On Wed, 28 Jun 2023 at 15:49, Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote: > > syzbot is reporting uninit-value at aes_encrypt(), for block cipher assumes > that bytes to encrypt/decrypt is multiple of block size for that cipher but > tls_alloc_encrypted_msg() is not initializing padding bytes when > required_size is not multiple of block cipher's block size. > > In order to make sure that padding bytes are automatically initialized, > enable __GFP_ZERO flag when setsockopt(SOL_TCP, TCP_ULP, "tls") is called. > > Reported-by: syzbot <syzbot+828dfc12440b4f6f305d@xxxxxxxxxxxxxxxxxxxxxxxxx> > Closes: https://syzkaller.appspot.com/bug?extid=828dfc12440b4f6f305d Maybe I am missing something, but this syzkaller report appears to b a huge collection of uninit-value reports, of which only one is related to bpx_tx_verdict(), and that one has nor reproducer. So even if this would be the right fix, I don't think closing that issue makes sense, so? The issue refers to a couple of other occcurences of uninit-value in aesti_encrypt, which do seem related. > Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> > --- > According to C reproducer, this problem happens when bpf_exec_tx_verdict() is > called with lower 4 bits of required_size being 0001 and does not happen when > being 0100. Thus, I assumed that this problem is caused by lack of initializing > padding bytes. > But I couldn't figure out why KMSAN reports this problem when bpf_exec_tx_verdict() > is called with lower 4 bits of required_size being 0001 for the second time and > does not report this problem when bpf_exec_tx_verdict() is called with lower > 4 bits of required_size being 0001 for the first time. More deeper problem exists? > KMSAN reporting this problem when accessing u64 relevant? > As Eric pointed out as well, zeroing the allocation papers over the problem. Why are you sending this now? Do you have a reproducer for this issue? > net/tls/tls_main.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c > index f2e7302a4d96..cd5366966864 100644 > --- a/net/tls/tls_main.c > +++ b/net/tls/tls_main.c > @@ -1025,6 +1025,7 @@ static int tls_init(struct sock *sk) > struct tls_context *ctx; > int rc = 0; > > + sk->sk_allocation |= __GFP_ZERO; > tls_build_proto(sk); > > #ifdef CONFIG_TLS_TOE > -- > 2.34.1 >
