[PATCH 3.2 04/70] crypto: skcipher - Copy iv from desc even for 0-len walks

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!news.mixmin.net!weretis.net!feeder4.news.weretis.net!storethat.news.telefonica.de!telefonica.de!news.panservice.it!bofh.it!news.nic.it!robomod
From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	[PATCH 3.2 04/70] crypto: skcipher - Copy iv from desc even for 0-len walks
Date	Mon, 18 Jan 2016 04:40:03 +0100
Message-ID	<qS8PF-3ml-35@gated-at.bofh.it> (permalink)
References	<qS8FX-3hu-3@gated-at.bofh.it>
X-Original-To	linux-kernel@vger.kernel.org, stable@vger.kernel.org
Content-Type	text/plain; charset="UTF-8"
Content-Disposition	inline
Content-Transfer-Encoding	8bit
MIME-Version	1.0
X-Mailer	LinuxStableQueue (scripts by bwh)
X-Sa-Exim-Connect-IP	192.168.4.247
X-Sa-Exim-Mail-From	ben@decadent.org.uk
X-Sa-Exim-Scanned	No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	61
Organization	linux.* mail to news gateway
X-Original-Cc	akpm@linux-foundation.org, "Jason A. Donenfeld" <Jason@zx2c4.com>, "Herbert Xu" <herbert@gondor.apana.org.au>
X-Original-Date	Mon, 18 Jan 2016 03:18:35 +0000
X-Original-Message-ID	<lsq.1453087115.428829142@decadent.org.uk>
X-Original-References	<lsq.1453087114.713093519@decadent.org.uk>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1311275

Show key headers only | View raw

3.2.76-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

commit 70d906bc17500edfa9bdd8c8b7e59618c7911613 upstream.

Some ciphers actually support encrypting zero length plaintexts. For
example, many AEAD modes support this. The resulting ciphertext for
those winds up being only the authentication tag, which is a result of
the key, the iv, the additional data, and the fact that the plaintext
had zero length. The blkcipher constructors won't copy the IV to the
right place, however, when using a zero length input, resulting in
some significant problems when ciphers call their initialization
routines, only to find that the ->iv parameter is uninitialized. One
such example of this would be using chacha20poly1305 with a zero length
input, which then calls chacha20, which calls the key setup routine,
which eventually OOPSes due to the uninitialized ->iv member.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 crypto/ablkcipher.c | 2 +-
 crypto/blkcipher.c  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -280,12 +280,12 @@ static int ablkcipher_walk_first(struct
 	if (WARN_ON_ONCE(in_irq()))
 		return -EDEADLK;
 
+	walk->iv = req->info;
 	walk->nbytes = walk->total;
 	if (unlikely(!walk->total))
 		return 0;
 
 	walk->iv_buffer = NULL;
-	walk->iv = req->info;
 	if (unlikely(((unsigned long)walk->iv & alignmask))) {
 		int err = ablkcipher_copy_iv(walk, tfm, alignmask);
 		if (err)
--- a/crypto/blkcipher.c
+++ b/crypto/blkcipher.c
@@ -329,12 +329,12 @@ static int blkcipher_walk_first(struct b
 	if (WARN_ON_ONCE(in_irq()))
 		return -EDEADLK;
 
+	walk->iv = desc->info;
 	walk->nbytes = walk->total;
 	if (unlikely(!walk->total))
 		return 0;
 
 	walk->buffer = NULL;
-	walk->iv = desc->info;
 	if (unlikely(((unsigned long)walk->iv & alignmask))) {
 		int err = blkcipher_copy_iv(walk, tfm, alignmask);
 		if (err)

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3.2 04/70] crypto: skcipher - Copy iv from desc even for  0-len walks Ben Hutchings <ben@decadent.org.uk> - 2016-01-18 04:40 +0100

csiph-web