Eric Lee / smarc-fsl-linux-kernel

03 Aug, 2018

1 commit

  • 09740f513   crypto: authenc - don't leak pointers to authenc keys ... Browse Code »

    [ Upstream commit ad2fdcdf75d169e7a5aec6c7cb421c0bec8ec711 ]

    In crypto_authenc_setkey we save pointers to the authenc keys in
    a local variable of type struct crypto_authenc_keys and we don't
    zeroize it after use. Fix this and don't leak pointers to the
    authenc keys.

    Signed-off-by: Tudor Ambarus
    Signed-off-by: Herbert Xu
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Tudor-Dan Ambarus
     

01 Nov, 2016

2 commits

18 Jul, 2016

1 commit

  • 7217d49f1   crypto: authenc - Use skcipher ... Browse Code »

    This patch converts authenc to use the new skcipher interface as
    opposed to ablkcipher.

    It also fixes a little bug where if a sync version of authenc
    is requested we may still end up using an async ahash. This should
    have no effect as none of the authenc users can request for a
    sync authenc.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

01 Jul, 2016

1 commit

  • 927ef32dc   crypto: authenc - Consider ahash ASYNC bit ... Browse Code »

    As it is, if you get an async ahash with a sync skcipher you'll
    end up with a sync authenc, which is wrong.

    This patch fixes it by considering the ASYNC bit from ahash as
    well.

    It also fixes a little bug where if a sync version of authenc
    is requested we may still end up using an async ahash.

    Neither of them should have any effect as none of the authenc
    users can request for a sync authenc.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

29 Jun, 2016

1 commit

17 Aug, 2015

1 commit

04 Aug, 2015

1 commit

13 May, 2015

2 commits

26 Nov, 2014

1 commit

  • 4943ba16b   crypto: include crypto- module prefix in template ... Browse Code »

    This adds the module loading prefix "crypto-" to the template lookup
    as well.

    For example, attempting to load 'vfat(blowfish)' via AF_ALG now correctly
    includes the "crypto-" prefix at every level, correctly rejecting "vfat":

    net-pf-38
    algif-hash
    crypto-vfat(blowfish)
    crypto-vfat(blowfish)-all
    crypto-vfat

    Reported-by: Mathias Krause
    Signed-off-by: Kees Cook
    Acked-by: Mathias Krause
    Signed-off-by: Herbert Xu

    Kees Cook
     

28 Nov, 2013

1 commit

  • fc019c712   crypto: authenc - Find proper IV address in ablkcipher callback ... Browse Code »

    When performing an asynchronous ablkcipher operation the authenc
    completion callback routine is invoked, but it does not locate and use
    the proper IV.

    The callback routine, crypto_authenc_encrypt_done, is updated to use
    the same method of calculating the address of the IV as is done in
    crypto_authenc_encrypt function which sets up the callback.

    Cc: stable@vger.kernel.org
    Signed-off-by: Tom Lendacky
    Signed-off-by: Herbert Xu

    Tom Lendacky
     

16 Oct, 2013

1 commit

07 Oct, 2013

1 commit

  • 6bf37e5aa   crypto: crypto_memneq - add equality testing of memory regions w/o timing leaks ... Browse Code »

    When comparing MAC hashes, AEAD authentication tags, or other hash
    values in the context of authentication or integrity checking, it
    is important not to leak timing information to a potential attacker,
    i.e. when communication happens over a network.

    Bytewise memory comparisons (such as memcmp) are usually optimized so
    that they return a nonzero value as soon as a mismatch is found. E.g,
    on x86_64/i5 for 512 bytes this can be ~50 cyc for a full mismatch
    and up to ~850 cyc for a full match (cold). This early-return behavior
    can leak timing information as a side channel, allowing an attacker to
    iteratively guess the correct result.

    This patch adds a new method crypto_memneq ("memory not equal to each
    other") to the crypto API that compares memory areas of the same length
    in roughly "constant time" (cache misses could change the timing, but
    since they don't reveal information about the content of the strings
    being compared, they are effectively benign). Iow, best and worst case
    behaviour take the same amount of time to complete (in contrast to
    memcmp).

    Note that crypto_memneq (unlike memcmp) can only be used to test for
    equality or inequality, NOT for lexicographical order. This, however,
    is not an issue for its use-cases within the crypto API.

    We tried to locate all of the places in the crypto API where memcmp was
    being used for authentication or integrity checking, and convert them
    over to crypto_memneq.

    crypto_memneq is declared noinline, placed in its own source file,
    and compiled with optimizations that might increase code size disabled
    ("Os") because a smart compiler (or LTO) might notice that the return
    value is always compared against zero/nonzero, and might then
    reintroduce the same early-return optimization that we are trying to
    avoid.

    Using #pragma or __attribute__ optimization annotations of the code
    for disabling optimization was avoided as it seems to be considered
    broken or unmaintained for long time in GCC [1]. Therefore, we work
    around that by specifying the compile flag for memneq.o directly in
    the Makefile. We found that this seems to be most appropriate.

    As we use ("Os"), this patch also provides a loop-free "fast-path" for
    frequently used 16 byte digests. Similarly to kernel library string
    functions, leave an option for future even further optimized architecture
    specific assembler implementations.

    This was a joint work of James Yonan and Daniel Borkmann. Also thanks
    for feedback from Florian Weimer on this and earlier proposals [2].

    [1] http://gcc.gnu.org/ml/gcc/2012-07/msg00211.html
    [2] https://lkml.org/lkml/2013/2/10/131

    Signed-off-by: James Yonan
    Signed-off-by: Daniel Borkmann
    Cc: Florian Weimer
    Signed-off-by: Herbert Xu

    James Yonan
     

04 Feb, 2013

1 commit

  • 3e8afe35c   crypto: use ERR_CAST ... Browse Code »

    Replace PTR_ERR followed by ERR_PTR by ERR_CAST, to be more concise.

    The semantic patch that makes this change is as follows:
    (http://coccinelle.lip6.fr/)

    //
    @@
    expression err,x;
    @@
    - err = PTR_ERR(x);
    if (IS_ERR(x))
    - return ERR_PTR(err);
    + return ERR_CAST(x);
    //

    Signed-off-by: Julia Lawall
    Signed-off-by: Herbert Xu

    Julia Lawall
     

11 Sep, 2012

1 commit

  • 9b2f4cb65   crypto: authenc - Fix crash with zero-length assoc data ... Browse Code »

    The authenc code doesn't deal with zero-length associated data
    correctly and ends up constructing a zero-length sg entry which
    causes a crash when it's fed into the crypto system.

    This patch fixes this by avoiding the code-path that triggers
    the SG construction if we have no associated data.

    This isn't the most optimal fix as it means that we'll end up
    using the fallback code-path even when we could still execute
    the digest function. However, this isn't a big deal as nobody
    but the test path would supply zero-length associated data.

    Reported-by: Romain Francoise
    Signed-off-by: Herbert Xu
    Tested-by: Romain Francoise

    Herbert Xu
     

02 Dec, 2010

1 commit

26 May, 2010

1 commit

  • 8db050786   crypto: Use ERR_CAST ... Browse Code »

    Use ERR_CAST(x) rather than ERR_PTR(PTR_ERR(x)). The former makes more
    clear what is the purpose of the operation, which otherwise looks like a
    no-op.

    The semantic patch that makes this change is as follows:
    (http://coccinelle.lip6.fr/)

    //
    @@
    type T;
    T x;
    identifier f;
    @@

    T f (...) { }

    @@
    expression x;
    @@

    - ERR_PTR(PTR_ERR(x))
    + ERR_CAST(x)
    //

    Signed-off-by: Julia Lawall
    Signed-off-by: Herbert Xu

    Julia Lawall
     

20 May, 2010

1 commit

26 Apr, 2010

1 commit

  • 180ce7e81   crypto: authenc - Add EINPROGRESS check ... Browse Code »

    When Steffen originally wrote the authenc async hash patch, he
    correctly had EINPROGRESS checks in place so that we did not invoke
    the original completion handler with it.

    Unfortuantely I told him to remove it before the patch was applied.

    As only MAY_BACKLOG request completion handlers are required to
    handle EINPROGRESS completions, those checks are really needed.

    This patch restores them.

    Reported-by: Sebastian Andrzej Siewior
    Signed-off-by: Herbert Xu

    Herbert Xu
     

03 Mar, 2010

1 commit

  • 50beceba7   crypto: authenc - Move saved IV in front of the ablkcipher request ... Browse Code »

    In crypto_authenc_encrypt() we save the IV behind the ablkcipher
    request. To save space on the request, we overwrite the ablkcipher
    request with a ahash request after encryption. So the IV may be
    overwritten by the ahash request. This patch fixes this by placing
    the IV in front of the ablkcipher/ahash request.

    Signed-off-by: Steffen Klassert
    Signed-off-by: Herbert Xu

    Steffen Klassert
     

02 Mar, 2010

1 commit

16 Feb, 2010

1 commit

05 Aug, 2009

1 commit

14 Jul, 2009

1 commit

15 Jan, 2009

1 commit

  • 29b37f421   crypto: authenc - Fix zero-length IV crash ... Browse Code »

    As it is if an algorithm with a zero-length IV is used (e.g.,
    NULL encryption) with authenc, authenc may generate an SG entry
    of length zero, which will trigger a BUG check in the hash layer.

    This patch fixes it by skipping the IV SG generation if the IV
    size is zero.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

25 Dec, 2008

1 commit

22 Aug, 2008

1 commit

  • a697690be   crypto: authenc - Avoid using clobbered request pointer ... Browse Code »

    Authenc works in two stages for encryption, it first encrypts and
    then computes an ICV. The context memory of the request is used
    by both operations. The problem is that when an asynchronous
    encryption completes, we will compute the ICV and then reread the
    context memory of the encryption to get the original request.

    It just happens that we have a buffer of 16 bytes in front of the
    request pointer, so ICVs of 16 bytes (such as SHA1) do not trigger
    the bug. However, any attempt to uses a larger ICV instantly kills
    the machine when the first asynchronous encryption is completed.

    This patch fixes this by saving the request pointer before we start
    the ICV computation.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

01 May, 2008

1 commit

  • 161613293   [CRYPTO] authenc: Fix async crypto crash in crypto_authenc_genicv() ... Browse Code »

    crypto_authenc_givencrypt_done uses req->data as struct aead_givcrypt_request,
    while it really points to a struct aead_request, causing this crash:

    BUG: unable to handle kernel paging request at 6b6b6b6b
    IP: [] :authenc:crypto_authenc_genicv+0x23/0x109
    *pde = 00000000
    Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC
    Modules linked in: hifn_795x authenc esp4 aead xfrm4_mode_tunnel sha1_generic hmac crypto_hash]

    Pid: 3074, comm: ping Not tainted (2.6.25 #4)
    EIP: 0060:[] EFLAGS: 00010296 CPU: 0
    EIP is at crypto_authenc_genicv+0x23/0x109 [authenc]
    EAX: daa04690 EBX: daa046e0 ECX: dab0a100 EDX: daa046b0
    ESI: 6b6b6b6b EDI: dc872054 EBP: c033ff60 ESP: c033ff0c
    DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
    Process ping (pid: 3074, ti=c033f000 task=db883a80 task.ti=dab6c000)
    Stack: 00000000 daa046b0 c0215a3e daa04690 dab0a100 00000000 ffffffff db9fd7f0
    dba208c0 dbbb1720 00000001 daa04720 00000001 c033ff54 c0119ca9 dc852a75
    c033ff60 c033ff60 daa046e0 00000000 00000001 c033ff6c dc87527b 00000001
    Call Trace:
    [] ? dev_alloc_skb+0x14/0x29
    [] ? printk+0x15/0x17
    [] ? crypto_authenc_givencrypt_done+0x1a/0x27 [authenc]
    [] ? hifn_process_ready+0x34a/0x352 [hifn_795x]
    [] ? rhine_napipoll+0x3f2/0x3fd [via_rhine]
    [] ? hifn_check_for_completion+0x4d/0xa6 [hifn_795x]
    [] ? hifn_tasklet_callback+0xa/0xc [hifn_795x]
    [] ? tasklet_action+0x3f/0x66
    [] ? __do_softirq+0x38/0x7a
    [] ? do_softirq+0x3e/0x71
    [] ? irq_exit+0x2c/0x65
    [] ? smp_apic_timer_interrupt+0x5f/0x6a
    [] ? apic_timer_interrupt+0x28/0x30
    [] ? hifn_handle_req+0x44a/0x50d [hifn_795x]
    ...

    Signed-off-by: Patrick McHardy
    Signed-off-by: Herbert Xu

    Patrick McHardy
     

11 Jan, 2008

11 commits