linux-kernel - Re: [PATCH] crypto: scomp - Fix off-by-one bug when calculating last page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aAaWODz21QmhPvpo@GRAPHRT>
Date: Mon, 21 Apr 2025 22:02:16 +0300
From: Marius Dinu <marius@...hoexpert.ro>
To: Herbert Xu <herbert@...dor.apana.org.au>
Cc: Nhat Pham <nphamcs@...il.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"Sridhar, Kanchana P" <kanchana.p.sridhar@...el.com>,
	Yosry Ahmed <yosry.ahmed@...ux.dev>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	"hannes@...xchg.org" <hannes@...xchg.org>,
	"chengming.zhou@...ux.dev" <chengming.zhou@...ux.dev>,
	"usamaarif642@...il.com" <usamaarif642@...il.com>,
	"ryan.roberts@....com" <ryan.roberts@....com>,
	"21cnbao@...il.com" <21cnbao@...il.com>,
	"ying.huang@...ux.alibaba.com" <ying.huang@...ux.alibaba.com>,
	"linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
	"davem@...emloft.net" <davem@...emloft.net>,
	"clabbe@...libre.com" <clabbe@...libre.com>,
	"ardb@...nel.org" <ardb@...nel.org>,
	"ebiggers@...gle.com" <ebiggers@...gle.com>,
	"surenb@...gle.com" <surenb@...gle.com>,
	"Accardi, Kristen C" <kristen.c.accardi@...el.com>,
	"Feghali, Wajdi K" <wajdi.k.feghali@...el.com>,
	"Gopal, Vinodh" <vinodh.gopal@...el.com>, m95d@...hoexpert.ro
Subject: Re: [PATCH] crypto: scomp - Fix off-by-one bug when calculating last
 page

On Mon, 2025-04-21 11.31.31 ++0800, Herbert Xu wrote:
> On Sun, Apr 20, 2025 at 04:35:44PM -0700, Nhat Pham wrote:
> >
> > Anyhow, this looks like a crypto/compression infra bug. Herbert, does
> > this ring any bell for you?
> 
> Yes this looks like an off-by-one bug in the new scomp scratch
> code.
> 
> ---8<---
> Fix off-by-one bug in the last page calculation for src and dst.
> 
> Reported-by: Nhat Pham <nphamcs@...il.com>
> Fixes: 2d3553ecb4e3 ("crypto: scomp - Remove support for some non-trivial SG lists")
> Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>
> 
> diff --git a/crypto/scompress.c b/crypto/scompress.c
> index 5762fcc63b51..36934c78d127 100644
> --- a/crypto/scompress.c
> +++ b/crypto/scompress.c
> @@ -215,8 +215,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
>  			spage = nth_page(spage, soff / PAGE_SIZE);
>  			soff = offset_in_page(soff);
>  
> -			n = slen / PAGE_SIZE;
> -			n += (offset_in_page(slen) + soff - 1) / PAGE_SIZE;
> +			n = (slen - 1) / PAGE_SIZE;
> +			n += (offset_in_page(slen - 1) + soff) / PAGE_SIZE;
>  			if (PageHighMem(nth_page(spage, n)) &&
>  			    size_add(soff, slen) > PAGE_SIZE)
>  				break;
> @@ -243,9 +243,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
>  			dpage = nth_page(dpage, doff / PAGE_SIZE);
>  			doff = offset_in_page(doff);
>  
> -			n = dlen / PAGE_SIZE;
> -			n += (offset_in_page(dlen) + doff - 1) / PAGE_SIZE;
> -			if (PageHighMem(dpage + n) &&
> +			n = (dlen - 1) / PAGE_SIZE;
> +			n += (offset_in_page(dlen - 1) + doff) / PAGE_SIZE;
> +			if (PageHighMem(nth_page(dpage, n)) &&
>  			    size_add(doff, dlen) > PAGE_SIZE)
>  				break;
>  			dst = kmap_local_page(dpage) + doff;
> -- 
> Email: Herbert Xu <herbert@...dor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Tested the patch with git master branch on the same SBC as my bug report.
It works. stress-ng --pageswap doesn't crash anymore.

Thank you!

Marius Dinu