mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
![Eric Biggers](/assets/img/avatar_default.png)
commit5c6bc4dfa5
upstream. Changing ghash_mod_init() to be subsys_initcall made it start running before the alignment fault handler has been installed on ARM. In kernel builds where the keys in the ghash test vectors happened to be misaligned in the kernel image, this exposed the longstanding bug that ghash_setkey() is incorrectly casting the key buffer (which can have any alignment) to be128 for passing to gf128mul_init_4k_lle(). Fix this by memcpy()ing the key to a temporary buffer. Don't fix it by setting an alignmask on the algorithm instead because that would unnecessarily force alignment of the data too. Fixes:2cdc6899a8
("crypto: ghash - Add GHASH digest algorithm for GCM") Reported-by: Peter Robinson <pbrobinson@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Tested-by: Peter Robinson <pbrobinson@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
171 lines
3.8 KiB
C
171 lines
3.8 KiB
C
/*
|
|
* GHASH: digest algorithm for GCM (Galois/Counter Mode).
|
|
*
|
|
* Copyright (c) 2007 Nokia Siemens Networks - Mikko Herranen <mh1@iki.fi>
|
|
* Copyright (c) 2009 Intel Corp.
|
|
* Author: Huang Ying <ying.huang@intel.com>
|
|
*
|
|
* The algorithm implementation is copied from gcm.c.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 as published
|
|
* by the Free Software Foundation.
|
|
*/
|
|
|
|
#include <crypto/algapi.h>
|
|
#include <crypto/gf128mul.h>
|
|
#include <crypto/ghash.h>
|
|
#include <crypto/internal/hash.h>
|
|
#include <linux/crypto.h>
|
|
#include <linux/init.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/module.h>
|
|
|
|
static int ghash_init(struct shash_desc *desc)
|
|
{
|
|
struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
|
|
|
|
memset(dctx, 0, sizeof(*dctx));
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int ghash_setkey(struct crypto_shash *tfm,
|
|
const u8 *key, unsigned int keylen)
|
|
{
|
|
struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
|
|
be128 k;
|
|
|
|
if (keylen != GHASH_BLOCK_SIZE) {
|
|
crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (ctx->gf128)
|
|
gf128mul_free_4k(ctx->gf128);
|
|
|
|
BUILD_BUG_ON(sizeof(k) != GHASH_BLOCK_SIZE);
|
|
memcpy(&k, key, GHASH_BLOCK_SIZE); /* avoid violating alignment rules */
|
|
ctx->gf128 = gf128mul_init_4k_lle(&k);
|
|
memzero_explicit(&k, GHASH_BLOCK_SIZE);
|
|
|
|
if (!ctx->gf128)
|
|
return -ENOMEM;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int ghash_update(struct shash_desc *desc,
|
|
const u8 *src, unsigned int srclen)
|
|
{
|
|
struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
|
|
struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
|
|
u8 *dst = dctx->buffer;
|
|
|
|
if (!ctx->gf128)
|
|
return -ENOKEY;
|
|
|
|
if (dctx->bytes) {
|
|
int n = min(srclen, dctx->bytes);
|
|
u8 *pos = dst + (GHASH_BLOCK_SIZE - dctx->bytes);
|
|
|
|
dctx->bytes -= n;
|
|
srclen -= n;
|
|
|
|
while (n--)
|
|
*pos++ ^= *src++;
|
|
|
|
if (!dctx->bytes)
|
|
gf128mul_4k_lle((be128 *)dst, ctx->gf128);
|
|
}
|
|
|
|
while (srclen >= GHASH_BLOCK_SIZE) {
|
|
crypto_xor(dst, src, GHASH_BLOCK_SIZE);
|
|
gf128mul_4k_lle((be128 *)dst, ctx->gf128);
|
|
src += GHASH_BLOCK_SIZE;
|
|
srclen -= GHASH_BLOCK_SIZE;
|
|
}
|
|
|
|
if (srclen) {
|
|
dctx->bytes = GHASH_BLOCK_SIZE - srclen;
|
|
while (srclen--)
|
|
*dst++ ^= *src++;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
|
|
{
|
|
u8 *dst = dctx->buffer;
|
|
|
|
if (dctx->bytes) {
|
|
u8 *tmp = dst + (GHASH_BLOCK_SIZE - dctx->bytes);
|
|
|
|
while (dctx->bytes--)
|
|
*tmp++ ^= 0;
|
|
|
|
gf128mul_4k_lle((be128 *)dst, ctx->gf128);
|
|
}
|
|
|
|
dctx->bytes = 0;
|
|
}
|
|
|
|
static int ghash_final(struct shash_desc *desc, u8 *dst)
|
|
{
|
|
struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
|
|
struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
|
|
u8 *buf = dctx->buffer;
|
|
|
|
if (!ctx->gf128)
|
|
return -ENOKEY;
|
|
|
|
ghash_flush(ctx, dctx);
|
|
memcpy(dst, buf, GHASH_BLOCK_SIZE);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void ghash_exit_tfm(struct crypto_tfm *tfm)
|
|
{
|
|
struct ghash_ctx *ctx = crypto_tfm_ctx(tfm);
|
|
if (ctx->gf128)
|
|
gf128mul_free_4k(ctx->gf128);
|
|
}
|
|
|
|
static struct shash_alg ghash_alg = {
|
|
.digestsize = GHASH_DIGEST_SIZE,
|
|
.init = ghash_init,
|
|
.update = ghash_update,
|
|
.final = ghash_final,
|
|
.setkey = ghash_setkey,
|
|
.descsize = sizeof(struct ghash_desc_ctx),
|
|
.base = {
|
|
.cra_name = "ghash",
|
|
.cra_driver_name = "ghash-generic",
|
|
.cra_priority = 100,
|
|
.cra_flags = CRYPTO_ALG_TYPE_SHASH,
|
|
.cra_blocksize = GHASH_BLOCK_SIZE,
|
|
.cra_ctxsize = sizeof(struct ghash_ctx),
|
|
.cra_module = THIS_MODULE,
|
|
.cra_exit = ghash_exit_tfm,
|
|
},
|
|
};
|
|
|
|
static int __init ghash_mod_init(void)
|
|
{
|
|
return crypto_register_shash(&ghash_alg);
|
|
}
|
|
|
|
static void __exit ghash_mod_exit(void)
|
|
{
|
|
crypto_unregister_shash(&ghash_alg);
|
|
}
|
|
|
|
module_init(ghash_mod_init);
|
|
module_exit(ghash_mod_exit);
|
|
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_DESCRIPTION("GHASH Message Digest Algorithm");
|
|
MODULE_ALIAS_CRYPTO("ghash");
|
|
MODULE_ALIAS_CRYPTO("ghash-generic");
|