29 Dec, 2014
1 commit
-
This patch adds the random number generator support for AF_ALG.
A random number generator's purpose is to generate data without
requiring the caller to provide any data. Therefore, the AF_ALG
interface handler for RNGs only implements a callback handler for
recvmsg.The following parameters provided with a recvmsg are processed by the
RNG callback handler:* sock - to resolve the RNG context data structure accessing the
RNG instance private to the socket* len - this parameter allows userspace callers to specify how
many random bytes the RNG shall produce and return. As the
kernel context for the RNG allocates a buffer of 128 bytes to
store random numbers before copying them to userspace, the len
parameter is checked that it is not larger than 128. If a
caller wants more random numbers, a new request for recvmsg
shall be made.The size of 128 bytes is chose because of the following considerations:
* to increase the memory footprint of the kernel too much (note,
that would be 128 bytes per open socket)* 128 is divisible by any typical cryptographic block size an
RNG may have* A request for random numbers typically only shall supply small
amount of data like for keys or IVs that should only require
one invocation of the recvmsg function.Note, during instantiation of the RNG, the code checks whether the RNG
implementation requires seeding. If so, the RNG is seeded with output
from get_random_bytes.A fully working example using all aspects of the RNG interface is
provided at http://www.chronox.de/libkcapi.htmlSigned-off-by: Stephan Mueller
Signed-off-by: Herbert Xu
26 Dec, 2014
6 commits
-
alg_setkey should zeroize the sensitive data after use.
Signed-off-by: Stephan Mueller
Signed-off-by: Herbert Xu -
We always do hwrng_init in set_current_rng. In fact, our current
reference count system relies on this. So make this explicit by
moving hwrng_init into set_current_rng.Signed-off-by: Herbert Xu
-
Rather than having callers of set_current_rng call drop_current_rng,
we can do it directly in set_current_rng.Signed-off-by: Herbert Xu
-
Currently we only register the device when a valid RNG is added.
However the way it's done is buggy because we test whether there
is a current RNG to determine whether we need to register. As
the current RNG may be missing due to a reinitialisation error
this can lead to a reregistration of the device.As the device already has to handle a NULL current RNG anyway,
let's just register the device always and remove the complexity.Signed-off-by: Herbert Xu
-
The kref solution is still buggy because we were only focusing
on the register/unregister race. The same race affects the
setting of current_rng through sysfs.This patch fixes it by using kref_get_unless_zero.
Signed-off-by: Herbert Xu
-
There is no point in doing a manual completion for cleanup_done
when struct completion fits in perfectly.Signed-off-by: Herbert Xu
24 Dec, 2014
5 commits
-
Enable user to select OCTEON MD5 module.
Signed-off-by: Aaro Koskinen
Signed-off-by: Herbert Xu -
Add OCTEON MD5 module.
Signed-off-by: Aaro Koskinen
Signed-off-by: Herbert Xu -
Reintroduce run-time check for crypto features. The old one was deleted
because it was unreliable, now decide the crypto availability on early
boot when the model string is constructed.Signed-off-by: Aaro Koskinen
Signed-off-by: Herbert Xu -
Add instruction definitions for MD5. Based on information extracted
from EdgeRouter Pro GPL source tarball.Signed-off-by: Aaro Koskinen
Signed-off-by: Herbert Xu -
Add crypto helper functions which are needed for kernel level usage.
The code for these has been extracted from the EdgeRouter Pro GPL tarball.While at it, also delete duplicate definitions of the functions.
Signed-off-by: Aaro Koskinen
Signed-off-by: Herbert Xu
22 Dec, 2014
19 commits
-
Fixed a coding style error, code indent should use tabs where possible
Signed-off-by: Asaf Vertz
Signed-off-by: Herbert Xu -
Add support for cbc(aes) ablkcipher.
Signed-off-by: Tadeusz Struk
Acked-by: Bruce W. Allan
Signed-off-by: Herbert Xu -
Fixed invalid assumpion that the sgl in and sgl out will always have the same
number of entries.Signed-off-by: Tadeusz Struk
Signed-off-by: Herbert Xu -
algif_skcipher sends 127 sgl buffers for encryption regardless of how
many buffers acctually have data to process, where the few first with
valid len and the rest with zero len. This is not very eficient.
This patch marks the last one with data as the last one to process.Signed-off-by: Tadeusz Struk
Signed-off-by: Herbert Xu -
Another interesting anti-pattern.
Signed-off-by: Rusty Russell
Signed-off-by: Herbert Xu -
Interesting anti-pattern.
Signed-off-by: Rusty Russell
Signed-off-by: Herbert Xu -
The previous patch added one potential problem: we can still be
reading from a hwrng when it's unregistered. Add a wait for zero
in the hwrng_unregister path.Signed-off-by: Rusty Russell
Signed-off-by: Amos Kong
Signed-off-by: Herbert Xu -
current_rng holds one reference, and we bump it every time we want
to do a read from it.This means we only hold the rng_mutex to grab or drop a reference,
so accessing /sys/devices/virtual/misc/hw_random/rng_current doesn't
block on read of /dev/hwrng.Using a kref is overkill (we're always under the rng_mutex), but
a standard pattern.This also solves the problem that the hwrng_fillfn thread was
accessing current_rng without a lock, which could change (eg. to NULL)
underneath it.Signed-off-by: Rusty Russell
Signed-off-by: Amos Kong
Signed-off-by: Herbert Xu -
In next patch, we use reference counting for each struct hwrng,
changing reference count also needs to take mutex_lock. Before
releasing the lock, if we try to stop a kthread that waits to
take the lock to reduce the referencing count, deadlock will
occur.Signed-off-by: Amos Kong
Signed-off-by: Herbert Xu -
There's currently a big lock around everything, and it means that we
can't query sysfs (eg /sys/devices/virtual/misc/hw_random/rng_current)
while the rng is reading. This is a real problem when the rng is slow,
or blocked (eg. virtio_rng with qemu's default /dev/random backend)This doesn't help (it leaves the current lock untouched), just adds a
lock to protect the read function and the static buffers, in preparation
for transition.Signed-off-by: Rusty Russell
Signed-off-by: Herbert Xu -
Use setsockopt on the tfm FD to provide the authentication tag size for
an AEAD cipher. This is achieved by adding a callback function which is
intended to be used by the AEAD AF_ALG implementation.The optlen argument of the setsockopt specifies the authentication tag
size to be used with the AEAD tfm.Signed-off-by: Stephan Mueller
Signed-off-by: Herbert Xu -
This patch adds a panic if the FIPS 140-2 self test error failed.
Note, that entire code is only executed with fips_enabled (i.e. when the
kernel is booted with fips=1. It is therefore not executed for 99.9% of
all user base.As mathematically such failure cannot occur, this panic should never be
triggered. But to comply with NISTs current requirements, an endless
loop must be replaced with the panic.When the new version of FIPS 140 will be released, this entire
continuous self test function will be ripped out as it will not be
needed any more.This patch is functionally equivalent as implemented in ansi_cprng.c and drivers/char/random.c.
Signed-off-by: Stephan Mueller
Signed-off-by: Herbert Xu -
Fixed style error identified by checkpatch.
WARNING: Missing a blank line after declarations
+ int err = crypto_remove_alg(&inst->alg, &users);
+ BUG_ON(err);Signed-off-by: Joshua I. James
Signed-off-by: Herbert Xu -
Fixed style error identified by checkpatch.
WARNING: Missing a blank line after declarations
+ unsigned int unaligned = alignmask + 1 - (offset & alignmask);
+ if (nbytes > unaligned)Signed-off-by: Joshua I. James
Signed-off-by: Herbert Xu -
Fixed style error identified by checkpatch.
ERROR: space required before the open parenthesis '('
+ switch(cmsg->cmsg_type) {Signed-off-by: Joshua I. James
Signed-off-by: Herbert Xu -
Fixed style error identified by checkpatch.
ERROR: do not use assignment in if condition
+ if ((err = crypto_register_instance(tmpl, inst))) {Signed-off-by: Joshua I. James
Signed-off-by: Herbert Xu -
Fixed style errors reported by checkpatch.
WARNING: Missing a blank line after declarations
+ u8 *end_page = (u8 *)(((unsigned long)(start + len - 1)) & PAGE_MASK);
+ return max(start, end_page);WARNING: line over 80 characters
+ scatterwalk_start(&walk->out, scatterwalk_sg_next(walk->out.sg));WARNING: Missing a blank line after declarations
+ int err = ablkcipher_copy_iv(walk, tfm, alignmask);
+ if (err)ERROR: do not use assignment in if condition
+ if ((err = crypto_register_instance(tmpl, inst))) {Signed-off-by: Joshua I. James
Signed-off-by: Herbert Xu -
The fallback is never used, so there is no point in having it.
The cra_exit routine can also be removed, since all it did was releasing
the fallback, along with the stub around cra_init, which just added an
unused NULL argument.Signed-off-by: Svenning Soerensen
Signed-off-by: Herbert Xu -
If a request is backlogged, it's complete() handler will get called
twice: once with -EINPROGRESS, and once with the final error code.af_alg's complete handler, unlike other users, does not handle the
-EINPROGRESS but instead always completes the completion that recvmsg()
is waiting on. This can lead to a return to user space while the
request is still pending in the driver. If userspace closes the sockets
before the requests are handled by the driver, this will lead to
use-after-frees (and potential crashes) in the kernel due to the tfm
having been freed.The crashes can be easily reproduced (for example) by reducing the max
queue length in cryptod.c and running the following (from
http://www.chronox.de/libkcapi.html) on AES-NI capable hardware:$ while true; do kcapi -x 1 -e -c '__ecb-aes-aesni' \
-k 00000000000000000000000000000000 \
-p 00000000000000000000000000000000 >/dev/null & doneCc: stable@vger.kernel.org
Signed-off-by: Rabin Vincent
Signed-off-by: Herbert Xu
21 Dec, 2014
8 commits
-
Pull ACCESS_ONCE cleanup preparation from Christian Borntraeger:
"kernel: Provide READ_ONCE and ASSIGN_ONCEAs discussed on LKML http://marc.info/?i=54611D86.4040306%40de.ibm.com
ACCESS_ONCE might fail with specific compilers for non-scalar
accesses.Here is a set of patches to tackle that problem.
The first patch introduce READ_ONCE and ASSIGN_ONCE. If the data
structure is larger than the machine word size memcpy is used and a
warning is emitted. The next patches fix up several in-tree users of
ACCESS_ONCE on non-scalar types.This does not yet contain a patch that forces ACCESS_ONCE to work only
on scalar types. This is targetted for the next merge window as Linux
next already contains new offenders regarding ACCESS_ONCE vs.
non-scalar types"* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/borntraeger/linux:
s390/kvm: REPLACE barrier fixup with READ_ONCE
arm/spinlock: Replace ACCESS_ONCE with READ_ONCE
arm64/spinlock: Replace ACCESS_ONCE READ_ONCE
mips/gup: Replace ACCESS_ONCE with READ_ONCE
x86/gup: Replace ACCESS_ONCE with READ_ONCE
x86/spinlock: Replace ACCESS_ONCE with READ_ONCE
mm: replace ACCESS_ONCE with READ_ONCE or barriers
kernel: Provide READ_ONCE and ASSIGN_ONCE -
Pull clk framework updates from Mike Turquette:
"This is much later than usual due to several last minute bugs that had
to be addressed. As usual the majority of changes are new drivers and
modifications to existing drivers. The core recieved many fixes along
with the groundwork for several large changes coming in the future
which will better parition clock providers from clock consumers"* tag 'clk-for-linus-3.19' of git://git.linaro.org/people/mike.turquette/linux: (86 commits)
clk: samsung: Fix Exynos 5420 pinctrl setup and clock disable failure due to domain being gated
ARM: OMAP3: clock: fix boot breakage in legacy mode
ARM: OMAP2+: clock: fix DPLL code to use new determine rate APIs
clk: Really fix deadlock with mmap_sem
clk: mmp: fix sparse non static symbol warning
clk: Change clk_ops->determine_rate to return a clk_hw as the best parent
clk: change clk_debugfs_add_file to take a struct clk_hw
clk: Don't expose __clk_get_accuracy
clk: Don't try to use a struct clk* after it could have been freed
clk: Remove unused function __clk_get_prepare_count
clk: samsung: Fix double add of syscore ops after driver rebind
clk: samsung: exynos4: set parent of sclk_hdmiphy to hdmi
clk: samsung: exynos4415: Fix build with PM_SLEEP disabled
clk: samsung: remove unnecessary inclusion of header files from clk.h
clk: samsung: remove unnecessary CONFIG_OF from clk.c
clk: samsung: Spelling s/bwtween/between/
clk: rockchip: Add support for the mmc clock phases using the framework
clk: rockchip: add bindings for the mmc clocks
clk: rockchip: rk3288 export i2s0_clkout for use in DT
clk: rockchip: use clock ID for DMC (memory controller) on rk3288
... -
Pull more i2c updates from Wolfram Sang:
"Included are two bugfixes needing some bigger refactoring (sh_mobile:
deferred probe with DMA, mv64xxx: fix offload support) and one
deprecated driver removal I thought would go in via ppc but I
misunderstood. It has a proper ack from BenH"* 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
i2c: sh_mobile: fix uninitialized var when debug is enabled
macintosh: therm_pm72: delete deprecated driver
i2c: sh_mobile: I2C_SH_MOBILE should depend on HAS_DMA
i2c: sh_mobile: rework deferred probing
i2c: sh_mobile: refactor DMA setup
i2c: mv64xxx: rework offload support to fix several problems
i2c: mv64xxx: use BIT() macro for register value definitions -
Pull SCSI update from James Bottomley:
"This is a much shorter set of patches that were on the go but didn't
make it in to the early pull request for the merge window. It's
really a set of bug fixes plus some final cleanup work on the new tag
queue API"* tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
storvsc: ring buffer failures may result in I/O freeze
ipr: set scsi_level correctly for disk arrays
ipr: add support for async scanning to speed up boot
scsi_debug: fix missing "break;" in SDEBUG_UA_CAPACITY_CHANGED case
scsi_debug: take sdebug_host_list_lock when changing capacity
scsi_debug: improve driver description in Kconfig
scsi_debug: fix compare and write errors
qla2xxx: fix race in handling rport deletion during recovery causes panic
scsi: blacklist RSOC for Microsoft iSCSI target devices
scsi: fix random memory corruption with scsi-mq + T10 PI
Revert "[SCSI] mpt3sas: Remove phys on topology change"
Revert "[SCSI] mpt2sas: Remove phys on topology change."
esas2r: Correct typos of "validate" in a comment
fc: FCP_PTA_SIMPLE is 0
ibmvfc: remove unused tag variable
scsi: remove MSG_*_TAG defines
scsi: remove scsi_set_tag_type
scsi: remove scsi_get_tag_type
scsi: never drop to untagged mode during queue ramp down
scsi: remove ->change_queue_type method -
Pull CONFIG_PM_RUNTIME elimination from Rafael Wysocki:
"This removes the last few uses of CONFIG_PM_RUNTIME introduced
recently and makes that config option finally go away.CONFIG_PM will be available directly from the menu now and also it
will be selected automatically if CONFIG_SUSPEND or CONFIG_HIBERNATION
is set"* tag 'pm-config-3.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
PM: Eliminate CONFIG_PM_RUNTIME
tty: 8250_omap: Replace CONFIG_PM_RUNTIME with CONFIG_PM
sound: sst-haswell-pcm: Replace CONFIG_PM_RUNTIME with CONFIG_PM
spi: Replace CONFIG_PM_RUNTIME with CONFIG_PM -
Pull misc kbuild changes from Michal Marek:
"There are only a few things in the misc branch:- Fix for bugon.cocci semantic patch
- Kdevelop4 files are .gitignored
- Put make binrpm-pkg on diet"* 'misc' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
scripts/package: binrpm-pkg do not create source and devel package
.gitignore: Add Kdevelop4 project files
bugon.cocci: fix Options at the macro -
Pull kbuild updates from Michal Marek:
"Here are the kbuild changes for v3.19-rc1:- Cleanups and deduplication in the main Makefile and
scripts/Makefile.*
- Sort the output of *config targets in make help
- Old is always removed to avoid a surprise during
bisecting
- Warning fix in kconfig"* 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
kbuild: remove redundant -rR flag of hdr-inst
kbuild: Fix make help- on powerpc
kbuild: Automatically remove stale file
kconfig: Fix warning "‘jump’ may be used uninitialized"
Makefile: sort list of defconfig targets in make help output
kbuild: Remove duplicate $(cmd) definition in Makefile.clean
kbuild: collect shorthands into scripts/Kbuild.include
20 Dec, 2014
1 commit
-
Signed-off-by: Wolfram Sang
Signed-off-by: Wolfram Sang
