lkml.org 
[lkml]   [2016]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 080/117] crypto: algif_skcipher - Require setkey before accept(2)
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Herbert Xu <herbert@gondor.apana.org.au>

    commit dd504589577d8e8e70f51f997ad487a4cb6c026f upstream.

    Some cipher implementations will crash if you try to use them
    without calling setkey first. This patch adds a check so that
    the accept(2) call will fail with -ENOKEY if setkey hasn't been
    done on the socket yet.

    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Tested-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    crypto/algif_skcipher.c | 48 +++++++++++++++++++++++++++++++++++++++++-------
    1 file changed, 41 insertions(+), 7 deletions(-)

    --- a/crypto/algif_skcipher.c
    +++ b/crypto/algif_skcipher.c
    @@ -31,6 +31,11 @@ struct skcipher_sg_list {
    struct scatterlist sg[0];
    };

    +struct skcipher_tfm {
    + struct crypto_skcipher *skcipher;
    + bool has_key;
    +};
    +
    struct skcipher_ctx {
    struct list_head tsgl;
    struct af_alg_sgl rsgl;
    @@ -750,17 +755,41 @@ static struct proto_ops algif_skcipher_o

    static void *skcipher_bind(const char *name, u32 type, u32 mask)
    {
    - return crypto_alloc_skcipher(name, type, mask);
    + struct skcipher_tfm *tfm;
    + struct crypto_skcipher *skcipher;
    +
    + tfm = kzalloc(sizeof(*tfm), GFP_KERNEL);
    + if (!tfm)
    + return ERR_PTR(-ENOMEM);
    +
    + skcipher = crypto_alloc_skcipher(name, type, mask);
    + if (IS_ERR(skcipher)) {
    + kfree(tfm);
    + return ERR_CAST(skcipher);
    + }
    +
    + tfm->skcipher = skcipher;
    +
    + return tfm;
    }

    static void skcipher_release(void *private)
    {
    - crypto_free_skcipher(private);
    + struct skcipher_tfm *tfm = private;
    +
    + crypto_free_skcipher(tfm->skcipher);
    + kfree(tfm);
    }

    static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen)
    {
    - return crypto_skcipher_setkey(private, key, keylen);
    + struct skcipher_tfm *tfm = private;
    + int err;
    +
    + err = crypto_skcipher_setkey(tfm->skcipher, key, keylen);
    + tfm->has_key = !err;
    +
    + return err;
    }

    static void skcipher_wait(struct sock *sk)
    @@ -792,20 +821,25 @@ static int skcipher_accept_parent(void *
    {
    struct skcipher_ctx *ctx;
    struct alg_sock *ask = alg_sk(sk);
    - unsigned int len = sizeof(*ctx) + crypto_skcipher_reqsize(private);
    + struct skcipher_tfm *tfm = private;
    + struct crypto_skcipher *skcipher = tfm->skcipher;
    + unsigned int len = sizeof(*ctx) + crypto_skcipher_reqsize(skcipher);
    +
    + if (!tfm->has_key)
    + return -ENOKEY;

    ctx = sock_kmalloc(sk, len, GFP_KERNEL);
    if (!ctx)
    return -ENOMEM;

    - ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(private),
    + ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(skcipher),
    GFP_KERNEL);
    if (!ctx->iv) {
    sock_kfree_s(sk, ctx, len);
    return -ENOMEM;
    }

    - memset(ctx->iv, 0, crypto_skcipher_ivsize(private));
    + memset(ctx->iv, 0, crypto_skcipher_ivsize(skcipher));

    INIT_LIST_HEAD(&ctx->tsgl);
    ctx->len = len;
    @@ -818,7 +852,7 @@ static int skcipher_accept_parent(void *

    ask->private = ctx;

    - skcipher_request_set_tfm(&ctx->req, private);
    + skcipher_request_set_tfm(&ctx->req, skcipher);
    skcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
    af_alg_complete, &ctx->completion);


    \
     
     \ /
      Last update: 2016-02-15 02:01    [W:4.161 / U:0.216 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site