linux-stable.git/crypto/blkcipher.c, branch v3.2.83

crypto: {blk,giv}cipher: Set has_setkey

2016-04-01T00:54:31+00:00

Commit a1383cd86a06 ("crypto: skcipher - Add crypto_skcipher_has_setkey")
was incorrectly backported to the 3.2.y and 3.16.y stable branches.
We need to set ablkcipher_tfm::has_setkey in the
crypto_init_blkcipher_ops_async() and crypto_init_givcipher_ops()
functions as well as crypto_init_ablkcipher_ops().

Signed-off-by: Ben Hutchings

crypto: skcipher - Copy iv from desc even for 0-len walks

2016-01-22T21:40:03+00:00

commit 70d906bc17500edfa9bdd8c8b7e59618c7911613 upstream.

Some ciphers actually support encrypting zero length plaintexts. For
example, many AEAD modes support this. The resulting ciphertext for
those winds up being only the authentication tag, which is a result of
the key, the iv, the additional data, and the fact that the plaintext
had zero length. The blkcipher constructors won't copy the IV to the
right place, however, when using a zero length input, resulting in
some significant problems when ciphers call their initialization
routines, only to find that the ->iv parameter is uninitialized. One
such example of this would be using chacha20poly1305 with a zero length
input, which then calls chacha20, which calls the key setup routine,
which eventually OOPSes due to the uninitialized ->iv member.

Signed-off-by: Jason A. Donenfeld 
Signed-off-by: Herbert Xu 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

crypto: user - fix info leaks in report API

2013-03-20T15:03:37+00:00

commit 9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6 upstream.

Three errors resulting in kernel memory disclosure:

1/ The structures used for the netlink based crypto algorithm report API
are located on the stack. As snprintf() does not fill the remainder of
the buffer with null bytes, those stack bytes will be disclosed to users
of the API. Switch to strncpy() to fix this.

2/ crypto_report_one() does not initialize all field of struct
crypto_user_alg. Fix this to fix the heap info leak.

3/ For the module name we should copy only as many bytes as
module_name() returns -- not as much as the destination buffer could
hold. But the current code does not and therefore copies random data
from behind the end of the module name, as the module name is always
shorter than CRYPTO_MAX_ALG_NAME.

Also switch to use strncpy() to copy the algorithm's name and
driver_name. They are strings, after all.

Signed-off-by: Mathias Krause 
Cc: Steffen Klassert 
Signed-off-by: Herbert Xu 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

crypto: algapi - Fix build problem with NET disabled

2011-11-10T22:57:06+00:00

The report functions use NLA_PUT so we need to ensure that NET
is enabled.

Reported-by: Luis Henriques 
Signed-off-by: Herbert Xu

crypto: Add userspace report for blkcipher type algorithms

2011-10-21T12:24:05+00:00

Signed-off-by: Steffen Klassert 
Signed-off-by: Herbert Xu

mm: strictly nested kmap_atomic()

2010-10-26T23:52:08+00:00

Ensure kmap_atomic() usage is strictly nested

Signed-off-by: Peter Zijlstra 
Reviewed-by: Rik van Riel 
Acked-by: Chris Metcalf 
Cc: David Howells 
Cc: Hugh Dickins 
Cc: Ingo Molnar 
Cc: Thomas Gleixner 
Cc: "H. Peter Anvin" 
Cc: Steven Rostedt 
Cc: Russell King 
Cc: Ralf Baechle 
Cc: David Miller 
Cc: Paul Mackerras 
Cc: Benjamin Herrenschmidt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

crypto: skcipher - Avoid infinite loop when cipher fails selftest

2009-02-18T13:20:06+00:00

When an skcipher constructed through crypto_givcipher_default fails
its selftest, we'll loop forever trying to construct new skcipher
objects but failing because it already exists.

The crux of the issue is that once a givcipher fails the selftest,
we'll ignore it on the next run through crypto_skcipher_lookup and
attempt to construct a new givcipher.

We should instead return an error to the caller if we find a
givcipher that has failed the test.

Signed-off-by: Herbert Xu

crypto: blkcipher - Fix WARN_ON handling in walk_done

2009-01-27T06:11:13+00:00

When we get left-over bits from a slow walk, it means that the
underlying cipher has gone troppo.  However, as we're handling
that case we should ensure that the caller terminates the walk.

This patch does this by setting walk->nbytes to zero.

Reported-by: Roel Kluin 
Reported-by: Huang Ying 
Signed-off-by: Herbert Xu

crypto: skcipher - Move IV generators into their own modules

2008-08-29T05:50:00+00:00

This patch moves the default IV generators into their own modules
in order to break a dependency loop between cryptomgr, rng, and
blkcipher.

Signed-off-by: Herbert Xu

[CRYPTO] skcipher: Move chainiv/seqiv into crypto_blkcipher module

2008-02-23T03:12:06+00:00

For compatibility with dm-crypt initramfs setups it is useful to merge
chainiv/seqiv into the crypto_blkcipher module.  Since they're required
by most algorithms anyway this is an acceptable trade-off.

Signed-off-by: Herbert Xu