Re: [PATCH v5 2/3] s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The temporary stack buffer `buf` in `ctr_paes_do_crypt()` is not explicitly scrubbed before the function returns, leaving sensitive plaintext and/or ciphertext data exposed on the kernel stack. This is identical to the issue fixed in `ctr_aes_crypt()` by this patchset, which missed the Protected AES counterpart implementation.
--

commit 5028b97eb1d91a81a384b0480662106643fa02f9
Author: Harald Freudenberger <freude@linux.ibm.com>

s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm

This commit fixes missing explicit scrubs of temporary stack buffers and
CPACF parameter blocks in the s390 AES CTR and GCM implementations. It
ensures sensitive data is cleared before the functions return.

> diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
> index 366ce22d36237..10561aa687c78 100644
> --- a/arch/s390/crypto/aes_s390.c
> +++ b/arch/s390/crypto/aes_s390.c
> @@ -604,6 +604,7 @@ static int ctr_aes_crypt(struct skcipher_request *req)
>  		memcpy(walk.dst.virt.addr, buf, nbytes);
>  		crypto_inc(walk.iv, AES_BLOCK_SIZE);
>  		ret = skcipher_walk_done(&walk, 0);
> +		memzero_explicit(buf, sizeof(buf));

[Severity: High]
This is a pre-existing issue, but does the Protected AES counterpart need
this identical fix?

Looking at ctr_paes_do_crypt() in arch/s390/crypto/paes_s390.c, there is a
similar temporary stack buffer used for partial block processing that does
not appear to be scrubbed before returning:

arch/s390/crypto/paes_s390.c:ctr_paes_do_crypt() {
    ...
		memcpy(walk->dst.virt.addr, buf, nbytes);
		crypto_inc(walk->iv, AES_BLOCK_SIZE);
		rc = skcipher_walk_done(walk, 0);
	}

out:
	pr_debug("rc=%d\n", rc);
	return rc;
}

Can executing a cryptographic operation in Protected AES CTR mode with a data
length that is not a multiple of AES_BLOCK_SIZE expose sensitive plaintext or
ciphertext bytes on the kernel stack when this buffer goes out of scope?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831083735.3625-1-freude@linux.ibm.com?part=2