Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp251159yba; Mon, 20 May 2019 08:08:15 -0700 (PDT) X-Google-Smtp-Source: APXvYqx7TuzPH8JRdVkV1VedabbBwb8p9s5onEm+Wst1/NQDwXoCABP/c6RnHHy3t0c5VzENLfho X-Received: by 2002:a62:2805:: with SMTP id o5mr80573186pfo.256.1558364895463; Mon, 20 May 2019 08:08:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1558364895; cv=none; d=google.com; s=arc-20160816; b=bai+NX1iEBfNCSs4Tkf3XQGV8s8M1GM2eL/QEoB1eBQ9WYFkBpmmEkrVUwAio6e/Eb VStoGFy/RoN722yvfLw8TRxANM70xzh19Slvefj5AGsFnhrBisYgoK5WOHCtmLJUp+F+ i+XfLiTZXVg6VwnBkKtOIxeRmfFC66OrVWgWoKDsb9jT88KLRU2tY75X6NUKTWWOPfwS /fuqxZ+ZKDDyFlM1OWXeU8p2h73NMQG8fcOYrjkJRJGcBFDOBKI9Ed8siErX2GUUhElY MVT1Zhg1rVpvzjURbLVIEs0xGm+7cOjhfve7OcsB3t96UFz1vYDG+MKZLc7t3mNxrSPw 6nzg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=f9UMPo2kDpoz6ZIolqHW+fcCHh8GhYiqnkSEqY3FfQ4=; b=Hr2UqiArap94S2j3ildcIFax05Dfy/KkRzPvOhWLOnVxcU8qcgCM26/qsoMY3h4b6a iYHgP5oLiQ/nFMQDqakvBA2ZbLLvozVYWxO4DMQtQ9hpXR472lBxwQNoJNasqkAWP1+s JUTFS5auUwnjDwjRuAs1P1bwtsbkXctFWKc1XPcUXVyh7Bhz+QLuCI7IlSBlsq7aBtjF awhCHWRoy0HiBLO5dp0J2vGKDjGyeZ34/8bUV9+/FBDmTKck1HdYj4OjBxhdgeY7Wakk 4PyjWkMwHUHlMPPO3Jf0Skgj83Rjl01YOrrn/L+ijiOvKUE6TR+MduXVRhwbiMLUb7Fh 4skA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="XodfEQ/w"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b5si17949365pgd.557.2019.05.20.08.08.00; Mon, 20 May 2019 08:08:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="XodfEQ/w"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388340AbfETMWC (ORCPT + 99 others); Mon, 20 May 2019 08:22:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:35898 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387450AbfETMWA (ORCPT ); Mon, 20 May 2019 08:22:00 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B22C221479; Mon, 20 May 2019 12:21:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1558354919; bh=rmHVYPOlnN/vpU5p3SZu4V8v2GRlgsYkk6Zj1BVORRs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XodfEQ/w0GVG5fBt7h6PBkBCTO+NGHlM1Me6FfPbBTZBHOo+9Kclkc54qPtp2xqDc 4PsItKYwfSmqvRvACyg/XgIFmWr0zopeML1leUYtPFzGp4FNz1bHqS2KOb0lnCtVZ7 kDCy/mfa7CGc3QViTnaIKsVI+gNGvv5Vqll4VJJ4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biggers , Herbert Xu Subject: [PATCH 4.19 028/105] crypto: gcm - fix incompatibility between "gcm" and "gcm_base" Date: Mon, 20 May 2019 14:13:34 +0200 Message-Id: <20190520115248.982523797@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190520115247.060821231@linuxfoundation.org> References: <20190520115247.060821231@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Biggers commit f699594d436960160f6d5ba84ed4a222f20d11cd upstream. GCM instances can be created by either the "gcm" template, which only allows choosing the block cipher, e.g. "gcm(aes)"; or by "gcm_base", which allows choosing the ctr and ghash implementations, e.g. "gcm_base(ctr(aes-generic),ghash-generic)". However, a "gcm_base" instance prevents a "gcm" instance from being registered using the same implementations. Nor will the instance be found by lookups of "gcm". This can be used as a denial of service. Moreover, "gcm_base" instances are never tested by the crypto self-tests, even if there are compatible "gcm" tests. The root cause of these problems is that instances of the two templates use different cra_names. Therefore, fix these problems by making "gcm_base" instances set the same cra_name as "gcm" instances, e.g. "gcm(aes)" instead of "gcm_base(ctr(aes-generic),ghash-generic)". This requires extracting the block cipher name from the name of the ctr algorithm. It also requires starting to verify that the algorithms are really ctr and ghash, not something else entirely. But it would be bizarre if anyone were actually using non-gcm-compatible algorithms with gcm_base, so this shouldn't break anyone in practice. Fixes: d00aa19b507b ("[CRYPTO] gcm: Allow block cipher parameter") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- crypto/gcm.c | 34 +++++++++++----------------------- 1 file changed, 11 insertions(+), 23 deletions(-) --- a/crypto/gcm.c +++ b/crypto/gcm.c @@ -597,7 +597,6 @@ static void crypto_gcm_free(struct aead_ static int crypto_gcm_create_common(struct crypto_template *tmpl, struct rtattr **tb, - const char *full_name, const char *ctr_name, const char *ghash_name) { @@ -638,7 +637,8 @@ static int crypto_gcm_create_common(stru goto err_free_inst; err = -EINVAL; - if (ghash->digestsize != 16) + if (strcmp(ghash->base.cra_name, "ghash") != 0 || + ghash->digestsize != 16) goto err_drop_ghash; crypto_set_skcipher_spawn(&ctx->ctr, aead_crypto_instance(inst)); @@ -650,24 +650,24 @@ static int crypto_gcm_create_common(stru ctr = crypto_spawn_skcipher_alg(&ctx->ctr); - /* We only support 16-byte blocks. */ + /* The skcipher algorithm must be CTR mode, using 16-byte blocks. */ err = -EINVAL; - if (crypto_skcipher_alg_ivsize(ctr) != 16) + if (strncmp(ctr->base.cra_name, "ctr(", 4) != 0 || + crypto_skcipher_alg_ivsize(ctr) != 16 || + ctr->base.cra_blocksize != 1) goto out_put_ctr; - /* Not a stream cipher? */ - if (ctr->base.cra_blocksize != 1) + err = -ENAMETOOLONG; + if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, + "gcm(%s", ctr->base.cra_name + 4) >= CRYPTO_MAX_ALG_NAME) goto out_put_ctr; - err = -ENAMETOOLONG; if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, "gcm_base(%s,%s)", ctr->base.cra_driver_name, ghash_alg->cra_driver_name) >= CRYPTO_MAX_ALG_NAME) goto out_put_ctr; - memcpy(inst->alg.base.cra_name, full_name, CRYPTO_MAX_ALG_NAME); - inst->alg.base.cra_flags = (ghash->base.cra_flags | ctr->base.cra_flags) & CRYPTO_ALG_ASYNC; inst->alg.base.cra_priority = (ghash->base.cra_priority + @@ -709,7 +709,6 @@ static int crypto_gcm_create(struct cryp { const char *cipher_name; char ctr_name[CRYPTO_MAX_ALG_NAME]; - char full_name[CRYPTO_MAX_ALG_NAME]; cipher_name = crypto_attr_alg_name(tb[1]); if (IS_ERR(cipher_name)) @@ -719,12 +718,7 @@ static int crypto_gcm_create(struct cryp CRYPTO_MAX_ALG_NAME) return -ENAMETOOLONG; - if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm(%s)", cipher_name) >= - CRYPTO_MAX_ALG_NAME) - return -ENAMETOOLONG; - - return crypto_gcm_create_common(tmpl, tb, full_name, - ctr_name, "ghash"); + return crypto_gcm_create_common(tmpl, tb, ctr_name, "ghash"); } static struct crypto_template crypto_gcm_tmpl = { @@ -738,7 +732,6 @@ static int crypto_gcm_base_create(struct { const char *ctr_name; const char *ghash_name; - char full_name[CRYPTO_MAX_ALG_NAME]; ctr_name = crypto_attr_alg_name(tb[1]); if (IS_ERR(ctr_name)) @@ -748,12 +741,7 @@ static int crypto_gcm_base_create(struct if (IS_ERR(ghash_name)) return PTR_ERR(ghash_name); - if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm_base(%s,%s)", - ctr_name, ghash_name) >= CRYPTO_MAX_ALG_NAME) - return -ENAMETOOLONG; - - return crypto_gcm_create_common(tmpl, tb, full_name, - ctr_name, ghash_name); + return crypto_gcm_create_common(tmpl, tb, ctr_name, ghash_name); } static struct crypto_template crypto_gcm_base_tmpl = {