| Message ID | 20200108050646.29220-1-dja@axtens.net (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Herbert Xu |
| Headers | show |
| Series | crypto: vmx/xts - reject inputs that are too short | expand |
On Wed, Jan 08, 2020 at 04:06:46PM +1100, Daniel Axtens wrote: > When the kernel XTS implementation was extended to deal with ciphertext > stealing in commit 8083b1bf8163 ("crypto: xts - add support for ciphertext > stealing"), a check was added to reject inputs that were too short. > > However, in the vmx enablement - commit 239668419349 ("crypto: vmx/xts - > use fallback for ciphertext stealing"), that check wasn't added to the > vmx implementation. This disparity leads to errors like the following: > > alg: skcipher: p8_aes_xts encryption unexpectedly succeeded on test vector "random: len=0 klen=64"; expected_error=-22, cfg="random: inplace may_sleep use_finup src_divs=[<flush>66.99%@+10, 33.1%@alignmask+1155]" > > Return -EINVAL if asked to operate with a cryptlen smaller than the AES > block size. This brings vmx in line with the generic implementation. > > Reported-by: Erhard Furtner <erhard_f@mailbox.org> > Link: https://bugzilla.kernel.org/show_bug.cgi?id=206049 > Fixes: 239668419349 ("crypto: vmx/xts - use fallback for ciphertext stealing") > Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> > Cc: stable@vger.kernel.org # v5.4+ > Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> > [dja: commit message] > Signed-off-by: Daniel Axtens <dja@axtens.net> > --- > drivers/crypto/vmx/aes_xts.c | 3 +++ > 1 file changed, 3 insertions(+) Patch applied. Thanks.
diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c index d59e736882f6..9fee1b1532a4 100644 --- a/drivers/crypto/vmx/aes_xts.c +++ b/drivers/crypto/vmx/aes_xts.c @@ -84,6 +84,9 @@ static int p8_aes_xts_crypt(struct skcipher_request *req, int enc) u8 tweak[AES_BLOCK_SIZE]; int ret; + if (req->cryptlen < AES_BLOCK_SIZE) + return -EINVAL; + if (!crypto_simd_usable() || (req->cryptlen % XTS_BLOCK_SIZE) != 0) { struct skcipher_request *subreq = skcipher_request_ctx(req);
When the kernel XTS implementation was extended to deal with ciphertext stealing in commit 8083b1bf8163 ("crypto: xts - add support for ciphertext stealing"), a check was added to reject inputs that were too short. However, in the vmx enablement - commit 239668419349 ("crypto: vmx/xts - use fallback for ciphertext stealing"), that check wasn't added to the vmx implementation. This disparity leads to errors like the following: alg: skcipher: p8_aes_xts encryption unexpectedly succeeded on test vector "random: len=0 klen=64"; expected_error=-22, cfg="random: inplace may_sleep use_finup src_divs=[<flush>66.99%@+10, 33.1%@alignmask+1155]" Return -EINVAL if asked to operate with a cryptlen smaller than the AES block size. This brings vmx in line with the generic implementation. Reported-by: Erhard Furtner <erhard_f@mailbox.org> Link: https://bugzilla.kernel.org/show_bug.cgi?id=206049 Fixes: 239668419349 ("crypto: vmx/xts - use fallback for ciphertext stealing") Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> [dja: commit message] Signed-off-by: Daniel Axtens <dja@axtens.net> --- drivers/crypto/vmx/aes_xts.c | 3 +++ 1 file changed, 3 insertions(+)