Skip to content

L
linux
Switch branch/tag
  1. 27 Jan, 2009 2 commits
    • Jarod Wilson's avatar
      crypto: ccm - Fix handling of null assoc data · 516280e7
      Jarod Wilson authored 
      Its a valid use case to have null associated data in a ccm vector, but
this case isn't being handled properly right now.

The following ccm decryption/verification test vector, using the
rfc4309 implementation regularly triggers a panic, as will any
other vector with null assoc data:

* key: ab2f8a74b71cd2b1ff802e487d82f8b9
* iv: c6fb7d800d13abd8a6b2d8
* Associated Data: [NULL]
* Tag Length: 8
* input: d5e8939fc7892e2b

The resulting panic looks like so:

Unable to handle kernel paging request at ffff810064ddaec0 RIP: 
 [<ffffffff8864c4d7>] :ccm:get_data_to_compute+0x1a6/0x1d6
PGD 8063 PUD 0 
Oops: 0002 [1] SMP 
last sysfs file: /module/libata/version
CPU 0
Modules linked in: crypto_tester_kmod(U) seqiv krng ansi_cprng chainiv rng ctr aes_generic aes_x86_64 ccm cryptomgr testmgr_cipher testmgr aead crypto_blkcipher crypto_a
lgapi des ipv6 xfrm_nalgo crypto_api autofs4 hidp l2cap bluetooth nfs lockd fscache nfs_acl sunrpc ip_conntrack_netbios_ns ipt_REJECT xt_state ip_conntrack nfnetlink xt_
tcpudp iptable_filter ip_tables x_tables dm_mirror dm_log dm_multipath scsi_dh dm_mod video hwmon backlight sbs i2c_ec button battery asus_acpi acpi_memhotplug ac lp sg 
snd_intel8x0 snd_ac97_codec ac97_bus snd_seq_dummy snd_seq_oss joydev snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss ide_cd snd_pcm floppy parport_p
c shpchp e752x_edac snd_timer e1000 i2c_i801 edac_mc snd soundcore snd_page_alloc i2c_core cdrom parport serio_raw pcspkr ata_piix libata sd_mod scsi_mod ext3 jbd uhci_h
cd ohci_hcd ehci_hcd
Pid: 12844, comm: crypto-tester Tainted: G      2.6.18-128.el5.fips1 #1
RIP: 0010:[<ffffffff8864c4d7>]  [<ffffffff8864c4d7>] :ccm:get_data_to_compute+0x1a6/0x1d6
RSP: 0018:ffff8100134434e8  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8100104898b0 RCX: ffffffffab6aea10
RDX: 0000000000000010 RSI: ffff8100104898c0 RDI: ffff810064ddaec0
RBP: 0000000000000000 R08: ffff8100104898b0 R09: 0000000000000000
R10: ffff8100103bac84 R11: ffff8100104898b0 R12: ffff810010489858
R13: ffff8100104898b0 R14: ffff8100103bac00 R15: 0000000000000000
FS:  00002ab881adfd30(0000) GS:ffffffff803ac000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffff810064ddaec0 CR3: 0000000012a88000 CR4: 00000000000006e0
Process crypto-tester (pid: 12844, threadinfo ffff810013442000, task ffff81003d165860)
Stack:  ffff8100103bac00 ffff8100104898e8 ffff8100134436f8 ffffffff00000000
 0000000000000000 ffff8100104898b0 0000000000000000 ffff810010489858
 0000000000000000 ffff8100103bac00 ffff8100134436f8 ffffffff8864c634
Call Trace:
 [<ffffffff8864c634>] :ccm:crypto_ccm_auth+0x12d/0x140
 [<ffffffff8864cf73>] :ccm:crypto_ccm_decrypt+0x161/0x23a
 [<ffffffff88633643>] :crypto_tester_kmod:cavs_test_rfc4309_ccm+0x4a5/0x559
[...]

The above is from a RHEL5-based kernel, but upstream is susceptible too.

The fix is trivial: in crypto/ccm.c:crypto_ccm_auth(), pctx->ilen contains
whatever was in memory when pctx was allocated if assoclen is 0. The tested
fix is to simply add an else clause setting pctx->ilen to 0 for the
assoclen == 0 case, so that get_data_to_compute() doesn't try doing
things its not supposed to.
Signed-off-by: default avatarJarod Wilson <jarod@redhat.com>
Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      516280e7
    • Herbert Xu's avatar
      crypto: blkcipher - Fix WARN_ON handling in walk_done · bac1b5c4
      Herbert Xu authored 
      When we get left-over bits from a slow walk, it means that the
underlying cipher has gone troppo.  However, as we're handling
that case we should ensure that the caller terminates the walk.

This patch does this by setting walk->nbytes to zero.
Reported-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Reported-by: default avatarHuang Ying <ying.huang@intel.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      bac1b5c4
  3. 15 Jan, 2009 7 commits
    • Herbert Xu's avatar
      crypto: authenc - Fix zero-length IV crash · 29b37f42
      Herbert Xu authored 
      As it is if an algorithm with a zero-length IV is used (e.g.,
NULL encryption) with authenc, authenc may generate an SG entry
of length zero, which will trigger a BUG check in the hash layer.

This patch fixes it by skipping the IV SG generation if the IV
size is zero.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      29b37f42
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · 5393f780
      Linus Torvalds authored 
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: (29 commits)
  powerpc/83xx: Move mcu_mpc8349emitx driver out of drivers/i2c/chips/
  powerpc/83xx: Make serial ports work on MPC8315E-RDB w/ FSL U-Boots
  powerpc/e500mc: Doorbells need to be taken w/exceptions disabled
  powerpc: Enable PS3 options and QPACE in ppc64_defconfig
  powerpc/powermac: Fix occasional SMP boot failure
  powerpc/cacheinfo: Rename cache_dir per-cpu variable
  hvc_console: Use kzalloc() instead of kmalloc() + memset()
  hvc_console: Do not set low_latency when using interrupts
  hvc_console: Call free_irq() only if request_irq() was successful
  hvc_console: Change an mb() to smp_mb() and add some comments
  powerpc: Cleanup from l64 to ll64 change: drivers/net
  powerpc: Cleanup from l64 to ll64 change: drivers/char
  powerpc: Cleanup from l64 to ll64 change: arch code
  powerpc: Change u64/s64 to a long long integer type
  powerpc/kexec: Check crash_base for relocatable kernel
  powerpc: Make dummy section a valid note header
  Xilinx: SPI: updated driver for device tree
  drivers/of: Add the of_find_i2c_device_by_node function.
  powerpc/xsysace: add compatible string for non-ipcore instance
  powerpc/mpc52xx: remove dead code from GPIO driver
  ...
      5393f780
    • Linus Torvalds's avatar
      Merge branch 'syscalls' of git://git390.osdl.marist.edu/pub/scm/linux-2.6 · bca26856
      Linus Torvalds authored 
      * 'syscalls' of git://git390.osdl.marist.edu/pub/scm/linux-2.6: (44 commits)
  [CVE-2009-0029] s390 specific system call wrappers
  [CVE-2009-0029] System call wrappers part 33
  [CVE-2009-0029] System call wrappers part 32
  [CVE-2009-0029] System call wrappers part 31
  [CVE-2009-0029] System call wrappers part 30
  [CVE-2009-0029] System call wrappers part 29
  [CVE-2009-0029] System call wrappers part 28
  [CVE-2009-0029] System call wrappers part 27
  [CVE-2009-0029] System call wrappers part 26
  [CVE-2009-0029] System call wrappers part 25
  [CVE-2009-0029] System call wrappers part 24
  [CVE-2009-0029] System call wrappers part 23
  [CVE-2009-0029] System call wrappers part 22
  [CVE-2009-0029] System call wrappers part 21
  [CVE-2009-0029] System call wrappers part 20
  [CVE-2009-0029] System call wrappers part 19
  [CVE-2009-0029] System call wrappers part 18
  [CVE-2009-0029] System call wrappers part 17
  [CVE-2009-0029] System call wrappers part 16
  [CVE-2009-0029] System call wrappers part 15
  ...
      bca26856
    • Harvey Harrison's avatar
      byteorder: make swab.h include asm/swab.h like a regular header · 74d96f01
      Harvey Harrison authored 
      Add swab.h to kbuild.asm and remove the individual entries from
each arch, mark as unifdef as some arches have some kernel-only
bits inside.
Signed-off-by: default avatarHarvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      74d96f01
    • Harvey Harrison's avatar
      cris: introduce asm/swab.h · aa0effbd
      Harvey Harrison authored 
      Adjust the arch overrides to the new names as well.
Signed-off-by: default avatarHarvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      aa0effbd
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs · 5bf431fa
      Linus Torvalds authored 
      * 'for-linus' of git://oss.sgi.com/xfs/xfs:
  [XFS] Update maintainers
  [XFS] use scalable vmap API
  [XFS] remove old vmap cache
  [XFS] make xfs_ino_t an unsigned long long
  [XFS] truncate readdir offsets to signed 32 bit values
  [XFS] fix compile of xfs_btree_readahead_lblock on m68k
  [XFS] Remove macro-to-function indirections in the mask code
  [XFS] Remove macro-to-function indirections in attr code
  [XFS] Remove several unused typedefs.
  [XFS] pass XFS_IGET_BULKSTAT to xfs_iget for handle operations
      5bf431fa
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6 · c2919f2a
      Linus Torvalds authored 
      * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
  IDE: fix sparse signed-ness errors with host->host_busy
  ide: fix suspend regression
  tx4938ide: Fix build error due to read_sff_dma_status moving
  ide: remove unused CONFIG_BLK_DEV_IDE_AU1XXX_SEQTS_PER_RQ
  sl82c105: remove dead code
  via82cxxx: fix cable warning message
  ide: can't use SSD/non-rotational queue flag for all CFA devices
  it821x.c: use dev->revision instead of pci_read_config_byte
  it821x: Add ultra_mask quirk for Vortex86SX
  ide: fix accidental LOCKDEP breakage caused by local_irq_set() removal
      c2919f2a
  5. 14 Jan, 2009 31 commits
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7