Re: [PATCH v5 09/19] crypto: cmh - add SM4 skcipher/aead/cmac/xcbc

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] crypto: cmh: missing DoS limit check in cmh_sm4_mac_import allows memory exhaustion
--

commit 60aa3a7525d3c5b378e645a473550b644da1ca56
Author: Alex Ousherovitch <aousherovitch@rambus.com>

crypto: cmh - add SM4 skcipher/aead/cmac/xcbc

This commit registers SM4 skcipher, AEAD, and MAC (CMAC, XCBC) algorithms
using the CMH SM4 core. It implements various fallback mechanisms for empty
inputs and handles scatter-gather logic by linearizing memory buffers.

> diff --git a/drivers/crypto/cmh/cmh_sm4_cmac.c b/drivers/crypto/cmh/cmh_sm4_cmac.c
> new file mode 100644
> index 0000000000000..abeadce312c09
> --- /dev/null
> +++ b/drivers/crypto/cmh/cmh_sm4_cmac.c

[ ... ]

> +static int cmh_sm4_mac_import(struct ahash_request *req, const void *in)
> +{
> +	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
> +	struct cmh_sm4_mac_tfm_ctx *tctx = crypto_ahash_ctx(tfm);
> +	struct cmh_sm4_mac_reqctx *rctx = ahash_request_ctx(req);
> +	const struct cmh_sm4_mac_export_state *state = in;
> +	struct cmh_sm4_mac_chunk *chunk;

[ ... ]

> +	if (state->total_len) {
> +		chunk = kmalloc(sizeof(*chunk) + state->total_len,
> +				req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
> +				GFP_KERNEL : GFP_ATOMIC);
> +		if (!chunk)
> +			return -ENOMEM;
> +		chunk->len = state->total_len;
> +		memcpy(chunk->data, state->data, state->total_len);
> +		spin_lock_bh(&tctx->chunk_lock);
> +		list_add_tail(&chunk->list, &rctx->chunks);
> +		list_add_tail(&chunk->tfm_node, &tctx->all_chunks);
> +		tctx->tfm_buffered += chunk->len;
> +		spin_unlock_bh(&tctx->chunk_lock);

[Severity: High]
Does this code allow an unbounded memory allocation bypass?

When an AF_ALG socket is created for cmac(sm4) or xcbc(sm4), a user can write
some data so it gets buffered, and then repeatedly call accept() on the
socket. Each accept() clones the request, triggering a crypto_ahash_export
on the parent and a crypto_ahash_import on the child.

During cmh_sm4_mac_import(), the function allocates a new chunk for the
imported data and adds it to the per-tfm list tctx->all_chunks. However, it
does not check if the total buffered memory exceeds the
CMH_SM4_MAC_TFM_MAX_BUFFERED limit, unlike cmh_sm4_mac_update().

If the user closes the child socket, the allocated chunks are abandoned in
tctx->all_chunks. Repeating this indefinitely could exhaust kernel memory and
cause a denial of service.

> +		rctx->total_len = state->total_len;
> +	}
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917225929.2494111-1-aousherovitch@rambus.com?part=9