Commit 51217aea authored by Herbert Xu's avatar Herbert Xu Committed by Kamal Mostafa

crypto: algif_skcipher - Require setkey before accept(2)

commit dd504589 upstream.

Some cipher implementations will crash if you try to use them
without calling setkey first.  This patch adds a check so that
the accept(2) call will fail with -ENOKEY if setkey hasn't been
done on the socket yet.
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Tested-by: default avatarDmitry Vyukov <dvyukov@google.com>
[ kamal: backport to 4.2-stable: crypto_alloc_ablkcipher API ]
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
parent 3278d0c2
...@@ -31,6 +31,11 @@ struct skcipher_sg_list { ...@@ -31,6 +31,11 @@ struct skcipher_sg_list {
struct scatterlist sg[0]; struct scatterlist sg[0];
}; };
struct skcipher_tfm {
struct crypto_ablkcipher *skcipher;
bool has_key;
};
struct skcipher_ctx { struct skcipher_ctx {
struct list_head tsgl; struct list_head tsgl;
struct af_alg_sgl rsgl; struct af_alg_sgl rsgl;
...@@ -543,17 +548,41 @@ static struct proto_ops algif_skcipher_ops = { ...@@ -543,17 +548,41 @@ static struct proto_ops algif_skcipher_ops = {
static void *skcipher_bind(const char *name, u32 type, u32 mask) static void *skcipher_bind(const char *name, u32 type, u32 mask)
{ {
return crypto_alloc_ablkcipher(name, type, mask); struct skcipher_tfm *tfm;
struct crypto_ablkcipher *skcipher;
tfm = kzalloc(sizeof(*tfm), GFP_KERNEL);
if (!tfm)
return ERR_PTR(-ENOMEM);
skcipher = crypto_alloc_ablkcipher(name, type, mask);
if (IS_ERR(skcipher)) {
kfree(tfm);
return ERR_CAST(skcipher);
}
tfm->skcipher = skcipher;
return tfm;
} }
static void skcipher_release(void *private) static void skcipher_release(void *private)
{ {
crypto_free_ablkcipher(private); struct skcipher_tfm *tfm = private;
crypto_free_ablkcipher(tfm->skcipher);
kfree(tfm);
} }
static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen) static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen)
{ {
return crypto_ablkcipher_setkey(private, key, keylen); struct skcipher_tfm *tfm = private;
int err;
err = crypto_ablkcipher_setkey(tfm->skcipher, key, keylen);
tfm->has_key = !err;
return err;
} }
static void skcipher_sock_destruct(struct sock *sk) static void skcipher_sock_destruct(struct sock *sk)
...@@ -572,20 +601,25 @@ static int skcipher_accept_parent(void *private, struct sock *sk) ...@@ -572,20 +601,25 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
{ {
struct skcipher_ctx *ctx; struct skcipher_ctx *ctx;
struct alg_sock *ask = alg_sk(sk); struct alg_sock *ask = alg_sk(sk);
unsigned int len = sizeof(*ctx) + crypto_ablkcipher_reqsize(private); struct skcipher_tfm *tfm = private;
struct crypto_ablkcipher *skcipher = tfm->skcipher;
unsigned int len = sizeof(*ctx) + crypto_ablkcipher_reqsize(skcipher);
if (!tfm->has_key)
return -ENOKEY;
ctx = sock_kmalloc(sk, len, GFP_KERNEL); ctx = sock_kmalloc(sk, len, GFP_KERNEL);
if (!ctx) if (!ctx)
return -ENOMEM; return -ENOMEM;
ctx->iv = sock_kmalloc(sk, crypto_ablkcipher_ivsize(private), ctx->iv = sock_kmalloc(sk, crypto_ablkcipher_ivsize(skcipher),
GFP_KERNEL); GFP_KERNEL);
if (!ctx->iv) { if (!ctx->iv) {
sock_kfree_s(sk, ctx, len); sock_kfree_s(sk, ctx, len);
return -ENOMEM; return -ENOMEM;
} }
memset(ctx->iv, 0, crypto_ablkcipher_ivsize(private)); memset(ctx->iv, 0, crypto_ablkcipher_ivsize(skcipher));
INIT_LIST_HEAD(&ctx->tsgl); INIT_LIST_HEAD(&ctx->tsgl);
ctx->len = len; ctx->len = len;
...@@ -597,7 +631,7 @@ static int skcipher_accept_parent(void *private, struct sock *sk) ...@@ -597,7 +631,7 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
ask->private = ctx; ask->private = ctx;
ablkcipher_request_set_tfm(&ctx->req, private); ablkcipher_request_set_tfm(&ctx->req, skcipher);
ablkcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG, ablkcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
af_alg_complete, &ctx->completion); af_alg_complete, &ctx->completion);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment