[v2,1/2] crypto: caam - fix pkcs1pad(rsa-caam, sha256) failure because of invalid input
diff mbox series

Message ID 1557919546-360-1-git-send-email-iuliana.prodan@nxp.com
State Changes Requested
Delegated to: Herbert Xu
Headers show
Series
  • [v2,1/2] crypto: caam - fix pkcs1pad(rsa-caam, sha256) failure because of invalid input
Related show

Commit Message

Iuliana Prodan May 15, 2019, 11:25 a.m. UTC
The problem is with the input data size sent to CAAM for encrypt/decrypt.
Pkcs1pad is failing due to pkcs1 padding done in SW starting with0x01
instead of 0x00 0x01.
CAAM expects an input of modulus size. For this we strip the leading
zeros in case the size is more than modulus or pad the input with zeros
until the modulus size is reached.

Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
---
Changes since V1:
	- remove not needed initialization of a variable;
	- free resources on error path.
---
 drivers/crypto/caam/caampkc.c | 84 +++++++++++++++++++++++++++++++++++--------
 drivers/crypto/caam/caampkc.h |  2 ++
 2 files changed, 72 insertions(+), 14 deletions(-)

Comments

Horia Geanta May 15, 2019, 12:45 p.m. UTC | #1
On 5/15/2019 2:25 PM, Iuliana Prodan wrote:
> The problem is with the input data size sent to CAAM for encrypt/decrypt.
> Pkcs1pad is failing due to pkcs1 padding done in SW starting with0x01
> instead of 0x00 0x01.
> CAAM expects an input of modulus size. For this we strip the leading
> zeros in case the size is more than modulus or pad the input with zeros
> until the modulus size is reached.
> 
> Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>

Thanks,
Horia
Herbert Xu May 23, 2019, 6:12 a.m. UTC | #2
On Wed, May 15, 2019 at 02:25:45PM +0300, Iuliana Prodan wrote:
>
> @@ -1058,6 +1105,14 @@ static int __init caam_pkc_init(void)
>  		goto out_put_dev;
>  	}
>  
> +	/* allocate zero buffer, used for padding input */
> +	zero_buffer = kzalloc(CAAM_RSA_MAX_INPUT_SIZE - 1, GFP_DMA |
> +			      GFP_KERNEL);
> +	if (!zero_buffer) {
> +		err = -ENOMEM;
> +		goto out_put_dev;
> +	}
> +
>  	err = crypto_register_akcipher(&caam_rsa);
>  	if (err)
>  		dev_warn(ctrldev, "%s alg registration failed\n",

This patch does not apply on top of the caam patch-series from Horia.
You're also going to leak zero_buffer if crypto_register_akcipher
fails.

Cheers,
Iuliana Prodan May 23, 2019, 8:08 a.m. UTC | #3
On 5/23/2019 9:12 AM, Herbert Xu wrote:
> On Wed, May 15, 2019 at 02:25:45PM +0300, Iuliana Prodan wrote:
>>
>> @@ -1058,6 +1105,14 @@ static int __init caam_pkc_init(void)
>>   		goto out_put_dev;
>>   	}
>>   
>> +	/* allocate zero buffer, used for padding input */
>> +	zero_buffer = kzalloc(CAAM_RSA_MAX_INPUT_SIZE - 1, GFP_DMA |
>> +			      GFP_KERNEL);
>> +	if (!zero_buffer) {
>> +		err = -ENOMEM;
>> +		goto out_put_dev;
>> +	}
>> +
>>   	err = crypto_register_akcipher(&caam_rsa);
>>   	if (err)
>>   		dev_warn(ctrldev, "%s alg registration failed\n",
> 
> This patch does not apply on top of the caam patch-series from Horia.
> You're also going to leak zero_buffer if crypto_register_akcipher
> fails.
> 
> Cheers,
> 

I'll fix the conflicts and also the leak of zero_buffer if 
crypto_register_akcipher fails and send a new version.

Regards,
Iulia
Horia Geanta May 23, 2019, 10:02 a.m. UTC | #4
On 5/23/2019 9:12 AM, Herbert Xu wrote:
> On Wed, May 15, 2019 at 02:25:45PM +0300, Iuliana Prodan wrote:
>>
>> @@ -1058,6 +1105,14 @@ static int __init caam_pkc_init(void)
>>  		goto out_put_dev;
>>  	}
>>  
>> +	/* allocate zero buffer, used for padding input */
>> +	zero_buffer = kzalloc(CAAM_RSA_MAX_INPUT_SIZE - 1, GFP_DMA |
>> +			      GFP_KERNEL);
>> +	if (!zero_buffer) {
>> +		err = -ENOMEM;
>> +		goto out_put_dev;
>> +	}
>> +
>>  	err = crypto_register_akcipher(&caam_rsa);
>>  	if (err)
>>  		dev_warn(ctrldev, "%s alg registration failed\n",
> 
> This patch does not apply on top of the caam patch-series from Horia.
The patch was considered a fix, and thus developed on top of crypto-2.6.
I guess you are implicitly asking to resubmit based on cryptodev-2.6, correct?

> You're also going to leak zero_buffer if crypto_register_akcipher
> fails.
> 
When crypto_register_akcipher fails, it merely prints a warning and falls
through (does not immediately return), thus there's no leak.

Thanks,
Horia
Herbert Xu May 23, 2019, 12:38 p.m. UTC | #5
On Thu, May 23, 2019 at 10:02:41AM +0000, Horia Geanta wrote:
>
> When crypto_register_akcipher fails, it merely prints a warning and falls
> through (does not immediately return), thus there's no leak.

How can this work? Wouldn't the exit path then unregister a bunch of
unregistered algorithms and crash?

Cheers,
Horia Geanta May 24, 2019, 6:52 a.m. UTC | #6
On 5/23/2019 3:38 PM, Herbert Xu wrote:
> On Thu, May 23, 2019 at 10:02:41AM +0000, Horia Geanta wrote:
>>
>> When crypto_register_akcipher fails, it merely prints a warning and falls
>> through (does not immediately return), thus there's no leak.
> 
> How can this work? Wouldn't the exit path then unregister a bunch of
> unregistered algorithms and crash?
> 
You're actually right.
zero_buffer is leaked in case crypto_register_akcipher fails.

Besides this, there is an existing issue (independent of current patch) with
algorithm registration: algorithms (in fact, rsa) are unregistered even if
registration might have failed.
This should be addressed separately.

Thanks,
Horia

Patch
diff mbox series

diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index fe24485..e356413 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -24,6 +24,10 @@ 
 				 sizeof(struct rsa_priv_f2_pdb))
 #define DESC_RSA_PRIV_F3_LEN	(2 * CAAM_CMD_SZ + \
 				 sizeof(struct rsa_priv_f3_pdb))
+#define CAAM_RSA_MAX_INPUT_SIZE	512 /* for a 4096-bit modulus */
+
+/* buffer filled with zeros, used for padding */
+static u8 *zero_buffer;
 
 static void rsa_io_unmap(struct device *dev, struct rsa_edesc *edesc,
 			 struct akcipher_request *req)
@@ -168,6 +172,13 @@  static void rsa_priv_f3_done(struct device *dev, u32 *desc, u32 err,
 	akcipher_request_complete(req, err);
 }
 
+/**
+ * Count leading zeros, need it to strip, from a given scatterlist
+ *
+ * @sgl   : scatterlist to count zeros from
+ * @nbytes: number of zeros, in bytes, to strip
+ * @flags : operation flags
+ */
 static int caam_rsa_count_leading_zeros(struct scatterlist *sgl,
 					unsigned int nbytes,
 					unsigned int flags)
@@ -187,7 +198,8 @@  static int caam_rsa_count_leading_zeros(struct scatterlist *sgl,
 	lzeros = 0;
 	len = 0;
 	while (nbytes > 0) {
-		while (len && !*buff) {
+		/* do not strip more than given bytes */
+		while (len && !*buff && lzeros < nbytes) {
 			lzeros++;
 			len--;
 			buff++;
@@ -218,6 +230,7 @@  static struct rsa_edesc *rsa_edesc_alloc(struct akcipher_request *req,
 	struct caam_rsa_ctx *ctx = akcipher_tfm_ctx(tfm);
 	struct device *dev = ctx->dev;
 	struct caam_rsa_req_ctx *req_ctx = akcipher_request_ctx(req);
+	struct caam_rsa_key *key = &ctx->key;
 	struct rsa_edesc *edesc;
 	gfp_t flags = (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ?
 		       GFP_KERNEL : GFP_ATOMIC;
@@ -225,20 +238,37 @@  static struct rsa_edesc *rsa_edesc_alloc(struct akcipher_request *req,
 	int sgc;
 	int sec4_sg_index, sec4_sg_len = 0, sec4_sg_bytes;
 	int src_nents, dst_nents;
+	unsigned int diff_size = 0;
 	int lzeros;
 
-	lzeros = caam_rsa_count_leading_zeros(req->src, req->src_len, sg_flags);
-	if (lzeros < 0)
-		return ERR_PTR(lzeros);
-
-	req->src_len -= lzeros;
-	req->src = scatterwalk_ffwd(req_ctx->src, req->src, lzeros);
+	if (req->src_len > key->n_sz) {
+		/*
+		 * strip leading zeros and
+		 * return the number of zeros to skip
+		 */
+		lzeros = caam_rsa_count_leading_zeros(req->src, req->src_len -
+						      key->n_sz, sg_flags);
+		if (lzeros < 0)
+			return ERR_PTR(lzeros);
+
+		req->src_len -= lzeros;
+		req->src = scatterwalk_ffwd(req_ctx->src, req->src, lzeros);
+	} else {
+		/*
+		 * input src is less then n key modulus,
+		 * so there will be zero padding
+		 */
+		diff_size = key->n_sz - req->src_len;
+	}
 
 	src_nents = sg_nents_for_len(req->src, req->src_len);
 	dst_nents = sg_nents_for_len(req->dst, req->dst_len);
 
-	if (src_nents > 1)
-		sec4_sg_len = src_nents;
+	if (!diff_size && src_nents == 1)
+		sec4_sg_len = 0; /* no need for an input hw s/g table */
+	else
+		sec4_sg_len = src_nents + !!diff_size;
+	sec4_sg_index = sec4_sg_len;
 	if (dst_nents > 1)
 		sec4_sg_len += dst_nents;
 
@@ -263,12 +293,14 @@  static struct rsa_edesc *rsa_edesc_alloc(struct akcipher_request *req,
 	}
 
 	edesc->sec4_sg = (void *)edesc + sizeof(*edesc) + desclen;
+	if (diff_size)
+		dma_to_sec4_sg_one(edesc->sec4_sg, ctx->padding_dma, diff_size,
+				   0);
+
+	if (sec4_sg_index)
+		sg_to_sec4_sg_last(req->src, src_nents, edesc->sec4_sg +
+				   !!diff_size, 0);
 
-	sec4_sg_index = 0;
-	if (src_nents > 1) {
-		sg_to_sec4_sg_last(req->src, src_nents, edesc->sec4_sg, 0);
-		sec4_sg_index += src_nents;
-	}
 	if (dst_nents > 1)
 		sg_to_sec4_sg_last(req->dst, dst_nents,
 				   edesc->sec4_sg + sec4_sg_index, 0);
@@ -289,6 +321,10 @@  static struct rsa_edesc *rsa_edesc_alloc(struct akcipher_request *req,
 
 	edesc->sec4_sg_bytes = sec4_sg_bytes;
 
+	print_hex_dump_debug("caampkc sec4_sg@" __stringify(__LINE__) ": ",
+			     DUMP_PREFIX_ADDRESS, 16, 4, edesc->sec4_sg,
+			     edesc->sec4_sg_bytes, 1);
+
 	return edesc;
 
 sec4_sg_fail:
@@ -978,6 +1014,15 @@  static int caam_rsa_init_tfm(struct crypto_akcipher *tfm)
 		return PTR_ERR(ctx->dev);
 	}
 
+	ctx->padding_dma = dma_map_single(ctx->dev, zero_buffer,
+					  CAAM_RSA_MAX_INPUT_SIZE - 1,
+					  DMA_TO_DEVICE);
+	if (dma_mapping_error(ctx->dev, ctx->padding_dma)) {
+		dev_err(ctx->dev, "unable to map padding\n");
+		caam_jr_free(ctx->dev);
+		return -ENOMEM;
+	}
+
 	return 0;
 }
 
@@ -987,6 +1032,8 @@  static void caam_rsa_exit_tfm(struct crypto_akcipher *tfm)
 	struct caam_rsa_ctx *ctx = akcipher_tfm_ctx(tfm);
 	struct caam_rsa_key *key = &ctx->key;
 
+	dma_unmap_single(ctx->dev, ctx->padding_dma, CAAM_RSA_MAX_INPUT_SIZE -
+			 1, DMA_TO_DEVICE);
 	caam_rsa_free_key(key);
 	caam_jr_free(ctx->dev);
 }
@@ -1058,6 +1105,14 @@  static int __init caam_pkc_init(void)
 		goto out_put_dev;
 	}
 
+	/* allocate zero buffer, used for padding input */
+	zero_buffer = kzalloc(CAAM_RSA_MAX_INPUT_SIZE - 1, GFP_DMA |
+			      GFP_KERNEL);
+	if (!zero_buffer) {
+		err = -ENOMEM;
+		goto out_put_dev;
+	}
+
 	err = crypto_register_akcipher(&caam_rsa);
 	if (err)
 		dev_warn(ctrldev, "%s alg registration failed\n",
@@ -1072,6 +1127,7 @@  static int __init caam_pkc_init(void)
 
 static void __exit caam_pkc_exit(void)
 {
+	kfree(zero_buffer);
 	crypto_unregister_akcipher(&caam_rsa);
 }
 
diff --git a/drivers/crypto/caam/caampkc.h b/drivers/crypto/caam/caampkc.h
index 82645bc..5ac7201 100644
--- a/drivers/crypto/caam/caampkc.h
+++ b/drivers/crypto/caam/caampkc.h
@@ -89,10 +89,12 @@  struct caam_rsa_key {
  * caam_rsa_ctx - per session context.
  * @key         : RSA key in DMA zone
  * @dev         : device structure
+ * @padding_dma : dma address of padding, for adding it to the input
  */
 struct caam_rsa_ctx {
 	struct caam_rsa_key key;
 	struct device *dev;
+	dma_addr_t padding_dma;
 };
 
 /**