linux.git/crypto, branch v5.10.247

crypto: essiv - Check ssize for decryption and in-place encryption

2025-10-29T13:01:10+00:00

[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]

Move the ssize check to the start in essiv_aead_crypt so that
it's also checked for decryption and in-place encryption.

Reported-by: Muhammad Alifa Ramdhan 
Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: rng - Ensure set_ent is always present

2025-10-29T13:01:03+00:00

commit c0d36727bf39bb16ef0a67ed608e279535ebf0da upstream.

Ensure that set_ent is always set since only drbg provides it.

Fixes: 77ebdabe8de7 ("crypto: af_alg - add extra parameters for DRBG interface")
Reported-by: Yiqi Sun 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

2025-10-02T11:35:42+00:00

[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ]

Issuing two writes to the same af_alg socket is bogus as the
data will be interleaved in an unpredictable fashion.  Furthermore,
concurrent writes may create inconsistencies in the internal
socket state.

Disallow this by adding a new ctx->write field that indiciates
exclusive ownership for writing.

Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
Reported-by: Muhammad Alifa Ramdhan 
Reported-by: Bing-Jhong Billy Jheng 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: xts - Only add ecb if it is not already there

2025-06-27T10:04:01+00:00

[ Upstream commit 270b6f13454cb7f2f7058c50df64df409c5dcf55 ]

Only add ecb to the cipher name if it isn't already ecb.

Also use memcmp instead of strncmp since these strings are all
stored in an array of length CRYPTO_MAX_ALG_NAME.

Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher")
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: lrw - Only add ecb if it is not already there

2025-06-27T10:04:01+00:00

[ Upstream commit 3d73909bddc2ebb3224a8bc2e5ce00e9df70c15d ]

Only add ecb to the cipher name if it isn't already ecb.

Also use memcmp instead of strncmp since these strings are all
stored in an array of length CRYPTO_MAX_ALG_NAME.

Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher")
Reported-by: kernel test robot 
Closes: https://lore.kernel.org/oe-lkp/202505151503.d8a6cf10-lkp@intel.com
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: algif_hash - fix double free in hash_accept

2025-06-04T12:37:07+00:00

commit b2df03ed4052e97126267e8c13ad4204ea6ba9b6 upstream.

If accept(2) is called on socket type algif_hash with
MSG_MORE flag set and crypto_ahash_import fails,
sk2 is freed. However, it is also freed in af_alg_release,
leading to slab-use-after-free error.

Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations")
Cc: 
Signed-off-by: Ivan Pravdin 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

crypto: null - Use spin lock instead of mutex

2025-05-02T05:41:18+00:00

[ Upstream commit dcc47a028c24e793ce6d6efebfef1a1e92f80297 ]

As the null algorithm may be freed in softirq context through
af_alg, use spin locks instead of mutexes to protect the default
null algorithm.

Reported-by: syzbot+b3e02953598f447d4d2a@syzkaller.appspotmail.com
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: testmgr - some more fixes to RSA test vectors

2025-03-13T11:47:26+00:00

[ Upstream commit 9d2bb9a74b2877f100637d6ab5685bcd33c69d44 ]

Two more fixes:

  * some test vectors in commit 79e6e2f3f3ff ("crypto: testmgr - populate
    RSA CRT parameters in RSA test vectors") had misplaced commas, which
    break the test and trigger KASAN warnings at least on x86-64

  * pkcs1pad test vector did not have its CRT parameters

Fixes: 79e6e2f3f3ff ("crypto: testmgr - populate RSA CRT parameters in RSA test vectors")
Reported-by: Eric Biggers 
Signed-off-by: Ignat Korchagin 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: testmgr - populate RSA CRT parameters in RSA test vectors

2025-03-13T11:47:26+00:00

[ Upstream commit 79e6e2f3f3ff345947075341781e900e4f70db81 ]

Changes from v1:
  * replace some accidental spaces with tabs

In commit f145d411a67e ("crypto: rsa - implement Chinese Remainder Theorem
for faster private key operations") we have started to use the additional
primes and coefficients for RSA private key operations. However, these
additional parameters are not present (defined as 0 integers) in the RSA
test vectors.

Some parameters were borrowed from OpenSSL, so I was able to find the
source. I could not find the public source for 1 vector though, so had to
recover the parameters by implementing Appendix C from [1].

[1]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Br1.pdf

Fixes: f145d411a67e ("crypto: rsa - implement Chinese Remainder Theorem for faster private key operations")
Reported-by: Tasmiya Nalatwad 
Signed-off-by: Ignat Korchagin 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: testmgr - fix version number of RSA tests

2025-03-13T11:47:25+00:00

[ Upstream commit 0bb8f125253843c445b70fc6ef4fb21aa7b25625 ]

According to PKCS#1 standard, the 'otherPrimeInfos' field contains
the information for the additional primes r_3, ..., r_u, in order.
It shall be omitted if the version is 0 and shall contain at least
one instance of OtherPrimeInfo if the version is 1, see:
	https://www.rfc-editor.org/rfc/rfc3447#page-44

Replace the version number '1' with 0, otherwise, some drivers may
not pass the run-time tests.

Signed-off-by: lei he 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin