Eric Lee / smarc-fsl-linux-kernel

29 Nov, 2017

1 commit

25 Nov, 2017

1 commit

  • c14ca8386   crypto: skcipher - Fix skcipher_walk_aead_common ... Browse Code »

    The skcipher_walk_aead_common function calls scatterwalk_copychunks on
    the input and output walks to skip the associated data. If the AD end
    at an SG list entry boundary, then after these calls the walks will
    still be pointing to the end of the skipped region.

    These offsets are later checked for alignment in skcipher_walk_next,
    so the skcipher_walk may detect the alignment incorrectly.

    This patch fixes it by calling scatterwalk_done after the copychunks
    calls to ensure that the offsets refer to the right SG list entry.

    Fixes: b286d8b1a690 ("crypto: skcipher - Add skcipher walk interface")
    Cc:
    Signed-off-by: Ondrej Mosnacek
    Signed-off-by: Herbert Xu

    Ondrej Mosnáček
     

24 Nov, 2017

3 commits

  • 7d2c3f54e   crypto: af_alg - remove locking in async callback ... Browse Code »

    The code paths protected by the socket-lock do not use or modify the
    socket in a non-atomic fashion. The actions pertaining the socket do not
    even need to be handled as an atomic operation. Thus, the socket-lock
    can be safely ignored.

    This fixes a bug regarding scheduling in atomic as the callback function
    may be invoked in interrupt context.

    In addition, the sock_hold is moved before the AIO encrypt/decrypt
    operation to ensure that the socket is always present. This avoids a
    tiny race window where the socket is unprotected and yet used by the AIO
    operation.

    Finally, the release of resources for a crypto operation is moved into a
    common function of af_alg_free_resources.

    Cc:
    Fixes: e870456d8e7c8 ("crypto: algif_skcipher - overhaul memory management")
    Fixes: d887c52d6ae43 ("crypto: algif_aead - overhaul memory management")
    Reported-by: Romain Izard
    Signed-off-by: Stephan Mueller
    Tested-by: Romain Izard
    Signed-off-by: Herbert Xu

    Stephan Mueller
     
  • 8e1fa89aa   crypto: algif_aead - skip SGL entries with NULL page ... Browse Code »

    The TX SGL may contain SGL entries that are assigned a NULL page. This
    may happen if a multi-stage AIO operation is performed where the data
    for each stage is pointed to by one SGL entry. Upon completion of that
    stage, af_alg_pull_tsgl will assign NULL to the SGL entry.

    The NULL cipher used to copy the AAD from TX SGL to the destination
    buffer, however, cannot handle the case where the SGL starts with an SGL
    entry having a NULL page. Thus, the code needs to advance the start
    pointer into the SGL to the first non-NULL entry.

    This fixes a crash visible on Intel x86 32 bit using the libkcapi test
    suite.

    Cc:
    Fixes: 72548b093ee38 ("crypto: algif_aead - copy AAD from src to dst")
    Signed-off-by: Stephan Mueller
    Signed-off-by: Herbert Xu

    Stephan Mueller
     
  • ce44cd8df   Merge tag 'keys-next-20171123' of git://git.kernel.org/pub/scm/linux/kernel/git/… ... Browse Code »

    …dhowells/linux-fs into next-keys

    Merge keys subsystem changes from David Howells, for v4.15.

    James Morris
     

16 Nov, 2017

2 commits

15 Nov, 2017

1 commit

  • 37dc79565   Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 ... Browse Code »

    Pull crypto updates from Herbert Xu:
    "Here is the crypto update for 4.15:

    API:

    - Disambiguate EBUSY when queueing crypto request by adding ENOSPC.
    This change touches code outside the crypto API.
    - Reset settings when empty string is written to rng_current.

    Algorithms:

    - Add OSCCA SM3 secure hash.

    Drivers:

    - Remove old mv_cesa driver (replaced by marvell/cesa).
    - Enable rfc3686/ecb/cfb/ofb AES in crypto4xx.
    - Add ccm/gcm AES in crypto4xx.
    - Add support for BCM7278 in iproc-rng200.
    - Add hash support on Exynos in s5p-sss.
    - Fix fallback-induced error in vmx.
    - Fix output IV in atmel-aes.
    - Fix empty GCM hash in mediatek.

    Others:

    - Fix DoS potential in lib/mpi.
    - Fix potential out-of-order issues with padata"

    * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (162 commits)
    lib/mpi: call cond_resched() from mpi_powm() loop
    crypto: stm32/hash - Fix return issue on update
    crypto: dh - Remove pointless checks for NULL 'p' and 'g'
    crypto: qat - Clean up error handling in qat_dh_set_secret()
    crypto: dh - Don't permit 'key' or 'g' size longer than 'p'
    crypto: dh - Don't permit 'p' to be 0
    crypto: dh - Fix double free of ctx->p
    hwrng: iproc-rng200 - Add support for BCM7278
    dt-bindings: rng: Document BCM7278 RNG200 compatible
    crypto: chcr - Replace _manual_ swap with swap macro
    crypto: marvell - Add a NULL entry at the end of mv_cesa_plat_id_table[]
    hwrng: virtio - Virtio RNG devices need to be re-registered after suspend/resume
    crypto: atmel - remove empty functions
    crypto: ecdh - remove empty exit()
    MAINTAINERS: update maintainer for qat
    crypto: caam - remove unused param of ctx_map_to_sec4_sg()
    crypto: caam - remove unneeded edesc zeroization
    crypto: atmel-aes - Reset the controller before each use
    crypto: atmel-aes - properly set IV after {en,de}crypt
    hwrng: core - Reset user selected rng by writing "" to rng_current
    ...

    Linus Torvalds
     

10 Nov, 2017

4 commits

  • ced6a5863   crypto: dh - Remove pointless checks for NULL 'p' and 'g' ... Browse Code »

    Neither 'p' nor 'g' can be NULL, as they were unpacked using
    crypto_dh_decode_key(). And it makes no sense for them to be optional.
    So remove the NULL checks that were copy-and-pasted into both modules.

    Signed-off-by: Eric Biggers
    Reviewed-by: Tudor Ambarus
    Signed-off-by: Herbert Xu

    Eric Biggers
     
  • ccd9888f1   crypto: dh - Don't permit 'key' or 'g' size longer than 'p' ... Browse Code »

    The "qat-dh" DH implementation assumes that 'key' and 'g' can be copied
    into a buffer with size 'p_size'. However it was never checked that
    that was actually the case, which most likely allowed users to cause a
    buffer underflow via KEYCTL_DH_COMPUTE.

    Fix this by updating crypto_dh_decode_key() to verify this precondition
    for all DH implementations.

    Fixes: c9839143ebbf ("crypto: qat - Add DH support")
    Cc: # v4.8+
    Signed-off-by: Eric Biggers
    Reviewed-by: Tudor Ambarus
    Signed-off-by: Herbert Xu

    Eric Biggers
     
  • 199512b12   crypto: dh - Don't permit 'p' to be 0 ... Browse Code »

    If 'p' is 0 for the software Diffie-Hellman implementation, then
    dh_max_size() returns 0. In the case of KEYCTL_DH_COMPUTE, this causes
    ZERO_SIZE_PTR to be passed to sg_init_one(), which with
    CONFIG_DEBUG_SG=y triggers the 'BUG_ON(!virt_addr_valid(buf));' in
    sg_set_buf().

    Fix this by making crypto_dh_decode_key() reject 0 for 'p'. p=0 makes
    no sense for any DH implementation because 'p' is supposed to be a prime
    number. Moreover, 'mod 0' is not mathematically defined.

    Bug report:

    kernel BUG at ./include/linux/scatterlist.h:140!
    invalid opcode: 0000 [#1] SMP KASAN
    CPU: 0 PID: 27112 Comm: syz-executor2 Not tainted 4.14.0-rc7-00010-gf5dbb5d0ce32-dirty #7
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.3-20171021_125229-anatol 04/01/2014
    task: ffff88006caac0c0 task.stack: ffff88006c7c8000
    RIP: 0010:sg_set_buf include/linux/scatterlist.h:140 [inline]
    RIP: 0010:sg_init_one+0x1b3/0x240 lib/scatterlist.c:156
    RSP: 0018:ffff88006c7cfb08 EFLAGS: 00010216
    RAX: 0000000000010000 RBX: ffff88006c7cfe30 RCX: 00000000000064ee
    RDX: ffffffff81cf64c3 RSI: ffffc90000d72000 RDI: ffffffff92e937e0
    RBP: ffff88006c7cfb30 R08: ffffed000d8f9fab R09: ffff88006c7cfd30
    R10: 0000000000000005 R11: ffffed000d8f9faa R12: ffff88006c7cfd30
    R13: 0000000000000000 R14: 0000000000000010 R15: ffff88006c7cfc50
    FS: 00007fce190fa700(0000) GS:ffff88003ea00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007fffc6b33db8 CR3: 000000003cf64000 CR4: 00000000000006f0
    Call Trace:
    __keyctl_dh_compute+0xa95/0x19b0 security/keys/dh.c:360
    keyctl_dh_compute+0xac/0x100 security/keys/dh.c:434
    SYSC_keyctl security/keys/keyctl.c:1745 [inline]
    SyS_keyctl+0x72/0x2c0 security/keys/keyctl.c:1641
    entry_SYSCALL_64_fastpath+0x1f/0xbe
    RIP: 0033:0x4585c9
    RSP: 002b:00007fce190f9bd8 EFLAGS: 00000216 ORIG_RAX: 00000000000000fa
    RAX: ffffffffffffffda RBX: 0000000000738020 RCX: 00000000004585c9
    RDX: 000000002000d000 RSI: 0000000020000ff4 RDI: 0000000000000017
    RBP: 0000000000000046 R08: 0000000020008000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000216 R12: 00007fff6e610cde
    R13: 00007fff6e610cdf R14: 00007fce190fa700 R15: 0000000000000000
    Code: 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 33 5b 45 89 6c 24 14 41 5c 41 5d 41 5e 41 5f 5d c3 e8 fd 8f 68 ff 0b e8 f6 8f 68 ff 0f 0b e8 ef 8f 68 ff 0f 0b e8 e8 8f 68 ff 20
    RIP: sg_set_buf include/linux/scatterlist.h:140 [inline] RSP: ffff88006c7cfb08
    RIP: sg_init_one+0x1b3/0x240 lib/scatterlist.c:156 RSP: ffff88006c7cfb08

    Fixes: 802c7f1c84e4 ("crypto: dh - Add DH software implementation")
    Cc: # v4.8+
    Reviewed-by: Tudor Ambarus
    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Eric Biggers
     
  • 12d41a023   crypto: dh - Fix double free of ctx->p ... Browse Code »

    When setting the secret with the software Diffie-Hellman implementation,
    if allocating 'g' failed (e.g. if it was longer than
    MAX_EXTERN_MPI_BITS), then 'p' was freed twice: once immediately, and
    once later when the crypto_kpp tfm was destroyed.

    Fix it by using dh_free_ctx() (renamed to dh_clear_ctx()) in the error
    paths, as that correctly sets the pointers to NULL.

    KASAN report:

    MPI: mpi too large (32760 bits)
    ==================================================================
    BUG: KASAN: use-after-free in mpi_free+0x131/0x170
    Read of size 4 at addr ffff88006c7cdf90 by task reproduce_doubl/367

    CPU: 1 PID: 367 Comm: reproduce_doubl Not tainted 4.14.0-rc7-00040-g05298abde6fe #7
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    Call Trace:
    dump_stack+0xb3/0x10b
    ? mpi_free+0x131/0x170
    print_address_description+0x79/0x2a0
    ? mpi_free+0x131/0x170
    kasan_report+0x236/0x340
    ? akcipher_register_instance+0x90/0x90
    __asan_report_load4_noabort+0x14/0x20
    mpi_free+0x131/0x170
    ? akcipher_register_instance+0x90/0x90
    dh_exit_tfm+0x3d/0x140
    crypto_kpp_exit_tfm+0x52/0x70
    crypto_destroy_tfm+0xb3/0x250
    __keyctl_dh_compute+0x640/0xe90
    ? kasan_slab_free+0x12f/0x180
    ? dh_data_from_key+0x240/0x240
    ? key_create_or_update+0x1ee/0xb20
    ? key_instantiate_and_link+0x440/0x440
    ? lock_contended+0xee0/0xee0
    ? kfree+0xcf/0x210
    ? SyS_add_key+0x268/0x340
    keyctl_dh_compute+0xb3/0xf1
    ? __keyctl_dh_compute+0xe90/0xe90
    ? SyS_add_key+0x26d/0x340
    ? entry_SYSCALL_64_fastpath+0x5/0xbe
    ? trace_hardirqs_on_caller+0x3f4/0x560
    SyS_keyctl+0x72/0x2c0
    entry_SYSCALL_64_fastpath+0x1f/0xbe
    RIP: 0033:0x43ccf9
    RSP: 002b:00007ffeeec96158 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa
    RAX: ffffffffffffffda RBX: 000000000248b9b9 RCX: 000000000043ccf9
    RDX: 00007ffeeec96170 RSI: 00007ffeeec96160 RDI: 0000000000000017
    RBP: 0000000000000046 R08: 0000000000000000 R09: 0248b9b9143dc936
    R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000000
    R13: 0000000000409670 R14: 0000000000409700 R15: 0000000000000000

    Allocated by task 367:
    save_stack_trace+0x16/0x20
    kasan_kmalloc+0xeb/0x180
    kmem_cache_alloc_trace+0x114/0x300
    mpi_alloc+0x4b/0x230
    mpi_read_raw_data+0xbe/0x360
    dh_set_secret+0x1dc/0x460
    __keyctl_dh_compute+0x623/0xe90
    keyctl_dh_compute+0xb3/0xf1
    SyS_keyctl+0x72/0x2c0
    entry_SYSCALL_64_fastpath+0x1f/0xbe

    Freed by task 367:
    save_stack_trace+0x16/0x20
    kasan_slab_free+0xab/0x180
    kfree+0xb5/0x210
    mpi_free+0xcb/0x170
    dh_set_secret+0x2d7/0x460
    __keyctl_dh_compute+0x623/0xe90
    keyctl_dh_compute+0xb3/0xf1
    SyS_keyctl+0x72/0x2c0
    entry_SYSCALL_64_fastpath+0x1f/0xbe

    Fixes: 802c7f1c84e4 ("crypto: dh - Add DH software implementation")
    Cc: # v4.8+
    Signed-off-by: Eric Biggers
    Reviewed-by: Tudor Ambarus
    Signed-off-by: Herbert Xu

    Eric Biggers
     

07 Nov, 2017

1 commit

06 Nov, 2017

1 commit

  • f560acc3b   crypto: ecdh - remove empty exit() ... Browse Code »

    Pointer members of an object with static storage duration, if not
    explicitly initialized, will be initialized to a NULL pointer. The crypto
    API checks if this pointer is not NULL before using it, we are safe to
    remove the function.

    Signed-off-by: Tudor Ambarus
    Signed-off-by: Herbert Xu

    Tudor-Dan Ambarus
     

03 Nov, 2017

13 commits

  • 646710419   crypto: tcrypt - move to generic async completion ... Browse Code »

    tcrypt starts several async crypto ops and waits for their completions.
    Move it over to generic code doing the same.

    Signed-off-by: Gilad Ben-Yossef
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     
  • 7f3971368   crypto: testmgr - move to generic async completion ... Browse Code »

    testmgr is starting async. crypto ops and waiting for them to complete.
    Move it over to generic code doing the same.

    This also provides a test of the generic crypto async. wait code.

    Signed-off-by: Gilad Ben-Yossef
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     
  • 76c673947   crypto: gcm - move to generic async completion ... Browse Code »

    gcm is starting an async. crypto op and waiting for it complete.
    Move it over to generic code doing the same.

    Signed-off-by: Gilad Ben-Yossef
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     
  • 85a2dea4b   crypto: drbg - move to generic async completion ... Browse Code »

    DRBG is starting an async. crypto op and waiting for it complete.
    Move it over to generic code doing the same.

    The code now also passes CRYPTO_TFM_REQ_MAY_SLEEP flag indicating
    crypto request memory allocation may use GFP_KERNEL which should
    be perfectly fine as the code is obviously sleeping for the
    completion of the request any way.

    Signed-off-by: Gilad Ben-Yossef
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     
  • 0ca2a04ac   crypto: move pub key to generic async completion ... Browse Code »

    public_key_verify_signature() is starting an async crypto op and
    waiting for it to complete. Move it over to generic code doing
    the same.

    Signed-off-by: Gilad Ben-Yossef
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     
  • 2c3f8b162   crypto: algif - move to generic async completion ... Browse Code »

    algif starts several async crypto ops and waits for their completion.
    Move it over to generic code doing the same.

    Signed-off-by: Gilad Ben-Yossef
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     
  • ada69a163   crypto: introduce crypto wait for async op ... Browse Code »

    Invoking a possibly async. crypto op and waiting for completion
    while correctly handling backlog processing is a common task
    in the crypto API implementation and outside users of it.

    This patch adds a generic implementation for doing so in
    preparation for using it across the board instead of hand
    rolled versions.

    Signed-off-by: Gilad Ben-Yossef
    CC: Eric Biggers
    CC: Jonathan Cameron
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     
  • 4e5b0ad58   crypto: remove redundant backlog checks on EBUSY ... Browse Code »

    Now that -EBUSY return code only indicates backlog queueing
    we can safely remove the now redundant check for the
    CRYPTO_TFM_REQ_MAY_BACKLOG flag when -EBUSY is returned.

    Signed-off-by: Gilad Ben-Yossef
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     
  • 6b80ea389   crypto: change transient busy return code to -ENOSPC ... Browse Code »

    The crypto API was using the -EBUSY return value to indicate
    both a hard failure to submit a crypto operation into a
    transformation provider when the latter was busy and the backlog
    mechanism was not enabled as well as a notification that the
    operation was queued into the backlog when the backlog mechanism
    was enabled.

    Having the same return code indicate two very different conditions
    depending on a flag is both error prone and requires extra runtime
    check like the following to discern between the cases:

    if (err == -EINPROGRESS ||
    (err == -EBUSY && (ahash_request_flags(req) &
    CRYPTO_TFM_REQ_MAY_BACKLOG)))

    This patch changes the return code used to indicate a crypto op
    failed due to the transformation provider being transiently busy
    to -ENOSPC.

    Signed-off-by: Gilad Ben-Yossef
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     
  • 7aacbfcb3   crypto: tcrypt - fix buffer lengths in test_aead_speed() ... Browse Code »

    Fix the way the length of the buffers used for
    encryption / decryption are computed.
    For e.g. in case of encryption, input buffer does not contain
    an authentication tag.

    Signed-off-by: Robert Baronescu
    Signed-off-by: Herbert Xu

    Robert Baronescu
     
  • 59517226a   crypto: tcrypt - mark expected switch fall-throughs in do_test() ... Browse Code »

    In preparation to enabling -Wimplicit-fallthrough, mark switch cases
    where we are expecting to fall through.

    Cc: Herbert Xu
    Cc: "David S. Miller"
    Cc: linux-crypto@vger.kernel.org
    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: Herbert Xu

    Gustavo A. R. Silva
     
  • acfc58781   crypto: gf128mul - The x8_ble multiplication functions ... Browse Code »

    It multiply GF(2^128) elements in the ble format.
    It will be used by chelsio driver to speed up gf multiplication.

    Signed-off-by: Harsh Jain
    Signed-off-by: Herbert Xu

    Harsh Jain
     
  • 441f99c90   crypto: ccm - preserve the IV buffer ... Browse Code »

    The IV buffer used during CCM operations is used twice, during both the
    hashing step and the ciphering step.

    When using a hardware accelerator that updates the contents of the IV
    buffer at the end of ciphering operations, the value will be modified.
    In the decryption case, the subsequent setup of the hashing algorithm
    will interpret the updated IV instead of the original value, which can
    lead to out-of-bounds writes.

    Reuse the idata buffer, only used in the hashing step, to preserve the
    IV's value during the ciphering step in the decryption case.

    Signed-off-by: Romain Izard
    Reviewed-by: Tudor Ambarus
    Cc:
    Signed-off-by: Herbert Xu

    Romain Izard
     

02 Nov, 2017

1 commit

  • b24413180   License cleanup: add SPDX GPL-2.0 license identifier to files with no license ... Browse Code »

    Many source files in the tree are missing licensing information, which
    makes it harder for compliance tools to determine the correct license.

    By default all files without license information are under the default
    license of the kernel, which is GPL version 2.

    Update the files which contain no license information with the 'GPL-2.0'
    SPDX license identifier. The SPDX identifier is a legally binding
    shorthand, which can be used instead of the full boiler plate text.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne.

    How this work was done:

    Patches were generated and checked against linux-4.14-rc6 for a subset of
    the use cases:
    - file had no licensing information it it.
    - file was a */uapi/* one with no licensing information in it,
    - file was a */uapi/* one with existing licensing information,

    Further patches will be generated in subsequent months to fix up cases
    where non-standard license headers were used, and references to license
    had to be inferred by heuristics based on keywords.

    The analysis to determine which SPDX License Identifier to be applied to
    a file was done in a spreadsheet of side by side results from of the
    output of two independent scanners (ScanCode & Windriver) producing SPDX
    tag:value files created by Philippe Ombredanne. Philippe prepared the
    base worksheet, and did an initial spot review of a few 1000 files.

    The 4.13 kernel was the starting point of the analysis with 60,537 files
    assessed. Kate Stewart did a file by file comparison of the scanner
    results in the spreadsheet to determine which SPDX license identifier(s)
    to be applied to the file. She confirmed any determination that was not
    immediately clear with lawyers working with the Linux Foundation.

    Criteria used to select files for SPDX license identifier tagging was:
    - Files considered eligible had to be source code files.
    - Make and config files were included as candidates if they contained >5
    lines of source
    - File already had some variant of a license header in it (even if
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

19 Oct, 2017

1 commit

18 Oct, 2017

3 commits

12 Oct, 2017

6 commits

11 Oct, 2017

1 commit

  • b61907bb4   crypto: shash - Fix zero-length shash ahash digest crash ... Browse Code »

    The shash ahash digest adaptor function may crash if given a
    zero-length input together with a null SG list. This is because
    it tries to read the SG list before looking at the length.

    This patch fixes it by checking the length first.

    Cc:
    Reported-by: Stephan Müller
    Signed-off-by: Herbert Xu
    Tested-by: Stephan Müller

    Herbert Xu
     

07 Oct, 2017

1 commit