Eric Lee / smarc-ti-linux-kernel

2
Download as
Browse Code ยป

Commit 5638cabf3e4883f38dfb246c30980cebf694fbda

Authored by Horia Geanta
Committed by Herbert Xu
1 parent 9dda2769af
Exists in master and in 16 other branches dlt-processor-sdk-linux-03.00.00.04, processor-sdk-linux-01.00.00, processor-sdk-linux-02.00.01, smarc-ti-linux-3.14.y, smarc-ti-linux-3.15.y, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04, ti-linux-3.14.y, ti-linux-3.15.y, ti-lsk-linux-4.1.y

crypto: ccm - Fix handling of zero plaintext when computing mac 

There are cases when cryptlen can be zero in crypto_ccm_auth():
-encryptiom: input scatterlist length is zero (no plaintext)
-decryption: input scatterlist contains only the mac
plus the condition of having different source and destination buffers
(or else scatterlist length = max(plaintext_len, ciphertext_len)).

These are not handled correctly, leading to crashes like:

root@p4080ds:~/crypto# insmod tcrypt.ko mode=45
------------[ cut here ]------------
kernel BUG at crypto/scatterwalk.c:37!
Oops: Exception in kernel mode, sig: 5 [#1]
SMP NR_CPUS=8 P4080 DS
Modules linked in: tcrypt(+) crc32c xts xcbc vmac pcbc ecb gcm ghash_generic gf128mul ccm ctr seqiv
CPU: 3 PID: 1082 Comm: cryptomgr_test Not tainted 3.11.0 #14
task: ee12c5b0 ti: eecd0000 task.ti: eecd0000
NIP: c0204d98 LR: f9225848 CTR: c0204d80
REGS: eecd1b70 TRAP: 0700   Not tainted  (3.11.0)
MSR: 00029002 <CE,EE,ME>  CR: 22044022  XER: 20000000

GPR00: f9225c94 eecd1c20 ee12c5b0 eecd1c28 ee879400 ee879400 00000000 ee607464
GPR08: 00000001 00000001 00000000 006b0000 c0204d80 00000000 00000002 c0698e20
GPR16: ee987000 ee895000 fffffff4 ee879500 00000100 eecd1d58 00000001 00000000
GPR24: ee879400 00000020 00000000 00000000 ee5b2800 ee607430 00000004 ee607460
NIP [c0204d98] scatterwalk_start+0x18/0x30
LR [f9225848] get_data_to_compute+0x28/0x2f0 [ccm]
Call Trace:
[eecd1c20] [f9225974] get_data_to_compute+0x154/0x2f0 [ccm] (unreliable)
[eecd1c70] [f9225c94] crypto_ccm_auth+0x184/0x1d0 [ccm]
[eecd1cb0] [f9225d40] crypto_ccm_encrypt+0x60/0x2d0 [ccm]
[eecd1cf0] [c020d77c] __test_aead+0x3ec/0xe20
[eecd1e20] [c020f35c] test_aead+0x6c/0xe0
[eecd1e40] [c020f420] alg_test_aead+0x50/0xd0
[eecd1e60] [c020e5e4] alg_test+0x114/0x2e0
[eecd1ee0] [c020bd1c] cryptomgr_test+0x4c/0x60
[eecd1ef0] [c0047058] kthread+0xa8/0xb0
[eecd1f40] [c000eb0c] ret_from_kernel_thread+0x5c/0x64
Instruction dump:
0f080000 81290024 552807fe 0f080000 5529003a 4bffffb4 90830000 39400000
39000001 8124000c 2f890000 7d28579e <0f090000> 81240008 91230004 4e800020
---[ end trace 6d652dfcd1be37bd ]---

Cc: <stable@vger.kernel.org>
Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Showing 1 changed file with 2 additions and 1 deletions Inline Diff

1 /* 1 /*
2 * CCM: Counter with CBC-MAC 2 * CCM: Counter with CBC-MAC
3 * 3 *
4 * (C) Copyright IBM Corp. 2007 - Joy Latten <latten@us.ibm.com> 4 * (C) Copyright IBM Corp. 2007 - Joy Latten <latten@us.ibm.com>
5 * 5 *
6 * This program is free software; you can redistribute it and/or modify it 6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the Free 7 * under the terms of the GNU General Public License as published by the Free
8 * Software Foundation; either version 2 of the License, or (at your option) 8 * Software Foundation; either version 2 of the License, or (at your option)
9 * any later version. 9 * any later version.
10 * 10 *
11 */ 11 */
12 12
13 #include <crypto/internal/aead.h> 13 #include <crypto/internal/aead.h>
14 #include <crypto/internal/skcipher.h> 14 #include <crypto/internal/skcipher.h>
15 #include <crypto/scatterwalk.h> 15 #include <crypto/scatterwalk.h>
16 #include <linux/err.h> 16 #include <linux/err.h>
17 #include <linux/init.h> 17 #include <linux/init.h>
18 #include <linux/kernel.h> 18 #include <linux/kernel.h>
19 #include <linux/module.h> 19 #include <linux/module.h>
20 #include <linux/slab.h> 20 #include <linux/slab.h>
21 21
22 #include "internal.h" 22 #include "internal.h"
23 23
24 struct ccm_instance_ctx { 24 struct ccm_instance_ctx {
25 struct crypto_skcipher_spawn ctr; 25 struct crypto_skcipher_spawn ctr;
26 struct crypto_spawn cipher; 26 struct crypto_spawn cipher;
27 }; 27 };
28 28
29 struct crypto_ccm_ctx { 29 struct crypto_ccm_ctx {
30 struct crypto_cipher *cipher; 30 struct crypto_cipher *cipher;
31 struct crypto_ablkcipher *ctr; 31 struct crypto_ablkcipher *ctr;
32 }; 32 };
33 33
34 struct crypto_rfc4309_ctx { 34 struct crypto_rfc4309_ctx {
35 struct crypto_aead *child; 35 struct crypto_aead *child;
36 u8 nonce[3]; 36 u8 nonce[3];
37 }; 37 };
38 38
39 struct crypto_ccm_req_priv_ctx { 39 struct crypto_ccm_req_priv_ctx {
40 u8 odata[16]; 40 u8 odata[16];
41 u8 idata[16]; 41 u8 idata[16];
42 u8 auth_tag[16]; 42 u8 auth_tag[16];
43 u32 ilen; 43 u32 ilen;
44 u32 flags; 44 u32 flags;
45 struct scatterlist src[2]; 45 struct scatterlist src[2];
46 struct scatterlist dst[2]; 46 struct scatterlist dst[2];
47 struct ablkcipher_request abreq; 47 struct ablkcipher_request abreq;
48 }; 48 };
49 49
50 static inline struct crypto_ccm_req_priv_ctx *crypto_ccm_reqctx( 50 static inline struct crypto_ccm_req_priv_ctx *crypto_ccm_reqctx(
51 struct aead_request *req) 51 struct aead_request *req)
52 { 52 {
53 unsigned long align = crypto_aead_alignmask(crypto_aead_reqtfm(req)); 53 unsigned long align = crypto_aead_alignmask(crypto_aead_reqtfm(req));
54 54
55 return (void *)PTR_ALIGN((u8 *)aead_request_ctx(req), align + 1); 55 return (void *)PTR_ALIGN((u8 *)aead_request_ctx(req), align + 1);
56 } 56 }
57 57
58 static int set_msg_len(u8 *block, unsigned int msglen, int csize) 58 static int set_msg_len(u8 *block, unsigned int msglen, int csize)
59 { 59 {
60 __be32 data; 60 __be32 data;
61 61
62 memset(block, 0, csize); 62 memset(block, 0, csize);
63 block += csize; 63 block += csize;
64 64
65 if (csize >= 4) 65 if (csize >= 4)
66 csize = 4; 66 csize = 4;
67 else if (msglen > (1 << (8 * csize))) 67 else if (msglen > (1 << (8 * csize)))
68 return -EOVERFLOW; 68 return -EOVERFLOW;
69 69
70 data = cpu_to_be32(msglen); 70 data = cpu_to_be32(msglen);
71 memcpy(block - csize, (u8 *)&data + 4 - csize, csize); 71 memcpy(block - csize, (u8 *)&data + 4 - csize, csize);
72 72
73 return 0; 73 return 0;
74 } 74 }
75 75
76 static int crypto_ccm_setkey(struct crypto_aead *aead, const u8 *key, 76 static int crypto_ccm_setkey(struct crypto_aead *aead, const u8 *key,
77 unsigned int keylen) 77 unsigned int keylen)
78 { 78 {
79 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead); 79 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
80 struct crypto_ablkcipher *ctr = ctx->ctr; 80 struct crypto_ablkcipher *ctr = ctx->ctr;
81 struct crypto_cipher *tfm = ctx->cipher; 81 struct crypto_cipher *tfm = ctx->cipher;
82 int err = 0; 82 int err = 0;
83 83
84 crypto_ablkcipher_clear_flags(ctr, CRYPTO_TFM_REQ_MASK); 84 crypto_ablkcipher_clear_flags(ctr, CRYPTO_TFM_REQ_MASK);
85 crypto_ablkcipher_set_flags(ctr, crypto_aead_get_flags(aead) & 85 crypto_ablkcipher_set_flags(ctr, crypto_aead_get_flags(aead) &
86 CRYPTO_TFM_REQ_MASK); 86 CRYPTO_TFM_REQ_MASK);
87 err = crypto_ablkcipher_setkey(ctr, key, keylen); 87 err = crypto_ablkcipher_setkey(ctr, key, keylen);
88 crypto_aead_set_flags(aead, crypto_ablkcipher_get_flags(ctr) & 88 crypto_aead_set_flags(aead, crypto_ablkcipher_get_flags(ctr) &
89 CRYPTO_TFM_RES_MASK); 89 CRYPTO_TFM_RES_MASK);
90 if (err) 90 if (err)
91 goto out; 91 goto out;
92 92
93 crypto_cipher_clear_flags(tfm, CRYPTO_TFM_REQ_MASK); 93 crypto_cipher_clear_flags(tfm, CRYPTO_TFM_REQ_MASK);
94 crypto_cipher_set_flags(tfm, crypto_aead_get_flags(aead) & 94 crypto_cipher_set_flags(tfm, crypto_aead_get_flags(aead) &
95 CRYPTO_TFM_REQ_MASK); 95 CRYPTO_TFM_REQ_MASK);
96 err = crypto_cipher_setkey(tfm, key, keylen); 96 err = crypto_cipher_setkey(tfm, key, keylen);
97 crypto_aead_set_flags(aead, crypto_cipher_get_flags(tfm) & 97 crypto_aead_set_flags(aead, crypto_cipher_get_flags(tfm) &
98 CRYPTO_TFM_RES_MASK); 98 CRYPTO_TFM_RES_MASK);
99 99
100 out: 100 out:
101 return err; 101 return err;
102 } 102 }
103 103
104 static int crypto_ccm_setauthsize(struct crypto_aead *tfm, 104 static int crypto_ccm_setauthsize(struct crypto_aead *tfm,
105 unsigned int authsize) 105 unsigned int authsize)
106 { 106 {
107 switch (authsize) { 107 switch (authsize) {
108 case 4: 108 case 4:
109 case 6: 109 case 6:
110 case 8: 110 case 8:
111 case 10: 111 case 10:
112 case 12: 112 case 12:
113 case 14: 113 case 14:
114 case 16: 114 case 16:
115 break; 115 break;
116 default: 116 default:
117 return -EINVAL; 117 return -EINVAL;
118 } 118 }
119 119
120 return 0; 120 return 0;
121 } 121 }
122 122
123 static int format_input(u8 *info, struct aead_request *req, 123 static int format_input(u8 *info, struct aead_request *req,
124 unsigned int cryptlen) 124 unsigned int cryptlen)
125 { 125 {
126 struct crypto_aead *aead = crypto_aead_reqtfm(req); 126 struct crypto_aead *aead = crypto_aead_reqtfm(req);
127 unsigned int lp = req->iv[0]; 127 unsigned int lp = req->iv[0];
128 unsigned int l = lp + 1; 128 unsigned int l = lp + 1;
129 unsigned int m; 129 unsigned int m;
130 130
131 m = crypto_aead_authsize(aead); 131 m = crypto_aead_authsize(aead);
132 132
133 memcpy(info, req->iv, 16); 133 memcpy(info, req->iv, 16);
134 134
135 /* format control info per RFC 3610 and 135 /* format control info per RFC 3610 and
136 * NIST Special Publication 800-38C 136 * NIST Special Publication 800-38C
137 */ 137 */
138 *info |= (8 * ((m - 2) / 2)); 138 *info |= (8 * ((m - 2) / 2));
139 if (req->assoclen) 139 if (req->assoclen)
140 *info |= 64; 140 *info |= 64;
141 141
142 return set_msg_len(info + 16 - l, cryptlen, l); 142 return set_msg_len(info + 16 - l, cryptlen, l);
143 } 143 }
144 144
145 static int format_adata(u8 *adata, unsigned int a) 145 static int format_adata(u8 *adata, unsigned int a)
146 { 146 {
147 int len = 0; 147 int len = 0;
148 148
149 /* add control info for associated data 149 /* add control info for associated data
150 * RFC 3610 and NIST Special Publication 800-38C 150 * RFC 3610 and NIST Special Publication 800-38C
151 */ 151 */
152 if (a < 65280) { 152 if (a < 65280) {
153 *(__be16 *)adata = cpu_to_be16(a); 153 *(__be16 *)adata = cpu_to_be16(a);
154 len = 2; 154 len = 2;
155 } else { 155 } else {
156 *(__be16 *)adata = cpu_to_be16(0xfffe); 156 *(__be16 *)adata = cpu_to_be16(0xfffe);
157 *(__be32 *)&adata[2] = cpu_to_be32(a); 157 *(__be32 *)&adata[2] = cpu_to_be32(a);
158 len = 6; 158 len = 6;
159 } 159 }
160 160
161 return len; 161 return len;
162 } 162 }
163 163
164 static void compute_mac(struct crypto_cipher *tfm, u8 *data, int n, 164 static void compute_mac(struct crypto_cipher *tfm, u8 *data, int n,
165 struct crypto_ccm_req_priv_ctx *pctx) 165 struct crypto_ccm_req_priv_ctx *pctx)
166 { 166 {
167 unsigned int bs = 16; 167 unsigned int bs = 16;
168 u8 *odata = pctx->odata; 168 u8 *odata = pctx->odata;
169 u8 *idata = pctx->idata; 169 u8 *idata = pctx->idata;
170 int datalen, getlen; 170 int datalen, getlen;
171 171
172 datalen = n; 172 datalen = n;
173 173
174 /* first time in here, block may be partially filled. */ 174 /* first time in here, block may be partially filled. */
175 getlen = bs - pctx->ilen; 175 getlen = bs - pctx->ilen;
176 if (datalen >= getlen) { 176 if (datalen >= getlen) {
177 memcpy(idata + pctx->ilen, data, getlen); 177 memcpy(idata + pctx->ilen, data, getlen);
178 crypto_xor(odata, idata, bs); 178 crypto_xor(odata, idata, bs);
179 crypto_cipher_encrypt_one(tfm, odata, odata); 179 crypto_cipher_encrypt_one(tfm, odata, odata);
180 datalen -= getlen; 180 datalen -= getlen;
181 data += getlen; 181 data += getlen;
182 pctx->ilen = 0; 182 pctx->ilen = 0;
183 } 183 }
184 184
185 /* now encrypt rest of data */ 185 /* now encrypt rest of data */
186 while (datalen >= bs) { 186 while (datalen >= bs) {
187 crypto_xor(odata, data, bs); 187 crypto_xor(odata, data, bs);
188 crypto_cipher_encrypt_one(tfm, odata, odata); 188 crypto_cipher_encrypt_one(tfm, odata, odata);
189 189
190 datalen -= bs; 190 datalen -= bs;
191 data += bs; 191 data += bs;
192 } 192 }
193 193
194 /* check and see if there's leftover data that wasn't 194 /* check and see if there's leftover data that wasn't
195 * enough to fill a block. 195 * enough to fill a block.
196 */ 196 */
197 if (datalen) { 197 if (datalen) {
198 memcpy(idata + pctx->ilen, data, datalen); 198 memcpy(idata + pctx->ilen, data, datalen);
199 pctx->ilen += datalen; 199 pctx->ilen += datalen;
200 } 200 }
201 } 201 }
202 202
203 static void get_data_to_compute(struct crypto_cipher *tfm, 203 static void get_data_to_compute(struct crypto_cipher *tfm,
204 struct crypto_ccm_req_priv_ctx *pctx, 204 struct crypto_ccm_req_priv_ctx *pctx,
205 struct scatterlist *sg, unsigned int len) 205 struct scatterlist *sg, unsigned int len)
206 { 206 {
207 struct scatter_walk walk; 207 struct scatter_walk walk;
208 u8 *data_src; 208 u8 *data_src;
209 int n; 209 int n;
210 210
211 scatterwalk_start(&walk, sg); 211 scatterwalk_start(&walk, sg);
212 212
213 while (len) { 213 while (len) {
214 n = scatterwalk_clamp(&walk, len); 214 n = scatterwalk_clamp(&walk, len);
215 if (!n) { 215 if (!n) {
216 scatterwalk_start(&walk, sg_next(walk.sg)); 216 scatterwalk_start(&walk, sg_next(walk.sg));
217 n = scatterwalk_clamp(&walk, len); 217 n = scatterwalk_clamp(&walk, len);
218 } 218 }
219 data_src = scatterwalk_map(&walk); 219 data_src = scatterwalk_map(&walk);
220 220
221 compute_mac(tfm, data_src, n, pctx); 221 compute_mac(tfm, data_src, n, pctx);
222 len -= n; 222 len -= n;
223 223
224 scatterwalk_unmap(data_src); 224 scatterwalk_unmap(data_src);
225 scatterwalk_advance(&walk, n); 225 scatterwalk_advance(&walk, n);
226 scatterwalk_done(&walk, 0, len); 226 scatterwalk_done(&walk, 0, len);
227 if (len) 227 if (len)
228 crypto_yield(pctx->flags); 228 crypto_yield(pctx->flags);
229 } 229 }
230 230
231 /* any leftover needs padding and then encrypted */ 231 /* any leftover needs padding and then encrypted */
232 if (pctx->ilen) { 232 if (pctx->ilen) {
233 int padlen; 233 int padlen;
234 u8 *odata = pctx->odata; 234 u8 *odata = pctx->odata;
235 u8 *idata = pctx->idata; 235 u8 *idata = pctx->idata;
236 236
237 padlen = 16 - pctx->ilen; 237 padlen = 16 - pctx->ilen;
238 memset(idata + pctx->ilen, 0, padlen); 238 memset(idata + pctx->ilen, 0, padlen);
239 crypto_xor(odata, idata, 16); 239 crypto_xor(odata, idata, 16);
240 crypto_cipher_encrypt_one(tfm, odata, odata); 240 crypto_cipher_encrypt_one(tfm, odata, odata);
241 pctx->ilen = 0; 241 pctx->ilen = 0;
242 } 242 }
243 } 243 }
244 244
245 static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain, 245 static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain,
246 unsigned int cryptlen) 246 unsigned int cryptlen)
247 { 247 {
248 struct crypto_aead *aead = crypto_aead_reqtfm(req); 248 struct crypto_aead *aead = crypto_aead_reqtfm(req);
249 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead); 249 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
250 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 250 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
251 struct crypto_cipher *cipher = ctx->cipher; 251 struct crypto_cipher *cipher = ctx->cipher;
252 unsigned int assoclen = req->assoclen; 252 unsigned int assoclen = req->assoclen;
253 u8 *odata = pctx->odata; 253 u8 *odata = pctx->odata;
254 u8 *idata = pctx->idata; 254 u8 *idata = pctx->idata;
255 int err; 255 int err;
256 256
257 /* format control data for input */ 257 /* format control data for input */
258 err = format_input(odata, req, cryptlen); 258 err = format_input(odata, req, cryptlen);
259 if (err) 259 if (err)
260 goto out; 260 goto out;
261 261
262 /* encrypt first block to use as start in computing mac */ 262 /* encrypt first block to use as start in computing mac */
263 crypto_cipher_encrypt_one(cipher, odata, odata); 263 crypto_cipher_encrypt_one(cipher, odata, odata);
264 264
265 /* format associated data and compute into mac */ 265 /* format associated data and compute into mac */
266 if (assoclen) { 266 if (assoclen) {
267 pctx->ilen = format_adata(idata, assoclen); 267 pctx->ilen = format_adata(idata, assoclen);
268 get_data_to_compute(cipher, pctx, req->assoc, req->assoclen); 268 get_data_to_compute(cipher, pctx, req->assoc, req->assoclen);
269 } else { 269 } else {
270 pctx->ilen = 0; 270 pctx->ilen = 0;
271 } 271 }
272 272
273 /* compute plaintext into mac */ 273 /* compute plaintext into mac */
274 get_data_to_compute(cipher, pctx, plain, cryptlen); 274 if (cryptlen)
275 get_data_to_compute(cipher, pctx, plain, cryptlen);
275 276
276 out: 277 out:
277 return err; 278 return err;
278 } 279 }
279 280
280 static void crypto_ccm_encrypt_done(struct crypto_async_request *areq, int err) 281 static void crypto_ccm_encrypt_done(struct crypto_async_request *areq, int err)
281 { 282 {
282 struct aead_request *req = areq->data; 283 struct aead_request *req = areq->data;
283 struct crypto_aead *aead = crypto_aead_reqtfm(req); 284 struct crypto_aead *aead = crypto_aead_reqtfm(req);
284 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 285 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
285 u8 *odata = pctx->odata; 286 u8 *odata = pctx->odata;
286 287
287 if (!err) 288 if (!err)
288 scatterwalk_map_and_copy(odata, req->dst, req->cryptlen, 289 scatterwalk_map_and_copy(odata, req->dst, req->cryptlen,
289 crypto_aead_authsize(aead), 1); 290 crypto_aead_authsize(aead), 1);
290 aead_request_complete(req, err); 291 aead_request_complete(req, err);
291 } 292 }
292 293
293 static inline int crypto_ccm_check_iv(const u8 *iv) 294 static inline int crypto_ccm_check_iv(const u8 *iv)
294 { 295 {
295 /* 2 <= L <= 8, so 1 <= L' <= 7. */ 296 /* 2 <= L <= 8, so 1 <= L' <= 7. */
296 if (1 > iv[0] || iv[0] > 7) 297 if (1 > iv[0] || iv[0] > 7)
297 return -EINVAL; 298 return -EINVAL;
298 299
299 return 0; 300 return 0;
300 } 301 }
301 302
302 static int crypto_ccm_encrypt(struct aead_request *req) 303 static int crypto_ccm_encrypt(struct aead_request *req)
303 { 304 {
304 struct crypto_aead *aead = crypto_aead_reqtfm(req); 305 struct crypto_aead *aead = crypto_aead_reqtfm(req);
305 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead); 306 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
306 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 307 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
307 struct ablkcipher_request *abreq = &pctx->abreq; 308 struct ablkcipher_request *abreq = &pctx->abreq;
308 struct scatterlist *dst; 309 struct scatterlist *dst;
309 unsigned int cryptlen = req->cryptlen; 310 unsigned int cryptlen = req->cryptlen;
310 u8 *odata = pctx->odata; 311 u8 *odata = pctx->odata;
311 u8 *iv = req->iv; 312 u8 *iv = req->iv;
312 int err; 313 int err;
313 314
314 err = crypto_ccm_check_iv(iv); 315 err = crypto_ccm_check_iv(iv);
315 if (err) 316 if (err)
316 return err; 317 return err;
317 318
318 pctx->flags = aead_request_flags(req); 319 pctx->flags = aead_request_flags(req);
319 320
320 err = crypto_ccm_auth(req, req->src, cryptlen); 321 err = crypto_ccm_auth(req, req->src, cryptlen);
321 if (err) 322 if (err)
322 return err; 323 return err;
323 324
324 /* Note: rfc 3610 and NIST 800-38C require counter of 325 /* Note: rfc 3610 and NIST 800-38C require counter of
325 * zero to encrypt auth tag. 326 * zero to encrypt auth tag.
326 */ 327 */
327 memset(iv + 15 - iv[0], 0, iv[0] + 1); 328 memset(iv + 15 - iv[0], 0, iv[0] + 1);
328 329
329 sg_init_table(pctx->src, 2); 330 sg_init_table(pctx->src, 2);
330 sg_set_buf(pctx->src, odata, 16); 331 sg_set_buf(pctx->src, odata, 16);
331 scatterwalk_sg_chain(pctx->src, 2, req->src); 332 scatterwalk_sg_chain(pctx->src, 2, req->src);
332 333
333 dst = pctx->src; 334 dst = pctx->src;
334 if (req->src != req->dst) { 335 if (req->src != req->dst) {
335 sg_init_table(pctx->dst, 2); 336 sg_init_table(pctx->dst, 2);
336 sg_set_buf(pctx->dst, odata, 16); 337 sg_set_buf(pctx->dst, odata, 16);
337 scatterwalk_sg_chain(pctx->dst, 2, req->dst); 338 scatterwalk_sg_chain(pctx->dst, 2, req->dst);
338 dst = pctx->dst; 339 dst = pctx->dst;
339 } 340 }
340 341
341 ablkcipher_request_set_tfm(abreq, ctx->ctr); 342 ablkcipher_request_set_tfm(abreq, ctx->ctr);
342 ablkcipher_request_set_callback(abreq, pctx->flags, 343 ablkcipher_request_set_callback(abreq, pctx->flags,
343 crypto_ccm_encrypt_done, req); 344 crypto_ccm_encrypt_done, req);
344 ablkcipher_request_set_crypt(abreq, pctx->src, dst, cryptlen + 16, iv); 345 ablkcipher_request_set_crypt(abreq, pctx->src, dst, cryptlen + 16, iv);
345 err = crypto_ablkcipher_encrypt(abreq); 346 err = crypto_ablkcipher_encrypt(abreq);
346 if (err) 347 if (err)
347 return err; 348 return err;
348 349
349 /* copy authtag to end of dst */ 350 /* copy authtag to end of dst */
350 scatterwalk_map_and_copy(odata, req->dst, cryptlen, 351 scatterwalk_map_and_copy(odata, req->dst, cryptlen,
351 crypto_aead_authsize(aead), 1); 352 crypto_aead_authsize(aead), 1);
352 return err; 353 return err;
353 } 354 }
354 355
355 static void crypto_ccm_decrypt_done(struct crypto_async_request *areq, 356 static void crypto_ccm_decrypt_done(struct crypto_async_request *areq,
356 int err) 357 int err)
357 { 358 {
358 struct aead_request *req = areq->data; 359 struct aead_request *req = areq->data;
359 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 360 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
360 struct crypto_aead *aead = crypto_aead_reqtfm(req); 361 struct crypto_aead *aead = crypto_aead_reqtfm(req);
361 unsigned int authsize = crypto_aead_authsize(aead); 362 unsigned int authsize = crypto_aead_authsize(aead);
362 unsigned int cryptlen = req->cryptlen - authsize; 363 unsigned int cryptlen = req->cryptlen - authsize;
363 364
364 if (!err) { 365 if (!err) {
365 err = crypto_ccm_auth(req, req->dst, cryptlen); 366 err = crypto_ccm_auth(req, req->dst, cryptlen);
366 if (!err && crypto_memneq(pctx->auth_tag, pctx->odata, authsize)) 367 if (!err && crypto_memneq(pctx->auth_tag, pctx->odata, authsize))
367 err = -EBADMSG; 368 err = -EBADMSG;
368 } 369 }
369 aead_request_complete(req, err); 370 aead_request_complete(req, err);
370 } 371 }
371 372
372 static int crypto_ccm_decrypt(struct aead_request *req) 373 static int crypto_ccm_decrypt(struct aead_request *req)
373 { 374 {
374 struct crypto_aead *aead = crypto_aead_reqtfm(req); 375 struct crypto_aead *aead = crypto_aead_reqtfm(req);
375 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead); 376 struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
376 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req); 377 struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
377 struct ablkcipher_request *abreq = &pctx->abreq; 378 struct ablkcipher_request *abreq = &pctx->abreq;
378 struct scatterlist *dst; 379 struct scatterlist *dst;
379 unsigned int authsize = crypto_aead_authsize(aead); 380 unsigned int authsize = crypto_aead_authsize(aead);
380 unsigned int cryptlen = req->cryptlen; 381 unsigned int cryptlen = req->cryptlen;
381 u8 *authtag = pctx->auth_tag; 382 u8 *authtag = pctx->auth_tag;
382 u8 *odata = pctx->odata; 383 u8 *odata = pctx->odata;
383 u8 *iv = req->iv; 384 u8 *iv = req->iv;
384 int err; 385 int err;
385 386
386 if (cryptlen < authsize) 387 if (cryptlen < authsize)
387 return -EINVAL; 388 return -EINVAL;
388 cryptlen -= authsize; 389 cryptlen -= authsize;
389 390
390 err = crypto_ccm_check_iv(iv); 391 err = crypto_ccm_check_iv(iv);
391 if (err) 392 if (err)
392 return err; 393 return err;
393 394
394 pctx->flags = aead_request_flags(req); 395 pctx->flags = aead_request_flags(req);
395 396
396 scatterwalk_map_and_copy(authtag, req->src, cryptlen, authsize, 0); 397 scatterwalk_map_and_copy(authtag, req->src, cryptlen, authsize, 0);
397 398
398 memset(iv + 15 - iv[0], 0, iv[0] + 1); 399 memset(iv + 15 - iv[0], 0, iv[0] + 1);
399 400
400 sg_init_table(pctx->src, 2); 401 sg_init_table(pctx->src, 2);
401 sg_set_buf(pctx->src, authtag, 16); 402 sg_set_buf(pctx->src, authtag, 16);
402 scatterwalk_sg_chain(pctx->src, 2, req->src); 403 scatterwalk_sg_chain(pctx->src, 2, req->src);
403 404
404 dst = pctx->src; 405 dst = pctx->src;
405 if (req->src != req->dst) { 406 if (req->src != req->dst) {
406 sg_init_table(pctx->dst, 2); 407 sg_init_table(pctx->dst, 2);
407 sg_set_buf(pctx->dst, authtag, 16); 408 sg_set_buf(pctx->dst, authtag, 16);
408 scatterwalk_sg_chain(pctx->dst, 2, req->dst); 409 scatterwalk_sg_chain(pctx->dst, 2, req->dst);
409 dst = pctx->dst; 410 dst = pctx->dst;
410 } 411 }
411 412
412 ablkcipher_request_set_tfm(abreq, ctx->ctr); 413 ablkcipher_request_set_tfm(abreq, ctx->ctr);
413 ablkcipher_request_set_callback(abreq, pctx->flags, 414 ablkcipher_request_set_callback(abreq, pctx->flags,
414 crypto_ccm_decrypt_done, req); 415 crypto_ccm_decrypt_done, req);
415 ablkcipher_request_set_crypt(abreq, pctx->src, dst, cryptlen + 16, iv); 416 ablkcipher_request_set_crypt(abreq, pctx->src, dst, cryptlen + 16, iv);
416 err = crypto_ablkcipher_decrypt(abreq); 417 err = crypto_ablkcipher_decrypt(abreq);
417 if (err) 418 if (err)
418 return err; 419 return err;
419 420
420 err = crypto_ccm_auth(req, req->dst, cryptlen); 421 err = crypto_ccm_auth(req, req->dst, cryptlen);
421 if (err) 422 if (err)
422 return err; 423 return err;
423 424
424 /* verify */ 425 /* verify */
425 if (crypto_memneq(authtag, odata, authsize)) 426 if (crypto_memneq(authtag, odata, authsize))
426 return -EBADMSG; 427 return -EBADMSG;
427 428
428 return err; 429 return err;
429 } 430 }
430 431
431 static int crypto_ccm_init_tfm(struct crypto_tfm *tfm) 432 static int crypto_ccm_init_tfm(struct crypto_tfm *tfm)
432 { 433 {
433 struct crypto_instance *inst = (void *)tfm->__crt_alg; 434 struct crypto_instance *inst = (void *)tfm->__crt_alg;
434 struct ccm_instance_ctx *ictx = crypto_instance_ctx(inst); 435 struct ccm_instance_ctx *ictx = crypto_instance_ctx(inst);
435 struct crypto_ccm_ctx *ctx = crypto_tfm_ctx(tfm); 436 struct crypto_ccm_ctx *ctx = crypto_tfm_ctx(tfm);
436 struct crypto_cipher *cipher; 437 struct crypto_cipher *cipher;
437 struct crypto_ablkcipher *ctr; 438 struct crypto_ablkcipher *ctr;
438 unsigned long align; 439 unsigned long align;
439 int err; 440 int err;
440 441
441 cipher = crypto_spawn_cipher(&ictx->cipher); 442 cipher = crypto_spawn_cipher(&ictx->cipher);
442 if (IS_ERR(cipher)) 443 if (IS_ERR(cipher))
443 return PTR_ERR(cipher); 444 return PTR_ERR(cipher);
444 445
445 ctr = crypto_spawn_skcipher(&ictx->ctr); 446 ctr = crypto_spawn_skcipher(&ictx->ctr);
446 err = PTR_ERR(ctr); 447 err = PTR_ERR(ctr);
447 if (IS_ERR(ctr)) 448 if (IS_ERR(ctr))
448 goto err_free_cipher; 449 goto err_free_cipher;
449 450
450 ctx->cipher = cipher; 451 ctx->cipher = cipher;
451 ctx->ctr = ctr; 452 ctx->ctr = ctr;
452 453
453 align = crypto_tfm_alg_alignmask(tfm); 454 align = crypto_tfm_alg_alignmask(tfm);
454 align &= ~(crypto_tfm_ctx_alignment() - 1); 455 align &= ~(crypto_tfm_ctx_alignment() - 1);
455 tfm->crt_aead.reqsize = align + 456 tfm->crt_aead.reqsize = align +
456 sizeof(struct crypto_ccm_req_priv_ctx) + 457 sizeof(struct crypto_ccm_req_priv_ctx) +
457 crypto_ablkcipher_reqsize(ctr); 458 crypto_ablkcipher_reqsize(ctr);
458 459
459 return 0; 460 return 0;
460 461
461 err_free_cipher: 462 err_free_cipher:
462 crypto_free_cipher(cipher); 463 crypto_free_cipher(cipher);
463 return err; 464 return err;
464 } 465 }
465 466
466 static void crypto_ccm_exit_tfm(struct crypto_tfm *tfm) 467 static void crypto_ccm_exit_tfm(struct crypto_tfm *tfm)
467 { 468 {
468 struct crypto_ccm_ctx *ctx = crypto_tfm_ctx(tfm); 469 struct crypto_ccm_ctx *ctx = crypto_tfm_ctx(tfm);
469 470
470 crypto_free_cipher(ctx->cipher); 471 crypto_free_cipher(ctx->cipher);
471 crypto_free_ablkcipher(ctx->ctr); 472 crypto_free_ablkcipher(ctx->ctr);
472 } 473 }
473 474
474 static struct crypto_instance *crypto_ccm_alloc_common(struct rtattr **tb, 475 static struct crypto_instance *crypto_ccm_alloc_common(struct rtattr **tb,
475 const char *full_name, 476 const char *full_name,
476 const char *ctr_name, 477 const char *ctr_name,
477 const char *cipher_name) 478 const char *cipher_name)
478 { 479 {
479 struct crypto_attr_type *algt; 480 struct crypto_attr_type *algt;
480 struct crypto_instance *inst; 481 struct crypto_instance *inst;
481 struct crypto_alg *ctr; 482 struct crypto_alg *ctr;
482 struct crypto_alg *cipher; 483 struct crypto_alg *cipher;
483 struct ccm_instance_ctx *ictx; 484 struct ccm_instance_ctx *ictx;
484 int err; 485 int err;
485 486
486 algt = crypto_get_attr_type(tb); 487 algt = crypto_get_attr_type(tb);
487 if (IS_ERR(algt)) 488 if (IS_ERR(algt))
488 return ERR_CAST(algt); 489 return ERR_CAST(algt);
489 490
490 if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & algt->mask) 491 if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & algt->mask)
491 return ERR_PTR(-EINVAL); 492 return ERR_PTR(-EINVAL);
492 493
493 cipher = crypto_alg_mod_lookup(cipher_name, CRYPTO_ALG_TYPE_CIPHER, 494 cipher = crypto_alg_mod_lookup(cipher_name, CRYPTO_ALG_TYPE_CIPHER,
494 CRYPTO_ALG_TYPE_MASK); 495 CRYPTO_ALG_TYPE_MASK);
495 if (IS_ERR(cipher)) 496 if (IS_ERR(cipher))
496 return ERR_CAST(cipher); 497 return ERR_CAST(cipher);
497 498
498 err = -EINVAL; 499 err = -EINVAL;
499 if (cipher->cra_blocksize != 16) 500 if (cipher->cra_blocksize != 16)
500 goto out_put_cipher; 501 goto out_put_cipher;
501 502
502 inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL); 503 inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL);
503 err = -ENOMEM; 504 err = -ENOMEM;
504 if (!inst) 505 if (!inst)
505 goto out_put_cipher; 506 goto out_put_cipher;
506 507
507 ictx = crypto_instance_ctx(inst); 508 ictx = crypto_instance_ctx(inst);
508 509
509 err = crypto_init_spawn(&ictx->cipher, cipher, inst, 510 err = crypto_init_spawn(&ictx->cipher, cipher, inst,
510 CRYPTO_ALG_TYPE_MASK); 511 CRYPTO_ALG_TYPE_MASK);
511 if (err) 512 if (err)
512 goto err_free_inst; 513 goto err_free_inst;
513 514
514 crypto_set_skcipher_spawn(&ictx->ctr, inst); 515 crypto_set_skcipher_spawn(&ictx->ctr, inst);
515 err = crypto_grab_skcipher(&ictx->ctr, ctr_name, 0, 516 err = crypto_grab_skcipher(&ictx->ctr, ctr_name, 0,
516 crypto_requires_sync(algt->type, 517 crypto_requires_sync(algt->type,
517 algt->mask)); 518 algt->mask));
518 if (err) 519 if (err)
519 goto err_drop_cipher; 520 goto err_drop_cipher;
520 521
521 ctr = crypto_skcipher_spawn_alg(&ictx->ctr); 522 ctr = crypto_skcipher_spawn_alg(&ictx->ctr);
522 523
523 /* Not a stream cipher? */ 524 /* Not a stream cipher? */
524 err = -EINVAL; 525 err = -EINVAL;
525 if (ctr->cra_blocksize != 1) 526 if (ctr->cra_blocksize != 1)
526 goto err_drop_ctr; 527 goto err_drop_ctr;
527 528
528 /* We want the real thing! */ 529 /* We want the real thing! */
529 if (ctr->cra_ablkcipher.ivsize != 16) 530 if (ctr->cra_ablkcipher.ivsize != 16)
530 goto err_drop_ctr; 531 goto err_drop_ctr;
531 532
532 err = -ENAMETOOLONG; 533 err = -ENAMETOOLONG;
533 if (snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME, 534 if (snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
534 "ccm_base(%s,%s)", ctr->cra_driver_name, 535 "ccm_base(%s,%s)", ctr->cra_driver_name,
535 cipher->cra_driver_name) >= CRYPTO_MAX_ALG_NAME) 536 cipher->cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
536 goto err_drop_ctr; 537 goto err_drop_ctr;
537 538
538 memcpy(inst->alg.cra_name, full_name, CRYPTO_MAX_ALG_NAME); 539 memcpy(inst->alg.cra_name, full_name, CRYPTO_MAX_ALG_NAME);
539 540
540 inst->alg.cra_flags = CRYPTO_ALG_TYPE_AEAD; 541 inst->alg.cra_flags = CRYPTO_ALG_TYPE_AEAD;
541 inst->alg.cra_flags |= ctr->cra_flags & CRYPTO_ALG_ASYNC; 542 inst->alg.cra_flags |= ctr->cra_flags & CRYPTO_ALG_ASYNC;
542 inst->alg.cra_priority = cipher->cra_priority + ctr->cra_priority; 543 inst->alg.cra_priority = cipher->cra_priority + ctr->cra_priority;
543 inst->alg.cra_blocksize = 1; 544 inst->alg.cra_blocksize = 1;
544 inst->alg.cra_alignmask = cipher->cra_alignmask | ctr->cra_alignmask | 545 inst->alg.cra_alignmask = cipher->cra_alignmask | ctr->cra_alignmask |
545 (__alignof__(u32) - 1); 546 (__alignof__(u32) - 1);
546 inst->alg.cra_type = &crypto_aead_type; 547 inst->alg.cra_type = &crypto_aead_type;
547 inst->alg.cra_aead.ivsize = 16; 548 inst->alg.cra_aead.ivsize = 16;
548 inst->alg.cra_aead.maxauthsize = 16; 549 inst->alg.cra_aead.maxauthsize = 16;
549 inst->alg.cra_ctxsize = sizeof(struct crypto_ccm_ctx); 550 inst->alg.cra_ctxsize = sizeof(struct crypto_ccm_ctx);
550 inst->alg.cra_init = crypto_ccm_init_tfm; 551 inst->alg.cra_init = crypto_ccm_init_tfm;
551 inst->alg.cra_exit = crypto_ccm_exit_tfm; 552 inst->alg.cra_exit = crypto_ccm_exit_tfm;
552 inst->alg.cra_aead.setkey = crypto_ccm_setkey; 553 inst->alg.cra_aead.setkey = crypto_ccm_setkey;
553 inst->alg.cra_aead.setauthsize = crypto_ccm_setauthsize; 554 inst->alg.cra_aead.setauthsize = crypto_ccm_setauthsize;
554 inst->alg.cra_aead.encrypt = crypto_ccm_encrypt; 555 inst->alg.cra_aead.encrypt = crypto_ccm_encrypt;
555 inst->alg.cra_aead.decrypt = crypto_ccm_decrypt; 556 inst->alg.cra_aead.decrypt = crypto_ccm_decrypt;
556 557
557 out: 558 out:
558 crypto_mod_put(cipher); 559 crypto_mod_put(cipher);
559 return inst; 560 return inst;
560 561
561 err_drop_ctr: 562 err_drop_ctr:
562 crypto_drop_skcipher(&ictx->ctr); 563 crypto_drop_skcipher(&ictx->ctr);
563 err_drop_cipher: 564 err_drop_cipher:
564 crypto_drop_spawn(&ictx->cipher); 565 crypto_drop_spawn(&ictx->cipher);
565 err_free_inst: 566 err_free_inst:
566 kfree(inst); 567 kfree(inst);
567 out_put_cipher: 568 out_put_cipher:
568 inst = ERR_PTR(err); 569 inst = ERR_PTR(err);
569 goto out; 570 goto out;
570 } 571 }
571 572
572 static struct crypto_instance *crypto_ccm_alloc(struct rtattr **tb) 573 static struct crypto_instance *crypto_ccm_alloc(struct rtattr **tb)
573 { 574 {
574 const char *cipher_name; 575 const char *cipher_name;
575 char ctr_name[CRYPTO_MAX_ALG_NAME]; 576 char ctr_name[CRYPTO_MAX_ALG_NAME];
576 char full_name[CRYPTO_MAX_ALG_NAME]; 577 char full_name[CRYPTO_MAX_ALG_NAME];
577 578
578 cipher_name = crypto_attr_alg_name(tb[1]); 579 cipher_name = crypto_attr_alg_name(tb[1]);
579 if (IS_ERR(cipher_name)) 580 if (IS_ERR(cipher_name))
580 return ERR_CAST(cipher_name); 581 return ERR_CAST(cipher_name);
581 582
582 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)", 583 if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
583 cipher_name) >= CRYPTO_MAX_ALG_NAME) 584 cipher_name) >= CRYPTO_MAX_ALG_NAME)
584 return ERR_PTR(-ENAMETOOLONG); 585 return ERR_PTR(-ENAMETOOLONG);
585 586
586 if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "ccm(%s)", cipher_name) >= 587 if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "ccm(%s)", cipher_name) >=
587 CRYPTO_MAX_ALG_NAME) 588 CRYPTO_MAX_ALG_NAME)
588 return ERR_PTR(-ENAMETOOLONG); 589 return ERR_PTR(-ENAMETOOLONG);
589 590
590 return crypto_ccm_alloc_common(tb, full_name, ctr_name, cipher_name); 591 return crypto_ccm_alloc_common(tb, full_name, ctr_name, cipher_name);
591 } 592 }
592 593
593 static void crypto_ccm_free(struct crypto_instance *inst) 594 static void crypto_ccm_free(struct crypto_instance *inst)
594 { 595 {
595 struct ccm_instance_ctx *ctx = crypto_instance_ctx(inst); 596 struct ccm_instance_ctx *ctx = crypto_instance_ctx(inst);
596 597
597 crypto_drop_spawn(&ctx->cipher); 598 crypto_drop_spawn(&ctx->cipher);
598 crypto_drop_skcipher(&ctx->ctr); 599 crypto_drop_skcipher(&ctx->ctr);
599 kfree(inst); 600 kfree(inst);
600 } 601 }
601 602
602 static struct crypto_template crypto_ccm_tmpl = { 603 static struct crypto_template crypto_ccm_tmpl = {
603 .name = "ccm", 604 .name = "ccm",
604 .alloc = crypto_ccm_alloc, 605 .alloc = crypto_ccm_alloc,
605 .free = crypto_ccm_free, 606 .free = crypto_ccm_free,
606 .module = THIS_MODULE, 607 .module = THIS_MODULE,
607 }; 608 };
608 609
609 static struct crypto_instance *crypto_ccm_base_alloc(struct rtattr **tb) 610 static struct crypto_instance *crypto_ccm_base_alloc(struct rtattr **tb)
610 { 611 {
611 const char *ctr_name; 612 const char *ctr_name;
612 const char *cipher_name; 613 const char *cipher_name;
613 char full_name[CRYPTO_MAX_ALG_NAME]; 614 char full_name[CRYPTO_MAX_ALG_NAME];
614 615
615 ctr_name = crypto_attr_alg_name(tb[1]); 616 ctr_name = crypto_attr_alg_name(tb[1]);
616 if (IS_ERR(ctr_name)) 617 if (IS_ERR(ctr_name))
617 return ERR_CAST(ctr_name); 618 return ERR_CAST(ctr_name);
618 619
619 cipher_name = crypto_attr_alg_name(tb[2]); 620 cipher_name = crypto_attr_alg_name(tb[2]);
620 if (IS_ERR(cipher_name)) 621 if (IS_ERR(cipher_name))
621 return ERR_CAST(cipher_name); 622 return ERR_CAST(cipher_name);
622 623
623 if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "ccm_base(%s,%s)", 624 if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "ccm_base(%s,%s)",
624 ctr_name, cipher_name) >= CRYPTO_MAX_ALG_NAME) 625 ctr_name, cipher_name) >= CRYPTO_MAX_ALG_NAME)
625 return ERR_PTR(-ENAMETOOLONG); 626 return ERR_PTR(-ENAMETOOLONG);
626 627
627 return crypto_ccm_alloc_common(tb, full_name, ctr_name, cipher_name); 628 return crypto_ccm_alloc_common(tb, full_name, ctr_name, cipher_name);
628 } 629 }
629 630
630 static struct crypto_template crypto_ccm_base_tmpl = { 631 static struct crypto_template crypto_ccm_base_tmpl = {
631 .name = "ccm_base", 632 .name = "ccm_base",
632 .alloc = crypto_ccm_base_alloc, 633 .alloc = crypto_ccm_base_alloc,
633 .free = crypto_ccm_free, 634 .free = crypto_ccm_free,
634 .module = THIS_MODULE, 635 .module = THIS_MODULE,
635 }; 636 };
636 637
637 static int crypto_rfc4309_setkey(struct crypto_aead *parent, const u8 *key, 638 static int crypto_rfc4309_setkey(struct crypto_aead *parent, const u8 *key,
638 unsigned int keylen) 639 unsigned int keylen)
639 { 640 {
640 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent); 641 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent);
641 struct crypto_aead *child = ctx->child; 642 struct crypto_aead *child = ctx->child;
642 int err; 643 int err;
643 644
644 if (keylen < 3) 645 if (keylen < 3)
645 return -EINVAL; 646 return -EINVAL;
646 647
647 keylen -= 3; 648 keylen -= 3;
648 memcpy(ctx->nonce, key + keylen, 3); 649 memcpy(ctx->nonce, key + keylen, 3);
649 650
650 crypto_aead_clear_flags(child, CRYPTO_TFM_REQ_MASK); 651 crypto_aead_clear_flags(child, CRYPTO_TFM_REQ_MASK);
651 crypto_aead_set_flags(child, crypto_aead_get_flags(parent) & 652 crypto_aead_set_flags(child, crypto_aead_get_flags(parent) &
652 CRYPTO_TFM_REQ_MASK); 653 CRYPTO_TFM_REQ_MASK);
653 err = crypto_aead_setkey(child, key, keylen); 654 err = crypto_aead_setkey(child, key, keylen);
654 crypto_aead_set_flags(parent, crypto_aead_get_flags(child) & 655 crypto_aead_set_flags(parent, crypto_aead_get_flags(child) &
655 CRYPTO_TFM_RES_MASK); 656 CRYPTO_TFM_RES_MASK);
656 657
657 return err; 658 return err;
658 } 659 }
659 660
660 static int crypto_rfc4309_setauthsize(struct crypto_aead *parent, 661 static int crypto_rfc4309_setauthsize(struct crypto_aead *parent,
661 unsigned int authsize) 662 unsigned int authsize)
662 { 663 {
663 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent); 664 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent);
664 665
665 switch (authsize) { 666 switch (authsize) {
666 case 8: 667 case 8:
667 case 12: 668 case 12:
668 case 16: 669 case 16:
669 break; 670 break;
670 default: 671 default:
671 return -EINVAL; 672 return -EINVAL;
672 } 673 }
673 674
674 return crypto_aead_setauthsize(ctx->child, authsize); 675 return crypto_aead_setauthsize(ctx->child, authsize);
675 } 676 }
676 677
677 static struct aead_request *crypto_rfc4309_crypt(struct aead_request *req) 678 static struct aead_request *crypto_rfc4309_crypt(struct aead_request *req)
678 { 679 {
679 struct aead_request *subreq = aead_request_ctx(req); 680 struct aead_request *subreq = aead_request_ctx(req);
680 struct crypto_aead *aead = crypto_aead_reqtfm(req); 681 struct crypto_aead *aead = crypto_aead_reqtfm(req);
681 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(aead); 682 struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(aead);
682 struct crypto_aead *child = ctx->child; 683 struct crypto_aead *child = ctx->child;
683 u8 *iv = PTR_ALIGN((u8 *)(subreq + 1) + crypto_aead_reqsize(child), 684 u8 *iv = PTR_ALIGN((u8 *)(subreq + 1) + crypto_aead_reqsize(child),
684 crypto_aead_alignmask(child) + 1); 685 crypto_aead_alignmask(child) + 1);
685 686
686 /* L' */ 687 /* L' */
687 iv[0] = 3; 688 iv[0] = 3;
688 689
689 memcpy(iv + 1, ctx->nonce, 3); 690 memcpy(iv + 1, ctx->nonce, 3);
690 memcpy(iv + 4, req->iv, 8); 691 memcpy(iv + 4, req->iv, 8);
691 692
692 aead_request_set_tfm(subreq, child); 693 aead_request_set_tfm(subreq, child);
693 aead_request_set_callback(subreq, req->base.flags, req->base.complete, 694 aead_request_set_callback(subreq, req->base.flags, req->base.complete,
694 req->base.data); 695 req->base.data);
695 aead_request_set_crypt(subreq, req->src, req->dst, req->cryptlen, iv); 696 aead_request_set_crypt(subreq, req->src, req->dst, req->cryptlen, iv);
696 aead_request_set_assoc(subreq, req->assoc, req->assoclen); 697 aead_request_set_assoc(subreq, req->assoc, req->assoclen);
697 698
698 return subreq; 699 return subreq;
699 } 700 }
700 701
701 static int crypto_rfc4309_encrypt(struct aead_request *req) 702 static int crypto_rfc4309_encrypt(struct aead_request *req)
702 { 703 {
703 req = crypto_rfc4309_crypt(req); 704 req = crypto_rfc4309_crypt(req);
704 705
705 return crypto_aead_encrypt(req); 706 return crypto_aead_encrypt(req);
706 } 707 }
707 708
708 static int crypto_rfc4309_decrypt(struct aead_request *req) 709 static int crypto_rfc4309_decrypt(struct aead_request *req)
709 { 710 {
710 req = crypto_rfc4309_crypt(req); 711 req = crypto_rfc4309_crypt(req);
711 712
712 return crypto_aead_decrypt(req); 713 return crypto_aead_decrypt(req);
713 } 714 }
714 715
715 static int crypto_rfc4309_init_tfm(struct crypto_tfm *tfm) 716 static int crypto_rfc4309_init_tfm(struct crypto_tfm *tfm)
716 { 717 {
717 struct crypto_instance *inst = (void *)tfm->__crt_alg; 718 struct crypto_instance *inst = (void *)tfm->__crt_alg;
718 struct crypto_aead_spawn *spawn = crypto_instance_ctx(inst); 719 struct crypto_aead_spawn *spawn = crypto_instance_ctx(inst);
719 struct crypto_rfc4309_ctx *ctx = crypto_tfm_ctx(tfm); 720 struct crypto_rfc4309_ctx *ctx = crypto_tfm_ctx(tfm);
720 struct crypto_aead *aead; 721 struct crypto_aead *aead;
721 unsigned long align; 722 unsigned long align;
722 723
723 aead = crypto_spawn_aead(spawn); 724 aead = crypto_spawn_aead(spawn);
724 if (IS_ERR(aead)) 725 if (IS_ERR(aead))
725 return PTR_ERR(aead); 726 return PTR_ERR(aead);
726 727
727 ctx->child = aead; 728 ctx->child = aead;
728 729
729 align = crypto_aead_alignmask(aead); 730 align = crypto_aead_alignmask(aead);
730 align &= ~(crypto_tfm_ctx_alignment() - 1); 731 align &= ~(crypto_tfm_ctx_alignment() - 1);
731 tfm->crt_aead.reqsize = sizeof(struct aead_request) + 732 tfm->crt_aead.reqsize = sizeof(struct aead_request) +
732 ALIGN(crypto_aead_reqsize(aead), 733 ALIGN(crypto_aead_reqsize(aead),
733 crypto_tfm_ctx_alignment()) + 734 crypto_tfm_ctx_alignment()) +
734 align + 16; 735 align + 16;
735 736
736 return 0; 737 return 0;
737 } 738 }
738 739
739 static void crypto_rfc4309_exit_tfm(struct crypto_tfm *tfm) 740 static void crypto_rfc4309_exit_tfm(struct crypto_tfm *tfm)
740 { 741 {
741 struct crypto_rfc4309_ctx *ctx = crypto_tfm_ctx(tfm); 742 struct crypto_rfc4309_ctx *ctx = crypto_tfm_ctx(tfm);
742 743
743 crypto_free_aead(ctx->child); 744 crypto_free_aead(ctx->child);
744 } 745 }
745 746
746 static struct crypto_instance *crypto_rfc4309_alloc(struct rtattr **tb) 747 static struct crypto_instance *crypto_rfc4309_alloc(struct rtattr **tb)
747 { 748 {
748 struct crypto_attr_type *algt; 749 struct crypto_attr_type *algt;
749 struct crypto_instance *inst; 750 struct crypto_instance *inst;
750 struct crypto_aead_spawn *spawn; 751 struct crypto_aead_spawn *spawn;
751 struct crypto_alg *alg; 752 struct crypto_alg *alg;
752 const char *ccm_name; 753 const char *ccm_name;
753 int err; 754 int err;
754 755
755 algt = crypto_get_attr_type(tb); 756 algt = crypto_get_attr_type(tb);
756 if (IS_ERR(algt)) 757 if (IS_ERR(algt))
757 return ERR_CAST(algt); 758 return ERR_CAST(algt);
758 759
759 if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & algt->mask) 760 if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & algt->mask)
760 return ERR_PTR(-EINVAL); 761 return ERR_PTR(-EINVAL);
761 762
762 ccm_name = crypto_attr_alg_name(tb[1]); 763 ccm_name = crypto_attr_alg_name(tb[1]);
763 if (IS_ERR(ccm_name)) 764 if (IS_ERR(ccm_name))
764 return ERR_CAST(ccm_name); 765 return ERR_CAST(ccm_name);
765 766
766 inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL); 767 inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
767 if (!inst) 768 if (!inst)
768 return ERR_PTR(-ENOMEM); 769 return ERR_PTR(-ENOMEM);
769 770
770 spawn = crypto_instance_ctx(inst); 771 spawn = crypto_instance_ctx(inst);
771 crypto_set_aead_spawn(spawn, inst); 772 crypto_set_aead_spawn(spawn, inst);
772 err = crypto_grab_aead(spawn, ccm_name, 0, 773 err = crypto_grab_aead(spawn, ccm_name, 0,
773 crypto_requires_sync(algt->type, algt->mask)); 774 crypto_requires_sync(algt->type, algt->mask));
774 if (err) 775 if (err)
775 goto out_free_inst; 776 goto out_free_inst;
776 777
777 alg = crypto_aead_spawn_alg(spawn); 778 alg = crypto_aead_spawn_alg(spawn);
778 779
779 err = -EINVAL; 780 err = -EINVAL;
780 781
781 /* We only support 16-byte blocks. */ 782 /* We only support 16-byte blocks. */
782 if (alg->cra_aead.ivsize != 16) 783 if (alg->cra_aead.ivsize != 16)
783 goto out_drop_alg; 784 goto out_drop_alg;
784 785
785 /* Not a stream cipher? */ 786 /* Not a stream cipher? */
786 if (alg->cra_blocksize != 1) 787 if (alg->cra_blocksize != 1)
787 goto out_drop_alg; 788 goto out_drop_alg;
788 789
789 err = -ENAMETOOLONG; 790 err = -ENAMETOOLONG;
790 if (snprintf(inst->alg.cra_name, CRYPTO_MAX_ALG_NAME, 791 if (snprintf(inst->alg.cra_name, CRYPTO_MAX_ALG_NAME,
791 "rfc4309(%s)", alg->cra_name) >= CRYPTO_MAX_ALG_NAME || 792 "rfc4309(%s)", alg->cra_name) >= CRYPTO_MAX_ALG_NAME ||
792 snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME, 793 snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
793 "rfc4309(%s)", alg->cra_driver_name) >= 794 "rfc4309(%s)", alg->cra_driver_name) >=
794 CRYPTO_MAX_ALG_NAME) 795 CRYPTO_MAX_ALG_NAME)
795 goto out_drop_alg; 796 goto out_drop_alg;
796 797
797 inst->alg.cra_flags = CRYPTO_ALG_TYPE_AEAD; 798 inst->alg.cra_flags = CRYPTO_ALG_TYPE_AEAD;
798 inst->alg.cra_flags |= alg->cra_flags & CRYPTO_ALG_ASYNC; 799 inst->alg.cra_flags |= alg->cra_flags & CRYPTO_ALG_ASYNC;
799 inst->alg.cra_priority = alg->cra_priority; 800 inst->alg.cra_priority = alg->cra_priority;
800 inst->alg.cra_blocksize = 1; 801 inst->alg.cra_blocksize = 1;
801 inst->alg.cra_alignmask = alg->cra_alignmask; 802 inst->alg.cra_alignmask = alg->cra_alignmask;
802 inst->alg.cra_type = &crypto_nivaead_type; 803 inst->alg.cra_type = &crypto_nivaead_type;
803 804
804 inst->alg.cra_aead.ivsize = 8; 805 inst->alg.cra_aead.ivsize = 8;
805 inst->alg.cra_aead.maxauthsize = 16; 806 inst->alg.cra_aead.maxauthsize = 16;
806 807
807 inst->alg.cra_ctxsize = sizeof(struct crypto_rfc4309_ctx); 808 inst->alg.cra_ctxsize = sizeof(struct crypto_rfc4309_ctx);
808 809
809 inst->alg.cra_init = crypto_rfc4309_init_tfm; 810 inst->alg.cra_init = crypto_rfc4309_init_tfm;
810 inst->alg.cra_exit = crypto_rfc4309_exit_tfm; 811 inst->alg.cra_exit = crypto_rfc4309_exit_tfm;
811 812
812 inst->alg.cra_aead.setkey = crypto_rfc4309_setkey; 813 inst->alg.cra_aead.setkey = crypto_rfc4309_setkey;
813 inst->alg.cra_aead.setauthsize = crypto_rfc4309_setauthsize; 814 inst->alg.cra_aead.setauthsize = crypto_rfc4309_setauthsize;
814 inst->alg.cra_aead.encrypt = crypto_rfc4309_encrypt; 815 inst->alg.cra_aead.encrypt = crypto_rfc4309_encrypt;
815 inst->alg.cra_aead.decrypt = crypto_rfc4309_decrypt; 816 inst->alg.cra_aead.decrypt = crypto_rfc4309_decrypt;
816 817
817 inst->alg.cra_aead.geniv = "seqiv"; 818 inst->alg.cra_aead.geniv = "seqiv";
818 819
819 out: 820 out:
820 return inst; 821 return inst;
821 822
822 out_drop_alg: 823 out_drop_alg:
823 crypto_drop_aead(spawn); 824 crypto_drop_aead(spawn);
824 out_free_inst: 825 out_free_inst:
825 kfree(inst); 826 kfree(inst);
826 inst = ERR_PTR(err); 827 inst = ERR_PTR(err);
827 goto out; 828 goto out;
828 } 829 }
829 830
830 static void crypto_rfc4309_free(struct crypto_instance *inst) 831 static void crypto_rfc4309_free(struct crypto_instance *inst)
831 { 832 {
832 crypto_drop_spawn(crypto_instance_ctx(inst)); 833 crypto_drop_spawn(crypto_instance_ctx(inst));
833 kfree(inst); 834 kfree(inst);
834 } 835 }
835 836
836 static struct crypto_template crypto_rfc4309_tmpl = { 837 static struct crypto_template crypto_rfc4309_tmpl = {
837 .name = "rfc4309", 838 .name = "rfc4309",
838 .alloc = crypto_rfc4309_alloc, 839 .alloc = crypto_rfc4309_alloc,
839 .free = crypto_rfc4309_free, 840 .free = crypto_rfc4309_free,
840 .module = THIS_MODULE, 841 .module = THIS_MODULE,
841 }; 842 };
842 843
843 static int __init crypto_ccm_module_init(void) 844 static int __init crypto_ccm_module_init(void)
844 { 845 {
845 int err; 846 int err;
846 847
847 err = crypto_register_template(&crypto_ccm_base_tmpl); 848 err = crypto_register_template(&crypto_ccm_base_tmpl);
848 if (err) 849 if (err)
849 goto out; 850 goto out;
850 851
851 err = crypto_register_template(&crypto_ccm_tmpl); 852 err = crypto_register_template(&crypto_ccm_tmpl);
852 if (err) 853 if (err)
853 goto out_undo_base; 854 goto out_undo_base;
854 855
855 err = crypto_register_template(&crypto_rfc4309_tmpl); 856 err = crypto_register_template(&crypto_rfc4309_tmpl);
856 if (err) 857 if (err)
857 goto out_undo_ccm; 858 goto out_undo_ccm;
858 859
859 out: 860 out:
860 return err; 861 return err;
861 862
862 out_undo_ccm: 863 out_undo_ccm:
863 crypto_unregister_template(&crypto_ccm_tmpl); 864 crypto_unregister_template(&crypto_ccm_tmpl);
864 out_undo_base: 865 out_undo_base:
865 crypto_unregister_template(&crypto_ccm_base_tmpl); 866 crypto_unregister_template(&crypto_ccm_base_tmpl);
866 goto out; 867 goto out;
867 } 868 }
868 869
869 static void __exit crypto_ccm_module_exit(void) 870 static void __exit crypto_ccm_module_exit(void)
870 { 871 {
871 crypto_unregister_template(&crypto_rfc4309_tmpl); 872 crypto_unregister_template(&crypto_rfc4309_tmpl);
872 crypto_unregister_template(&crypto_ccm_tmpl); 873 crypto_unregister_template(&crypto_ccm_tmpl);
873 crypto_unregister_template(&crypto_ccm_base_tmpl); 874 crypto_unregister_template(&crypto_ccm_base_tmpl);
874 } 875 }
875 876
876 module_init(crypto_ccm_module_init); 877 module_init(crypto_ccm_module_init);
877 module_exit(crypto_ccm_module_exit); 878 module_exit(crypto_ccm_module_exit);
878 879
879 MODULE_LICENSE("GPL"); 880 MODULE_LICENSE("GPL");
880 MODULE_DESCRIPTION("Counter with CBC MAC"); 881 MODULE_DESCRIPTION("Counter with CBC MAC");
881 MODULE_ALIAS("ccm_base"); 882 MODULE_ALIAS("ccm_base");
882 MODULE_ALIAS("rfc4309"); 883 MODULE_ALIAS("rfc4309");
883 884