From patchwork Mon Nov 28 13:39:09 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephan Mueller X-Patchwork-Id: 9449541 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E8283600CB for ; Mon, 28 Nov 2016 13:39:18 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D04F6266F3 for ; Mon, 28 Nov 2016 13:39:18 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C4BD6277D9; Mon, 28 Nov 2016 13:39:18 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EAC66266F3 for ; Mon, 28 Nov 2016 13:39:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932467AbcK1NjR (ORCPT ); Mon, 28 Nov 2016 08:39:17 -0500 Received: from mail.eperm.de ([89.247.134.16]:51016 "EHLO mail.eperm.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932266AbcK1NjQ (ORCPT ); Mon, 28 Nov 2016 08:39:16 -0500 Received: from positron.chronox.de (mail.eperm.de [89.247.134.16]) by mail.eperm.de (Postfix) with ESMTPA id 0ED1D1816195; Mon, 28 Nov 2016 14:39:14 +0100 (CET) From: Stephan Mueller To: Herbert Xu Cc: linux-crypto@vger.kernel.org Subject: [PATCH RESEND] crypto: CTR DRBG - prevent invalid SG mappings Date: Mon, 28 Nov 2016 14:39:09 +0100 Message-ID: <1506389.b84a3PTDCG@positron.chronox.de> User-Agent: KMail/5.3.2 (Linux/4.8.8-300.fc25.x86_64; KDE/5.27.0; x86_64; ; ) In-Reply-To: <20161128131027.GA2674@gondor.apana.org.au> References: <1833318.YYJALW9cvC@positron.chronox.de> <2300597.UdE444b3Re@positron.chronox.de> <20161128131027.GA2674@gondor.apana.org.au> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When using SGs, only heap memory (memory that is valid as per virt_addr_valid) is allowed to be referenced. The CTR DRBG used to reference the caller-provided memory directly in an SG. In case the caller provided stack memory pointers, the SG mapping is not considered to be valid. In some cases, this would even cause a paging fault. The change adds a new scratch buffer that is used in case the caller-provided buffer is deemed not suitable for use in an SG. The crypto operation of the CTR DRBG produces its output with that scratch buffer. The scratch buffer is allocated during allocation time of the CTR DRBG as its access is protected with the DRBG mutex. Signed-off-by: Stephan Mueller --- crypto/drbg.c | 35 +++++++++++++++++++++++++++++++---- include/crypto/drbg.h | 2 ++ 2 files changed, 33 insertions(+), 4 deletions(-) diff --git a/crypto/drbg.c b/crypto/drbg.c index 9a95b61..cbbd19f 100644 --- a/crypto/drbg.c +++ b/crypto/drbg.c @@ -262,6 +262,7 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, u8 *inbuf, u32 inbuflen, u8 *outbuf, u32 outlen); #define DRBG_CTR_NULL_LEN 128 +#define DRBG_OUTSCRATCHLEN DRBG_CTR_NULL_LEN /* BCC function for CTR DRBG as defined in 10.4.3 */ static int drbg_ctr_bcc(struct drbg_state *drbg, @@ -1644,6 +1645,9 @@ static int drbg_fini_sym_kernel(struct drbg_state *drbg) kfree(drbg->ctr_null_value_buf); drbg->ctr_null_value = NULL; + kfree(drbg->outscratchpadbuf); + drbg->outscratchpadbuf = NULL; + return 0; } @@ -1708,6 +1712,15 @@ static int drbg_init_sym_kernel(struct drbg_state *drbg) drbg->ctr_null_value = (u8 *)PTR_ALIGN(drbg->ctr_null_value_buf, alignmask + 1); + drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask, + GFP_KERNEL); + if (!drbg->outscratchpadbuf) { + drbg_fini_sym_kernel(drbg); + return -ENOMEM; + } + drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf, + alignmask + 1); + return alignmask; } @@ -1737,15 +1750,22 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, u8 *outbuf, u32 outlen) { struct scatterlist sg_in; + bool virt_addr_valid = virt_addr_valid(outbuf); + int ret = 0; sg_init_one(&sg_in, inbuf, inlen); while (outlen) { u32 cryptlen = min_t(u32, inlen, outlen); struct scatterlist sg_out; - int ret; - sg_init_one(&sg_out, outbuf, cryptlen); + /* If output buffer is not valid for SGL, use scratchpad */ + if (virt_addr_valid) + sg_init_one(&sg_out, outbuf, cryptlen); + else { + cryptlen = min_t(u32, cryptlen, DRBG_OUTSCRATCHLEN); + sg_init_one(&sg_out, drbg->outscratchpad, cryptlen); + } skcipher_request_set_crypt(drbg->ctr_req, &sg_in, &sg_out, cryptlen, drbg->V); ret = crypto_skcipher_encrypt(drbg->ctr_req); @@ -1761,15 +1781,22 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, break; } default: - return ret; + goto out; } init_completion(&drbg->ctr_completion); + if (!virt_addr_valid) + memcpy(outbuf, drbg->outscratchpad, cryptlen); + outlen -= cryptlen; outbuf += cryptlen; } + ret = 0; - return 0; +out: + if (!virt_addr_valid) + memzero_explicit(drbg->outscratchpad, DRBG_OUTSCRATCHLEN); + return ret; } #endif /* CONFIG_CRYPTO_DRBG_CTR */ diff --git a/include/crypto/drbg.h b/include/crypto/drbg.h index 61580b1..22f884c 100644 --- a/include/crypto/drbg.h +++ b/include/crypto/drbg.h @@ -124,6 +124,8 @@ struct drbg_state { struct skcipher_request *ctr_req; /* CTR mode request handle */ __u8 *ctr_null_value_buf; /* CTR mode unaligned buffer */ __u8 *ctr_null_value; /* CTR mode aligned zero buf */ + __u8 *outscratchpadbuf; /* CTR mode output scratchpad */ + __u8 *outscratchpad; /* CTR mode aligned outbuf */ struct completion ctr_completion; /* CTR mode async handler */ int ctr_async_err; /* CTR mode async error */