linux.git/crypto/gcm.c, branch v4.19.151

crypto: gcm - fix incompatibility between "gcm" and "gcm_base"

2019-05-22T05:37:37+00:00

commit f699594d436960160f6d5ba84ed4a222f20d11cd upstream.

GCM instances can be created by either the "gcm" template, which only
allows choosing the block cipher, e.g. "gcm(aes)"; or by "gcm_base",
which allows choosing the ctr and ghash implementations, e.g.
"gcm_base(ctr(aes-generic),ghash-generic)".

However, a "gcm_base" instance prevents a "gcm" instance from being
registered using the same implementations.  Nor will the instance be
found by lookups of "gcm".  This can be used as a denial of service.
Moreover, "gcm_base" instances are never tested by the crypto
self-tests, even if there are compatible "gcm" tests.

The root cause of these problems is that instances of the two templates
use different cra_names.  Therefore, fix these problems by making
"gcm_base" instances set the same cra_name as "gcm" instances, e.g.
"gcm(aes)" instead of "gcm_base(ctr(aes-generic),ghash-generic)".

This requires extracting the block cipher name from the name of the ctr
algorithm.  It also requires starting to verify that the algorithms are
really ctr and ghash, not something else entirely.  But it would be
bizarre if anyone were actually using non-gcm-compatible algorithms with
gcm_base, so this shouldn't break anyone in practice.

Fixes: d00aa19b507b ("[CRYPTO] gcm: Allow block cipher parameter")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

crypto: null - Get rid of crypto_{get,put}_default_null_skcipher2()

2017-12-22T08:29:08+00:00

Since commit 499a66e6b689 ("crypto: null - Remove default null
blkcipher"), crypto_get_default_null_skcipher2() and
crypto_put_default_null_skcipher2() are the same as their non-2
equivalents.  So switch callers of the "2" versions over to the original
versions and remove the "2" versions.

Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu

crypto: gcm - move to generic async completion

2017-11-03T14:11:19+00:00

gcm is starting an async. crypto op and waiting for it complete.
Move it over to generic code doing the same.

Signed-off-by: Gilad Ben-Yossef 
Signed-off-by: Herbert Xu

crypto: gcm - Use GCM IV size constant

2017-09-22T09:43:13+00:00

This patch replace GCM IV size value by their constant name.

Signed-off-by: Corentin Labbe 
Signed-off-by: Herbert Xu

crypto: gcm - wait for crypto op not signal safe

2017-05-23T04:45:11+00:00

crypto_gcm_setkey() was using wait_for_completion_interruptible() to
wait for completion of async crypto op but if a signal occurs it
may return before DMA ops of HW crypto provider finish, thus
corrupting the data buffer that is kfree'ed in this case.

Resolve this by using wait_for_completion() instead.

Reported-by: Eric Biggers 
Signed-off-by: Gilad Ben-Yossef 
CC: stable@vger.kernel.org
Signed-off-by: Herbert Xu

crypto: skcipher - Get rid of crypto_spawn_skcipher2()

2016-11-01T00:37:17+00:00

Since commit 3a01d0ee2b99 ("crypto: skcipher - Remove top-level
givcipher interface"), crypto_spawn_skcipher2() and
crypto_spawn_skcipher() are equivalent.  So switch callers of
crypto_spawn_skcipher2() to crypto_spawn_skcipher() and remove it.

Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu

crypto: skcipher - Get rid of crypto_grab_skcipher2()

2016-11-01T00:37:16+00:00

Since commit 3a01d0ee2b99 ("crypto: skcipher - Remove top-level
givcipher interface"), crypto_grab_skcipher2() and
crypto_grab_skcipher() are equivalent.  So switch callers of
crypto_grab_skcipher2() to crypto_grab_skcipher() and remove it.

Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu

crypto: gcm - Fix error return code in crypto_gcm_create_common()

2016-10-25T03:08:19+00:00

Fix to return error code -EINVAL from the invalid alg ivsize error
handling case instead of 0, as done elsewhere in this function.

Signed-off-by: Wei Yongjun 
Signed-off-by: Herbert Xu

crypto: gcm - Fix IV buffer size in crypto_gcm_setkey

2016-10-02T14:31:52+00:00

The cipher block size for GCM is 16 bytes, and thus the CTR transform
used in crypto_gcm_setkey() will also expect a 16-byte IV. However,
the code currently reserves only 8 bytes for the IV, causing
an out-of-bounds access in the CTR transform. This patch fixes
the issue by setting the size of the IV buffer to 16 bytes.

Fixes: 84c911523020 ("[CRYPTO] gcm: Add support for async ciphers")
Signed-off-by: Ondrej Mosnacek 
Signed-off-by: Herbert Xu

crypto: gcm - Use skcipher

2016-07-18T09:35:40+00:00

This patch converts gcm to use the new skcipher interface as opposed
to ablkcipher.

Signed-off-by: Herbert Xu