linux.git/crypto, branch v5.4.302

crypto: essiv - Check ssize for decryption and in-place encryption

2025-10-29T12:59:52+00:00

[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]

Move the ssize check to the start in essiv_aead_crypt so that
it's also checked for decryption and in-place encryption.

Reported-by: Muhammad Alifa Ramdhan 
Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: algif_hash - fix double free in hash_accept

2025-06-04T12:32:35+00:00

commit b2df03ed4052e97126267e8c13ad4204ea6ba9b6 upstream.

If accept(2) is called on socket type algif_hash with
MSG_MORE flag set and crypto_ahash_import fails,
sk2 is freed. However, it is also freed in af_alg_release,
leading to slab-use-after-free error.

Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations")
Cc: 
Signed-off-by: Ivan Pravdin 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

crypto: null - Use spin lock instead of mutex

2025-05-02T05:39:27+00:00

[ Upstream commit dcc47a028c24e793ce6d6efebfef1a1e92f80297 ]

As the null algorithm may be freed in softirq context through
af_alg, use spin locks instead of mutexes to protect the default
null algorithm.

Reported-by: syzbot+b3e02953598f447d4d2a@syzkaller.appspotmail.com
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: testmgr - some more fixes to RSA test vectors

2025-03-13T11:43:21+00:00

[ Upstream commit 9d2bb9a74b2877f100637d6ab5685bcd33c69d44 ]

Two more fixes:

  * some test vectors in commit 79e6e2f3f3ff ("crypto: testmgr - populate
    RSA CRT parameters in RSA test vectors") had misplaced commas, which
    break the test and trigger KASAN warnings at least on x86-64

  * pkcs1pad test vector did not have its CRT parameters

Fixes: 79e6e2f3f3ff ("crypto: testmgr - populate RSA CRT parameters in RSA test vectors")
Reported-by: Eric Biggers 
Signed-off-by: Ignat Korchagin 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: testmgr - populate RSA CRT parameters in RSA test vectors

2025-03-13T11:43:20+00:00

[ Upstream commit 79e6e2f3f3ff345947075341781e900e4f70db81 ]

Changes from v1:
  * replace some accidental spaces with tabs

In commit f145d411a67e ("crypto: rsa - implement Chinese Remainder Theorem
for faster private key operations") we have started to use the additional
primes and coefficients for RSA private key operations. However, these
additional parameters are not present (defined as 0 integers) in the RSA
test vectors.

Some parameters were borrowed from OpenSSL, so I was able to find the
source. I could not find the public source for 1 vector though, so had to
recover the parameters by implementing Appendix C from [1].

[1]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Br1.pdf

Fixes: f145d411a67e ("crypto: rsa - implement Chinese Remainder Theorem for faster private key operations")
Reported-by: Tasmiya Nalatwad 
Signed-off-by: Ignat Korchagin 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: testmgr - fix version number of RSA tests

2025-03-13T11:43:20+00:00

[ Upstream commit 0bb8f125253843c445b70fc6ef4fb21aa7b25625 ]

According to PKCS#1 standard, the 'otherPrimeInfos' field contains
the information for the additional primes r_3, ..., r_u, in order.
It shall be omitted if the version is 0 and shall contain at least
one instance of OtherPrimeInfo if the version is 1, see:
	https://www.rfc-editor.org/rfc/rfc3447#page-44

Replace the version number '1' with 0, otherwise, some drivers may
not pass the run-time tests.

Signed-off-by: lei he 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: testmgr - Fix wrong test case of RSA

2025-03-13T11:43:20+00:00

[ Upstream commit a9887010ed2da3fddaff83ceec80e2b71be8a966 ]

According to the BER encoding rules, integer value should be encoded
as two's complement, and if the highest bit of a positive integer
is 1, should add a leading zero-octet.

The kernel's built-in RSA algorithm cannot recognize negative numbers
when parsing keys, so it can pass this test case.

Export the key to file and run the following command to verify the
fix result:

  openssl asn1parse -inform DER -in /path/to/key/file

Signed-off-by: Lei He 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: testmgr - fix wrong key length for pkcs1pad

2025-03-13T11:43:20+00:00

[ Upstream commit 39ef08517082a424b5b65c3dbaa6c0fa9d3303b9 ]

Fix wrong test data at testmgr.h, it seems to be caused
by ignoring the last '\0' when calling sizeof.

Signed-off-by: Lei He 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY

2024-12-14T18:44:23+00:00

[ Upstream commit 662f2f13e66d3883b9238b0b96b17886179e60e2 ]

Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for
PADATA_RESET"), the pcrypt encryption and decryption operations return
-EAGAIN when the CPU goes online or offline. In alg_test(), a WARN is
generated when pcrypt_aead_decrypt() or pcrypt_aead_encrypt() returns
-EAGAIN, the unnecessary panic will occur when panic_on_warn set 1.
Fix this issue by calling crypto layer directly without parallelization
in that case.

Fixes: 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET")
Signed-off-by: Yi Yang 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: aead,cipher - zeroize key buffer after use

2024-11-08T15:20:33+00:00

commit 23e4099bdc3c8381992f9eb975c79196d6755210 upstream.

I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding
cryptographic information should be zeroized once they are no longer
needed. Accomplish this by using kfree_sensitive for buffers that
previously held the private key.

Signed-off-by: Hailey Mothershead 
Signed-off-by: Herbert Xu 
Signed-off-by: Hugo SIMELIERE 
Signed-off-by: Greg Kroah-Hartman