lkml.org 
[lkml]   [2016]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.13.y-ckt 043/108] crypto: skcipher - Copy iv from desc even for 0-len walks
    Date
    3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: "Jason A. Donenfeld" <Jason@zx2c4.com>

    commit 70d906bc17500edfa9bdd8c8b7e59618c7911613 upstream.

    Some ciphers actually support encrypting zero length plaintexts. For
    example, many AEAD modes support this. The resulting ciphertext for
    those winds up being only the authentication tag, which is a result of
    the key, the iv, the additional data, and the fact that the plaintext
    had zero length. The blkcipher constructors won't copy the IV to the
    right place, however, when using a zero length input, resulting in
    some significant problems when ciphers call their initialization
    routines, only to find that the ->iv parameter is uninitialized. One
    such example of this would be using chacha20poly1305 with a zero length
    input, which then calls chacha20, which calls the key setup routine,
    which eventually OOPSes due to the uninitialized ->iv member.

    Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    crypto/ablkcipher.c | 2 +-
    crypto/blkcipher.c | 2 +-
    2 files changed, 2 insertions(+), 2 deletions(-)

    diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
    index 520729d..f02fdbe 100644
    --- a/crypto/ablkcipher.c
    +++ b/crypto/ablkcipher.c
    @@ -276,12 +276,12 @@ static int ablkcipher_walk_first(struct ablkcipher_request *req,
    if (WARN_ON_ONCE(in_irq()))
    return -EDEADLK;

    + walk->iv = req->info;
    walk->nbytes = walk->total;
    if (unlikely(!walk->total))
    return 0;

    walk->iv_buffer = NULL;
    - walk->iv = req->info;
    if (unlikely(((unsigned long)walk->iv & alignmask))) {
    int err = ablkcipher_copy_iv(walk, tfm, alignmask);
    if (err)
    diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
    index a79e7e9..fd4aec7 100644
    --- a/crypto/blkcipher.c
    +++ b/crypto/blkcipher.c
    @@ -329,12 +329,12 @@ static int blkcipher_walk_first(struct blkcipher_desc *desc,
    if (WARN_ON_ONCE(in_irq()))
    return -EDEADLK;

    + walk->iv = desc->info;
    walk->nbytes = walk->total;
    if (unlikely(!walk->total))
    return 0;

    walk->buffer = NULL;
    - walk->iv = desc->info;
    if (unlikely(((unsigned long)walk->iv & alignmask))) {
    int err = blkcipher_copy_iv(walk, tfm, alignmask);
    if (err)
    --
    1.9.1
    \
     
     \ /
      Last update: 2016-01-23 01:41    [W:4.378 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site