 #29
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x86/0xca lib/dump_stack.c:113
 print_address_description.cold.2+0xe1/0x1f0 mm/kasan/report.c:188
 __kasan_report.cold.3+0x7d/0x95 mm/kasan/report.c:317
 kasan_report+0x12/0x20 mm/kasan/common.c:614
 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/generic_report.c:142
 des3_ede_expand_key+0x1a4/0x1b0 lib/crypto/des.c:829
 des3_ede_setkey+0x28/0x100 crypto/des_generic.c:72
 setkey+0x149/0x290 crypto/cipher.c:61
 crypto_cipher_setkey include/linux/crypto.h:1741 [inline]
 test_cipher+0x2cb/0x690 crypto/testmgr.c:2373
 alg_test_cipher crypto/testmgr.c:3226 [inline]
 alg_test.part.6+0x531/0x8b0 crypto/testmgr.c:5198
 alg_test+0x33/0x70 crypto/testmgr.c:5177
 cryptomgr_test+0x56/0x80 crypto/algboss.c:223
 kthread+0x324/0x3e0 kernel/kthread.c:254
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
The buggy address belongs to the variable:
 des3_ede_cbc_tv_template+0xb0/0x500
Memory state around the buggy address:
 ffffffff82b74900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 fa
 ffffffff82b74980: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff82b74a00: 00 00 00 00 fa fa fa fa 00 00 00 01 fa fa fa fa
                                                    ^
 ffffffff82b74a80: 00 01 fa fa fa fa fa fa 00 01 fa fa fa fa fa fa
 ffffffff82b74b00: 00 00 00 01 fa fa fa fa 00 01 fa fa fa fa fa fa
==================================================================