Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:
"This fixes the following issues:

- Potential memory overwrite in simd

- Kernel info leaks in crypto_user

- NULL dereference and use-after-free in hisilicon"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: user - Zeroize whole structure given to user space
crypto: user - fix leaking uninitialized memory to userspace
crypto: simd - correctly take reqsize of wrapped skcipher into account
crypto: hisilicon - Fix reference after free of memories on error path
crypto: hisilicon - Fix NULL dereference for same dst and src

+50 -25
+9 -9
crypto/crypto_user_base.c
··· 84 84 { 85 85 struct crypto_report_cipher rcipher; 86 86 87 - strlcpy(rcipher.type, "cipher", sizeof(rcipher.type)); 87 + strncpy(rcipher.type, "cipher", sizeof(rcipher.type)); 88 88 89 89 rcipher.blocksize = alg->cra_blocksize; 90 90 rcipher.min_keysize = alg->cra_cipher.cia_min_keysize; ··· 103 103 { 104 104 struct crypto_report_comp rcomp; 105 105 106 - strlcpy(rcomp.type, "compression", sizeof(rcomp.type)); 106 + strncpy(rcomp.type, "compression", sizeof(rcomp.type)); 107 107 if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS, 108 108 sizeof(struct crypto_report_comp), &rcomp)) 109 109 goto nla_put_failure; ··· 117 117 { 118 118 struct crypto_report_acomp racomp; 119 119 120 - strlcpy(racomp.type, "acomp", sizeof(racomp.type)); 120 + strncpy(racomp.type, "acomp", sizeof(racomp.type)); 121 121 122 122 if (nla_put(skb, CRYPTOCFGA_REPORT_ACOMP, 123 123 sizeof(struct crypto_report_acomp), &racomp)) ··· 132 132 { 133 133 struct crypto_report_akcipher rakcipher; 134 134 135 - strlcpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); 135 + strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); 136 136 137 137 if (nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER, 138 138 sizeof(struct crypto_report_akcipher), &rakcipher)) ··· 147 147 { 148 148 struct crypto_report_kpp rkpp; 149 149 150 - strlcpy(rkpp.type, "kpp", sizeof(rkpp.type)); 150 + strncpy(rkpp.type, "kpp", sizeof(rkpp.type)); 151 151 152 152 if (nla_put(skb, CRYPTOCFGA_REPORT_KPP, 153 153 sizeof(struct crypto_report_kpp), &rkpp)) ··· 161 161 static int crypto_report_one(struct crypto_alg *alg, 162 162 struct crypto_user_alg *ualg, struct sk_buff *skb) 163 163 { 164 - strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); 165 - strlcpy(ualg->cru_driver_name, alg->cra_driver_name, 164 + strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); 165 + strncpy(ualg->cru_driver_name, alg->cra_driver_name, 166 166 sizeof(ualg->cru_driver_name)); 167 - strlcpy(ualg->cru_module_name, module_name(alg->cra_module), 167 + strncpy(ualg->cru_module_name, module_name(alg->cra_module), 168 168 sizeof(ualg->cru_module_name)); 169 169 170 170 ualg->cru_type = 0; ··· 177 177 if (alg->cra_flags & CRYPTO_ALG_LARVAL) { 178 178 struct crypto_report_larval rl; 179 179 180 - strlcpy(rl.type, "larval", sizeof(rl.type)); 180 + strncpy(rl.type, "larval", sizeof(rl.type)); 181 181 if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL, 182 182 sizeof(struct crypto_report_larval), &rl)) 183 183 goto nla_put_failure;
+21
crypto/crypto_user_stat.c
··· 37 37 u64 v64; 38 38 u32 v32; 39 39 40 + memset(&raead, 0, sizeof(raead)); 41 + 40 42 strncpy(raead.type, "aead", sizeof(raead.type)); 41 43 42 44 v32 = atomic_read(&alg->encrypt_cnt); ··· 66 64 struct crypto_stat rcipher; 67 65 u64 v64; 68 66 u32 v32; 67 + 68 + memset(&rcipher, 0, sizeof(rcipher)); 69 69 70 70 strlcpy(rcipher.type, "cipher", sizeof(rcipher.type)); 71 71 ··· 97 93 u64 v64; 98 94 u32 v32; 99 95 96 + memset(&rcomp, 0, sizeof(rcomp)); 97 + 100 98 strlcpy(rcomp.type, "compression", sizeof(rcomp.type)); 101 99 v32 = atomic_read(&alg->compress_cnt); 102 100 rcomp.stat_compress_cnt = v32; ··· 126 120 u64 v64; 127 121 u32 v32; 128 122 123 + memset(&racomp, 0, sizeof(racomp)); 124 + 129 125 strlcpy(racomp.type, "acomp", sizeof(racomp.type)); 130 126 v32 = atomic_read(&alg->compress_cnt); 131 127 racomp.stat_compress_cnt = v32; ··· 154 146 struct crypto_stat rakcipher; 155 147 u64 v64; 156 148 u32 v32; 149 + 150 + memset(&rakcipher, 0, sizeof(rakcipher)); 157 151 158 152 strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); 159 153 v32 = atomic_read(&alg->encrypt_cnt); ··· 187 177 struct crypto_stat rkpp; 188 178 u32 v; 189 179 180 + memset(&rkpp, 0, sizeof(rkpp)); 181 + 190 182 strlcpy(rkpp.type, "kpp", sizeof(rkpp.type)); 191 183 192 184 v = atomic_read(&alg->setsecret_cnt); ··· 215 203 u64 v64; 216 204 u32 v32; 217 205 206 + memset(&rhash, 0, sizeof(rhash)); 207 + 218 208 strncpy(rhash.type, "ahash", sizeof(rhash.type)); 219 209 220 210 v32 = atomic_read(&alg->hash_cnt); ··· 240 226 struct crypto_stat rhash; 241 227 u64 v64; 242 228 u32 v32; 229 + 230 + memset(&rhash, 0, sizeof(rhash)); 243 231 244 232 strncpy(rhash.type, "shash", sizeof(rhash.type)); 245 233 ··· 267 251 u64 v64; 268 252 u32 v32; 269 253 254 + memset(&rrng, 0, sizeof(rrng)); 255 + 270 256 strncpy(rrng.type, "rng", sizeof(rrng.type)); 271 257 272 258 v32 = atomic_read(&alg->generate_cnt); ··· 293 275 struct crypto_user_alg *ualg, 294 276 struct sk_buff *skb) 295 277 { 278 + memset(ualg, 0, sizeof(*ualg)); 279 + 296 280 strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); 297 281 strlcpy(ualg->cru_driver_name, alg->cra_driver_name, 298 282 sizeof(ualg->cru_driver_name)); ··· 311 291 if (alg->cra_flags & CRYPTO_ALG_LARVAL) { 312 292 struct crypto_stat rl; 313 293 294 + memset(&rl, 0, sizeof(rl)); 314 295 strlcpy(rl.type, "larval", sizeof(rl.type)); 315 296 if (nla_put(skb, CRYPTOCFGA_STAT_LARVAL, 316 297 sizeof(struct crypto_stat), &rl))
+3 -2
crypto/simd.c
··· 124 124 125 125 ctx->cryptd_tfm = cryptd_tfm; 126 126 127 - reqsize = sizeof(struct skcipher_request); 128 - reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base); 127 + reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm)); 128 + reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base)); 129 + reqsize += sizeof(struct skcipher_request); 129 130 130 131 crypto_skcipher_set_reqsize(tfm, reqsize); 131 132
+17 -14
drivers/crypto/hisilicon/sec/sec_algs.c
··· 732 732 int *splits_in_nents; 733 733 int *splits_out_nents = NULL; 734 734 struct sec_request_el *el, *temp; 735 + bool split = skreq->src != skreq->dst; 735 736 736 737 mutex_init(&sec_req->lock); 737 738 sec_req->req_base = &skreq->base; ··· 751 750 if (ret) 752 751 goto err_free_split_sizes; 753 752 754 - if (skreq->src != skreq->dst) { 753 + if (split) { 755 754 sec_req->len_out = sg_nents(skreq->dst); 756 755 ret = sec_map_and_split_sg(skreq->dst, split_sizes, steps, 757 756 &splits_out, &splits_out_nents, ··· 786 785 split_sizes[i], 787 786 skreq->src != skreq->dst, 788 787 splits_in[i], splits_in_nents[i], 789 - splits_out[i], 790 - splits_out_nents[i], info); 788 + split ? splits_out[i] : NULL, 789 + split ? splits_out_nents[i] : 0, 790 + info); 791 791 if (IS_ERR(el)) { 792 792 ret = PTR_ERR(el); 793 793 goto err_free_elements; ··· 808 806 * more refined but this is unlikely to happen so no need. 809 807 */ 810 808 811 - /* Cleanup - all elements in pointer arrays have been coppied */ 812 - kfree(splits_in_nents); 813 - kfree(splits_in); 814 - kfree(splits_out_nents); 815 - kfree(splits_out); 816 - kfree(split_sizes); 817 - 818 809 /* Grab a big lock for a long time to avoid concurrency issues */ 819 810 mutex_lock(&queue->queuelock); 820 811 ··· 822 827 (!queue->havesoftqueue || 823 828 kfifo_avail(&queue->softqueue) > steps)) || 824 829 !list_empty(&ctx->backlog)) { 830 + ret = -EBUSY; 825 831 if ((skreq->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) { 826 832 list_add_tail(&sec_req->backlog_head, &ctx->backlog); 827 833 mutex_unlock(&queue->queuelock); 828 - return -EBUSY; 834 + goto out; 829 835 } 830 836 831 - ret = -EBUSY; 832 837 mutex_unlock(&queue->queuelock); 833 838 goto err_free_elements; 834 839 } ··· 837 842 if (ret) 838 843 goto err_free_elements; 839 844 840 - return -EINPROGRESS; 845 + ret = -EINPROGRESS; 846 + out: 847 + /* Cleanup - all elements in pointer arrays have been copied */ 848 + kfree(splits_in_nents); 849 + kfree(splits_in); 850 + kfree(splits_out_nents); 851 + kfree(splits_out); 852 + kfree(split_sizes); 853 + return ret; 841 854 842 855 err_free_elements: 843 856 list_for_each_entry_safe(el, temp, &sec_req->elements, head) { ··· 857 854 crypto_skcipher_ivsize(atfm), 858 855 DMA_BIDIRECTIONAL); 859 856 err_unmap_out_sg: 860 - if (skreq->src != skreq->dst) 857 + if (split) 861 858 sec_unmap_sg_on_err(skreq->dst, steps, splits_out, 862 859 splits_out_nents, sec_req->len_out, 863 860 info->dev);