linux-kernel - Re: [syzbot] ff/ext4: Prevent crypto operation on unaligned blocks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 05 Jun 2024 13:17:24 -0700
From: syzbot <syzbot+aeb14e2539ffb6d21130@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] ff/ext4: Prevent crypto operation on unaligned blocks

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: ff/ext4: Prevent crypto operation on unaligned blocks
Author: norkam41@...il.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 45db3ab70092637967967bfd8e6144017638563c

syzbot is reporting an uninitialized value in aes_encrypt(). The block
cipher expects the bytes to encrypt or decrypt to be a multiple of the
cipher's block size. However, when ext4_write_begin() is called and new
folios are allocated and they might not be aligned to the required block
size.

To ensure that padding bytes are automatically initialized in
the ext4_write_begin, this patch adds __GFP_ZERO to the existing GFP
masks. This adjustment is applied only when the CONFIG_FS_ENCRYPTION
is defined.

Closes: https://syzkaller.appspot.com/bug?extid=aeb14e2539ffb6d21130
Signed-off-by: Norbert Kamiński <norkam41@...il.com>
---
 fs/ext4/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 4bae9ccf5fe0..1a8e47221e72 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1156,6 +1156,9 @@ static int ext4_write_begin(struct file *file, struct address_space *mapping,
 	 * the folio (if needed) without using GFP_NOFS.
 	 */
 retry_grab:
+#ifdef CONFIG_FS_ENCRYPTION
+	mapping_set_gfp_mask(mapping, mapping_gfp_mask(mapping) | __GFP_ZERO);
+#endif
 	folio = __filemap_get_folio(mapping, index, FGP_WRITEBEGIN,
 					mapping_gfp_mask(mapping));
 	if (IS_ERR(folio))
@@ -2882,6 +2885,9 @@ static int ext4_da_write_begin(struct file *file, struct address_space *mapping,
 	}
 
 retry:
+#ifdef CONFIG_FS_ENCRYPTION
+	mapping_set_gfp_mask(mapping, mapping_gfp_mask(mapping) | __GFP_ZERO);
+#endif
 	folio = __filemap_get_folio(mapping, index, FGP_WRITEBEGIN,
 			mapping_gfp_mask(mapping));
 	if (IS_ERR(folio))
-- 
2.34.1