Eric Lee / smarc-fsl-linux-kernel

03 Aug, 2018

1 commit

  • a07fc8dd2   crypto: authencesn - don't leak pointers to authenc keys ... Browse Code »

    [ Upstream commit 31545df391d58a3bb60e29b1192644a6f2b5a8dd ]

    In crypto_authenc_esn_setkey we save pointers to the authenc keys
    in a local variable of type struct crypto_authenc_keys and we don't
    zeroize it after use. Fix this and don't leak pointers to the
    authenc keys.

    Signed-off-by: Tudor Ambarus
    Signed-off-by: Herbert Xu
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Tudor-Dan Ambarus
     

18 Jul, 2017

1 commit

  • 41cdf7a45   crypto: authencesn - Fix digest_null crash ... Browse Code »

    When authencesn is used together with digest_null a crash will
    occur on the decrypt path. This is because normally we perform
    a special setup to preserve the ESN, but this is skipped if there
    is no authentication. However, on the post-authentication path
    it always expects the preservation to be in place, thus causing
    a crash when digest_null is used.

    This patch fixes this by also skipping the post-processing when
    there is no authentication.

    Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD...")
    Cc:
    Reported-by: Jan Tluka
    Signed-off-by: Herbert Xu

    Herbert Xu
     

01 Nov, 2016

2 commits

18 Jul, 2016

1 commit

  • e75445a84   crypto: authencesn - Use skcipher ... Browse Code »

    This patch converts authencesn to use the new skcipher interface as
    opposed to ablkcipher.

    It also fixes a little bug where if a sync version of authencesn
    is requested we may still end up using an async ahash. This should
    have no effect as none of the authencesn users can request for a
    sync authencesn.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

01 Jul, 2016

1 commit

  • 927ef32dc   crypto: authenc - Consider ahash ASYNC bit ... Browse Code »

    As it is, if you get an async ahash with a sync skcipher you'll
    end up with a sync authenc, which is wrong.

    This patch fixes it by considering the ASYNC bit from ahash as
    well.

    It also fixes a little bug where if a sync version of authenc
    is requested we may still end up using an async ahash.

    Neither of them should have any effect as none of the authenc
    users can request for a sync authenc.

    Signed-off-by: Herbert Xu

    Herbert Xu
     

17 Aug, 2015

1 commit

10 Aug, 2015

2 commits

13 May, 2015

2 commits

26 Nov, 2014

1 commit

  • 4943ba16b   crypto: include crypto- module prefix in template ... Browse Code »

    This adds the module loading prefix "crypto-" to the template lookup
    as well.

    For example, attempting to load 'vfat(blowfish)' via AF_ALG now correctly
    includes the "crypto-" prefix at every level, correctly rejecting "vfat":

    net-pf-38
    algif-hash
    crypto-vfat(blowfish)
    crypto-vfat(blowfish)-all
    crypto-vfat

    Reported-by: Mathias Krause
    Signed-off-by: Kees Cook
    Acked-by: Mathias Krause
    Signed-off-by: Herbert Xu

    Kees Cook
     

16 Oct, 2013

1 commit

07 Oct, 2013

1 commit

  • 6bf37e5aa   crypto: crypto_memneq - add equality testing of memory regions w/o timing leaks ... Browse Code »

    When comparing MAC hashes, AEAD authentication tags, or other hash
    values in the context of authentication or integrity checking, it
    is important not to leak timing information to a potential attacker,
    i.e. when communication happens over a network.

    Bytewise memory comparisons (such as memcmp) are usually optimized so
    that they return a nonzero value as soon as a mismatch is found. E.g,
    on x86_64/i5 for 512 bytes this can be ~50 cyc for a full mismatch
    and up to ~850 cyc for a full match (cold). This early-return behavior
    can leak timing information as a side channel, allowing an attacker to
    iteratively guess the correct result.

    This patch adds a new method crypto_memneq ("memory not equal to each
    other") to the crypto API that compares memory areas of the same length
    in roughly "constant time" (cache misses could change the timing, but
    since they don't reveal information about the content of the strings
    being compared, they are effectively benign). Iow, best and worst case
    behaviour take the same amount of time to complete (in contrast to
    memcmp).

    Note that crypto_memneq (unlike memcmp) can only be used to test for
    equality or inequality, NOT for lexicographical order. This, however,
    is not an issue for its use-cases within the crypto API.

    We tried to locate all of the places in the crypto API where memcmp was
    being used for authentication or integrity checking, and convert them
    over to crypto_memneq.

    crypto_memneq is declared noinline, placed in its own source file,
    and compiled with optimizations that might increase code size disabled
    ("Os") because a smart compiler (or LTO) might notice that the return
    value is always compared against zero/nonzero, and might then
    reintroduce the same early-return optimization that we are trying to
    avoid.

    Using #pragma or __attribute__ optimization annotations of the code
    for disabling optimization was avoided as it seems to be considered
    broken or unmaintained for long time in GCC [1]. Therefore, we work
    around that by specifying the compile flag for memneq.o directly in
    the Makefile. We found that this seems to be most appropriate.

    As we use ("Os"), this patch also provides a loop-free "fast-path" for
    frequently used 16 byte digests. Similarly to kernel library string
    functions, leave an option for future even further optimized architecture
    specific assembler implementations.

    This was a joint work of James Yonan and Daniel Borkmann. Also thanks
    for feedback from Florian Weimer on this and earlier proposals [2].

    [1] http://gcc.gnu.org/ml/gcc/2012-07/msg00211.html
    [2] https://lkml.org/lkml/2013/2/10/131

    Signed-off-by: James Yonan
    Signed-off-by: Daniel Borkmann
    Cc: Florian Weimer
    Signed-off-by: Herbert Xu

    James Yonan
     

04 Feb, 2013

1 commit

  • 3e8afe35c   crypto: use ERR_CAST ... Browse Code »

    Replace PTR_ERR followed by ERR_PTR by ERR_CAST, to be more concise.

    The semantic patch that makes this change is as follows:
    (http://coccinelle.lip6.fr/)

    //
    @@
    expression err,x;
    @@
    - err = PTR_ERR(x);
    if (IS_ERR(x))
    - return ERR_PTR(err);
    + return ERR_CAST(x);
    //

    Signed-off-by: Julia Lawall
    Signed-off-by: Herbert Xu

    Julia Lawall
     

14 Mar, 2011

1 commit