linux-stable.git/crypto/gcm.c, branch linux-3.2.y

crypto: gcm - wait for crypto op not signal safe

2017-09-15T17:30:47+00:00

commit f3ad587070d6bd961ab942b3fd7a85d00dfc934b upstream.

crypto_gcm_setkey() was using wait_for_completion_interruptible() to
wait for completion of async crypto op but if a signal occurs it
may return before DMA ops of HW crypto provider finish, thus
corrupting the data buffer that is kfree'ed in this case.

Resolve this by using wait_for_completion() instead.

Reported-by: Eric Biggers 
Signed-off-by: Gilad Ben-Yossef 
Signed-off-by: Herbert Xu 
Signed-off-by: Ben Hutchings

crypto: gcm - Fix IV buffer size in crypto_gcm_setkey

2017-02-23T03:50:52+00:00

commit 50d2e6dc1f83db0563c7d6603967bf9585ce934b upstream.

The cipher block size for GCM is 16 bytes, and thus the CTR transform
used in crypto_gcm_setkey() will also expect a 16-byte IV. However,
the code currently reserves only 8 bytes for the IV, causing
an out-of-bounds access in the CTR transform. This patch fixes
the issue by setting the size of the IV buffer to 16 bytes.

Fixes: 84c911523020 ("[CRYPTO] gcm: Add support for async ciphers")
Signed-off-by: Ondrej Mosnacek 
Signed-off-by: Herbert Xu 
Signed-off-by: Ben Hutchings

crypto: gcm - Filter out async ghash if necessary

2016-11-20T01:01:23+00:00

commit b30bdfa86431afbafe15284a3ad5ac19b49b88e3 upstream.

As it is if you ask for a sync gcm you may actually end up with
an async one because it does not filter out async implementations
of ghash.

This patch fixes this by adding the necessary filter when looking
for ghash.

Signed-off-by: Herbert Xu 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

crypto: gcm - Fix rfc4543 decryption crash

2016-06-15T20:28:10+00:00

This bug has already bee fixed upstream since 4.2.  However, it
was fixed during the AEAD conversion so no fix was backported to
the older kernels.

When we do an RFC 4543 decryption, we will end up writing the
ICV beyond the end of the dst buffer.  This should lead to a
crash but for some reason it was never noticed.

This patch fixes it by only writing back the ICV for encryption.

Fixes: d733ac90f9fe ("crypto: gcm - fix rfc4543 to handle async...")
Reported-by: Patrick Meyer 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

crypto: gcm - fix rfc4543 to handle async crypto correctly

2016-06-15T20:28:10+00:00

commit d733ac90f9fe8ac284e523f9920b507555b12f6d upstream.

If the gcm cipher used by rfc4543 does not complete request immediately,
the authentication tag is not copied to destination buffer. Patch adds
correct async logic for this case.

Signed-off-by: Jussi Kivilinna 
Signed-off-by: Herbert Xu 
Signed-off-by: Ben Hutchings

crypto: include crypto- module prefix in template

2015-02-20T00:49:36+00:00

commit 4943ba16bbc2db05115707b3ff7b4874e9e3c560 upstream.

This adds the module loading prefix "crypto-" to the template lookup
as well.

For example, attempting to load 'vfat(blowfish)' via AF_ALG now correctly
includes the "crypto-" prefix at every level, correctly rejecting "vfat":

	net-pf-38
	algif-hash
	crypto-vfat(blowfish)
	crypto-vfat(blowfish)-all
	crypto-vfat

Reported-by: Mathias Krause 
Signed-off-by: Kees Cook 
Acked-by: Mathias Krause 
Signed-off-by: Herbert Xu 
[bwh: Backported to 3.2: drop changes to cmac and mcryptd which we don't have]
Signed-off-by: Ben Hutchings

crypto: prefix module autoloading with "crypto-"

2015-02-20T00:49:36+00:00

commit 5d26a105b5a73e5635eae0629b42fa0a90e07b7b upstream.

This prefixes all crypto module loading with "crypto-" so we never run
the risk of exposing module auto-loading to userspace via a crypto API,
as demonstrated by Mathias Krause:

https://lkml.org/lkml/2013/3/4/70

Signed-off-by: Kees Cook 
Signed-off-by: Herbert Xu 
[bwh: Backported to 3.2:
 - Adjust filenames
 - Drop changes to algorithms and drivers we don't have
 - Add aliases to generic C implementations that didn't need them before]
Signed-off-by: Ben Hutchings

crypto: gcm - fix assumption that assoc has one segment

2013-04-25T19:25:31+00:00

commit d3dde52209ab571e4e2ec26c66f85ad1355f7475 upstream.

rfc4543(gcm(*)) code for GMAC assumes that assoc scatterlist always contains
only one segment and only makes use of this first segment. However ipsec passes
assoc with three segments when using 'extended sequence number' thus in this
case rfc4543(gcm(*)) fails to function correctly. Patch fixes this issue.

Reported-by: Chaoxing Lin 
Tested-by: Chaoxing Lin 
Signed-off-by: Jussi Kivilinna 
Signed-off-by: Herbert Xu 
Signed-off-by: Ben Hutchings

crypto: Use scatterwalk_crypto_chain

2010-12-02T06:47:16+00:00

Use scatterwalk_crypto_chain in favor of locally defined chaining functions.

Signed-off-by: Steffen Klassert 
Signed-off-by: Herbert Xu

crypto: gcm - Add RFC4543 wrapper for GCM

2010-01-17T10:52:11+00:00

This patch adds the RFC4543 (GMAC) wrapper for GCM similar to the
existing RFC4106 wrapper. The main differences between GCM and GMAC are
the contents of the AAD and that the plaintext is empty for the latter.

Signed-off-by: Tobias Brunner 
Signed-off-by: Herbert Xu