A "capi:" table line that pairs an AEAD cipher with the lmk IV mode,
for example "capi:gcm(aes)-lmk" with the integrity:28:aead option,
causes an oops when it is loaded. lmk sets tfms_count to 64, but
crypt_alloc_tfms_aead only allocates one transform, so crypt_setkey
reads past the end of the tfms_aead array and calls crypto_aead_setkey
on the values it finds there.
lmk exists for compatibility with Loop-AES, which uses CBC, so refuse
it with an AEAD cipher rather than allocate 64 AEAD transforms. The
check cannot go in crypt_iv_lmk_ctr with the other lmk checks, because
the IV constructor runs after crypt_set_key.
Fixes: 33d2f09fcb35 ("dm crypt: introduce new format of cipher with "capi:"
prefix")
Cc: [email protected]
Signed-off-by: Ben Cressey <[email protected]>
Assisted-by: LLM
---
To reproduce, with slub_debug=P: dmsetup create x --table "0 <n> crypt
capi:gcm(aes)-lmk <32-byte key> 0 /dev/ram0 0 1 integrity:28:aead".
No integrity profile is needed on the underlying device; crypt_setkey
runs before dm-crypt checks for one.
---
drivers/md/dm-crypt.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 9e170de50ad32..0bd22bda3e2de 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2894,8 +2894,13 @@ static int crypt_ctr_cipher_new(struct dm_target *ti,
char *cipher_in, char *key
}
}
- if (*ivmode && !strcmp(*ivmode, "lmk"))
+ if (*ivmode && !strcmp(*ivmode, "lmk")) {
+ if (crypt_integrity_aead(cc)) {
+ ti->error = "AEAD transforms not supported for LMK";
+ return -EINVAL;
+ }
cc->tfms_count = 64;
+ }
if (*ivmode && !strcmp(*ivmode, "essiv")) {
if (!*ivopts) {
---
base-commit: df2908090cda368b01ff43709f51890076c56157
change-id: 20260915-dm-crypt-lmk-aead-2e36abe57e55
