Eric Lee / smarc-fsl-linux-kernel

20 Dec, 2017

1 commit

  • 902ae89f8   crypto: hmac - require that the underlying hash algorithm is unkeyed ... Browse Code »

    commit af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 upstream.

    Because the HMAC template didn't check that its underlying hash
    algorithm is unkeyed, trying to use "hmac(hmac(sha3-512-generic))"
    through AF_ALG or through KEYCTL_DH_COMPUTE resulted in the inner HMAC
    being used without having been keyed, resulting in sha3_update() being
    called without sha3_init(), causing a stack buffer overflow.

    This is a very old bug, but it seems to have only started causing real
    problems when SHA-3 support was added (requires CONFIG_CRYPTO_SHA3)
    because the innermost hash's state is ->import()ed from a zeroed buffer,
    and it just so happens that other hash algorithms are fine with that,
    but SHA-3 is not. However, there could be arch or hardware-dependent
    hash algorithms also affected; I couldn't test everything.

    Fix the bug by introducing a function crypto_shash_alg_has_setkey()
    which tests whether a shash algorithm is keyed. Then update the HMAC
    template to require that its underlying hash algorithm is unkeyed.

    Here is a reproducer:

    #include
    #include

    int main()
    {
    int algfd;
    struct sockaddr_alg addr = {
    .salg_type = "hash",
    .salg_name = "hmac(hmac(sha3-512-generic))",
    };
    char key[4096] = { 0 };

    algfd = socket(AF_ALG, SOCK_SEQPACKET, 0);
    bind(algfd, (const struct sockaddr *)&addr, sizeof(addr));
    setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key));
    }

    Here was the KASAN report from syzbot:

    BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:341 [inline]
    BUG: KASAN: stack-out-of-bounds in sha3_update+0xdf/0x2e0 crypto/sha3_generic.c:161
    Write of size 4096 at addr ffff8801cca07c40 by task syzkaller076574/3044

    CPU: 1 PID: 3044 Comm: syzkaller076574 Not tainted 4.14.0-mm1+ #25
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
    __dump_stack lib/dump_stack.c:17 [inline]
    dump_stack+0x194/0x257 lib/dump_stack.c:53
    print_address_description+0x73/0x250 mm/kasan/report.c:252
    kasan_report_error mm/kasan/report.c:351 [inline]
    kasan_report+0x25b/0x340 mm/kasan/report.c:409
    check_memory_region_inline mm/kasan/kasan.c:260 [inline]
    check_memory_region+0x137/0x190 mm/kasan/kasan.c:267
    memcpy+0x37/0x50 mm/kasan/kasan.c:303
    memcpy include/linux/string.h:341 [inline]
    sha3_update+0xdf/0x2e0 crypto/sha3_generic.c:161
    crypto_shash_update+0xcb/0x220 crypto/shash.c:109
    shash_finup_unaligned+0x2a/0x60 crypto/shash.c:151
    crypto_shash_finup+0xc4/0x120 crypto/shash.c:165
    hmac_finup+0x182/0x330 crypto/hmac.c:152
    crypto_shash_finup+0xc4/0x120 crypto/shash.c:165
    shash_digest_unaligned+0x9e/0xd0 crypto/shash.c:172
    crypto_shash_digest+0xc4/0x120 crypto/shash.c:186
    hmac_setkey+0x36a/0x690 crypto/hmac.c:66
    crypto_shash_setkey+0xad/0x190 crypto/shash.c:64
    shash_async_setkey+0x47/0x60 crypto/shash.c:207
    crypto_ahash_setkey+0xaf/0x180 crypto/ahash.c:200
    hash_setkey+0x40/0x90 crypto/algif_hash.c:446
    alg_setkey crypto/af_alg.c:221 [inline]
    alg_setsockopt+0x2a1/0x350 crypto/af_alg.c:254
    SYSC_setsockopt net/socket.c:1851 [inline]
    SyS_setsockopt+0x189/0x360 net/socket.c:1830
    entry_SYSCALL_64_fastpath+0x1f/0x96

    Reported-by: syzbot
    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu
    Signed-off-by: Greg Kroah-Hartman

    Eric Biggers
     

23 May, 2017

1 commit

  • 03d7db565   crypto: hmac - add hmac IPAD/OPAD constant ... Browse Code »

    Many HMAC users directly use directly 0x36/0x5c values.
    It's better with crypto to use a name instead of directly some crypto
    constant.

    This patch simply add HMAC_IPAD_VALUE/HMAC_OPAD_VALUE defines in a new
    include file "crypto/hmac.h" and use them in crypto/hmac.c

    Signed-off-by: Corentin Labbe
    Signed-off-by: Herbert Xu

    Corentin LABBE
     

26 Nov, 2014

1 commit

  • 4943ba16b   crypto: include crypto- module prefix in template ... Browse Code »

    This adds the module loading prefix "crypto-" to the template lookup
    as well.

    For example, attempting to load 'vfat(blowfish)' via AF_ALG now correctly
    includes the "crypto-" prefix at every level, correctly rejecting "vfat":

    net-pf-38
    algif-hash
    crypto-vfat(blowfish)
    crypto-vfat(blowfish)-all
    crypto-vfat

    Reported-by: Mathias Krause
    Signed-off-by: Kees Cook
    Acked-by: Mathias Krause
    Signed-off-by: Herbert Xu

    Kees Cook
     

14 Oct, 2014

1 commit

  • ffb32e973   crypto: LLVMLinux: Remove VLAIS usage from crypto/hmac.c ... Browse Code »

    Replaced the use of a Variable Length Array In Struct (VLAIS) with a C99
    compliant equivalent. This patch allocates the appropriate amount of memory
    using a char array using the SHASH_DESC_ON_STACK macro.

    The new code can be compiled with both gcc and clang.

    Signed-off-by: Jan-Simon Möller
    Signed-off-by: Behan Webster
    Reviewed-by: Mark Charlebois
    Acked-by: Herbert Xu
    Cc: pageexec@freemail.hu

    Jan-Simon Möller
     

30 Mar, 2010

1 commit

  • 5a0e3ad6a   include cleanup: Update gfp.h and slab.h includes to prepare for breaking implic… ... Browse Code »

    …it slab.h inclusion from percpu.h

    percpu.h is included by sched.h and module.h and thus ends up being
    included when building most .c files. percpu.h includes slab.h which
    in turn includes gfp.h making everything defined by the two files
    universally available and complicating inclusion dependencies.

    percpu.h -> slab.h dependency is about to be removed. Prepare for
    this change by updating users of gfp and slab facilities include those
    headers directly instead of assuming availability. As this conversion
    needs to touch large number of source files, the following script is
    used as the basis of conversion.

    http://userweb.kernel.org/~tj/misc/slabh-sweep.py

    The script does the followings.

    * Scan files for gfp and slab usages and update includes such that
    only the necessary includes are there. ie. if only gfp is used,
    gfp.h, if slab is used, slab.h.

    * When the script inserts a new include, it looks at the include
    blocks and try to put the new include such that its order conforms
    to its surrounding. It's put in the include block which contains
    core kernel includes, in the same order that the rest are ordered -
    alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
    doesn't seem to be any matching order.

    * If the script can't find a place to put a new include (mostly
    because the file doesn't have fitting include block), it prints out
    an error message indicating which .h file needs to be added to the
    file.

    The conversion was done in the following steps.

    1. The initial automatic conversion of all .c files updated slightly
    over 4000 files, deleting around 700 includes and adding ~480 gfp.h
    and ~3000 slab.h inclusions. The script emitted errors for ~400
    files.

    2. Each error was manually checked. Some didn't need the inclusion,
    some needed manual addition while adding it to implementation .h or
    embedding .c file was more appropriate for others. This step added
    inclusions to around 150 files.

    3. The script was run again and the output was compared to the edits
    from #2 to make sure no file was left behind.

    4. Several build tests were done and a couple of problems were fixed.
    e.g. lib/decompress_*.c used malloc/free() wrappers around slab
    APIs requiring slab.h to be added manually.

    5. The script was run on all .h files but without automatically
    editing them as sprinkling gfp.h and slab.h inclusions around .h
    files could easily lead to inclusion dependency hell. Most gfp.h
    inclusion directives were ignored as stuff from gfp.h was usually
    wildly available and often used in preprocessor macros. Each
    slab.h inclusion directive was examined and added manually as
    necessary.

    6. percpu.h was updated not to include slab.h.

    7. Build test were done on the following configurations and failures
    were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
    distributed build env didn't work with gcov compiles) and a few
    more options had to be turned off depending on archs to make things
    build (like ipr on powerpc/64 which failed due to missing writeq).

    * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
    * powerpc and powerpc64 SMP allmodconfig
    * sparc and sparc64 SMP allmodconfig
    * ia64 SMP allmodconfig
    * s390 SMP allmodconfig
    * alpha SMP allmodconfig
    * um on x86_64 SMP allmodconfig

    8. percpu.h modifications were reverted so that it could be applied as
    a separate patch and serve as bisection point.

    Given the fact that I had only a couple of failures from tests on step
    6, I'm fairly confident about the coverage of this conversion patch.
    If there is a breakage, it's likely to be something in one of the arch
    headers which should be easily discoverable easily on most builds of
    the specific arch.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>

    Tejun Heo
     

24 Jul, 2009

1 commit

15 Jul, 2009

1 commit

14 Jul, 2009

1 commit

25 Dec, 2008

1 commit

10 Jul, 2008

1 commit

  • ca786dc73   crypto: hash - Fixed digest size check ... Browse Code »

    The digest size check on hash algorithms is incorrect. It's
    perfectly valid for hash algorithms to have a digest length
    longer than their block size. For example crc32c has a block
    size of 1 and a digest size of 4. Rather than having it lie
    about its block size, this patch fixes the checks to do what
    they really should which is to bound the digest size so that
    code placing the digest on the stack continue to work.

    HMAC however still needs to check this as it's only defined
    for such algorithms.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

07 May, 2008

1 commit

  • 67412f0e7   [CRYPTO] hmac: Avoid calling virt_to_page on key ... Browse Code »

    When HMAC gets a key longer than the block size of the hash, it needs
    to feed it as input to the hash to reduce it to a fixed length. As
    it is HMAC converts the key to a scatter and gather list. However,
    this doesn't work on certain platforms if the key is not allocated
    via kmalloc. For example, the keys from tcrypt are stored in the
    rodata section and this causes it to fail with HMAC on x86-64.

    This patch fixes this by copying the key to memory obtained via
    kmalloc before hashing it.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

08 Feb, 2008

1 commit

11 Jan, 2008

2 commits

26 Oct, 2007

2 commits

24 Oct, 2007

1 commit

23 Oct, 2007

1 commit

02 May, 2007

1 commit

  • ebc610e5b   [CRYPTO] templates: Pass type/mask when creating instances ... Browse Code »

    This patch passes the type/mask along when constructing instances of
    templates. This is in preparation for templates that may support
    multiple types of instances depending on what is requested. For example,
    the planned software async crypto driver will use this construct.

    For the moment this allows us to check whether the instance constructed
    is of the correct type and avoid returning success if the type does not
    match.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

07 Feb, 2007

1 commit

24 Sep, 2006

2 commits

21 Sep, 2006

3 commits

  • 8425165df   [CRYPTO] digest: Remove old HMAC implementation ... Browse Code »

    This patch removes the old HMAC implementation now that nobody uses it
    anymore.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 0796ae061   [CRYPTO] hmac: Add crypto template implementation ... Browse Code »

    This patch rewrites HMAC as a crypto template. This means that HMAC is no
    longer a hard-coded part of the API. It's now a template that generates
    standard digest algorithms like any other.

    The old HMAC is preserved until all current users are converted.

    The same structure can be used by other MACs such as AES-XCBC-MAC.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 055bcee31   [CRYPTO] digest: Added user API for new hash type ... Browse Code »

    The existing digest user interface is inadequate for support asynchronous
    operations. For one it doesn't return a value to indicate success or
    failure, nor does it take a per-operation descriptor which is essential
    for the issuing of requests while other requests are still outstanding.

    This patch is the first in a series of steps to remodel the interface
    for asynchronous operations.

    For the ease of transition the new interface will be known as "hash"
    while the old one will remain as "digest".

    This patch also changes sg_next to allow chaining.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

30 Oct, 2005

1 commit

07 Jul, 2005

1 commit

17 Apr, 2005

1 commit

  • 1da177e4c   Linux-2.6.12-rc2 ... Browse Code »

    Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds