Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
crypto: qce - Restore/save ahash state with custom struct in export/import
Export and import interfaces save and restore partial transformation
states. The partial states were being stored and restored in struct
sha1_state for sha1/hmac(sha1) transformations and sha256_state for
sha256/hmac(sha256) transformations.This led to a bunch of corner cases
where improper state was being stored and restored. A few of the corner
cases that turned up during testing are:
- wrong byte_count restored if export/import is called twice without h/w
transaction in between
- wrong buflen restored back if the pending buffer
length is exactly the block size.
- wrong state restored if buffer length is 0.
To fix these issues, save and restore the partial transformation state
using the newly introduced qce_sha_saved_state struct. This ensures that
all the pieces required to properly restart the transformation is captured
and restored back
Signed-off-by: Thara Gopinath <thara.gopinath@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
authored by
Thara Gopinath
and committed by
Herbert Xu
a01dc5c1
2eee428d
+34
-88
+34
-88
drivers/crypto/qce/sha.c
+34
-88
drivers/crypto/qce/sha.c
···
12
12
#include "core.h"
13
13
#include "sha.h"
14
14
15
-
/* crypto hw padding constant for first operation */
16
-
#define SHA_PADDING 64
17
-
#define SHA_PADDING_MASK (SHA_PADDING - 1)
15
+
struct qce_sha_saved_state {
16
+
u8 pending_buf[QCE_SHA_MAX_BLOCKSIZE];
17
+
u8 partial_digest[QCE_SHA_MAX_DIGESTSIZE];
18
+
__be32 byte_count[2];
19
+
unsigned int pending_buflen;
20
+
unsigned int flags;
21
+
u64 count;
22
+
bool first_blk;
23
+
};
18
24
19
25
static LIST_HEAD(ahash_algs);
20
26
···
145
139
146
140
static int qce_ahash_export(struct ahash_request *req, void *out)
147
141
{
148
-
struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
149
142
struct qce_sha_reqctx *rctx = ahash_request_ctx(req);
150
-
unsigned long flags = rctx->flags;
151
-
unsigned int digestsize = crypto_ahash_digestsize(ahash);
152
-
unsigned int blocksize =
153
-
crypto_tfm_alg_blocksize(crypto_ahash_tfm(ahash));
143
+
struct qce_sha_saved_state *export_state = out;
154
144
155
-
if (IS_SHA1(flags) || IS_SHA1_HMAC(flags)) {
156
-
struct sha1_state *out_state = out;
157
-
158
-
out_state->count = rctx->count;
159
-
qce_cpu_to_be32p_array((__be32 *)out_state->state,
160
-
rctx->digest, digestsize);
161
-
memcpy(out_state->buffer, rctx->buf, blocksize);
162
-
} else if (IS_SHA256(flags) || IS_SHA256_HMAC(flags)) {
163
-
struct sha256_state *out_state = out;
164
-
165
-
out_state->count = rctx->count;
166
-
qce_cpu_to_be32p_array((__be32 *)out_state->state,
167
-
rctx->digest, digestsize);
168
-
memcpy(out_state->buf, rctx->buf, blocksize);
169
-
} else {
170
-
return -EINVAL;
171
-
}
172
-
173
-
return 0;
174
-
}
175
-
176
-
static int qce_import_common(struct ahash_request *req, u64 in_count,
177
-
const u32 *state, const u8 *buffer, bool hmac)
178
-
{
179
-
struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
180
-
struct qce_sha_reqctx *rctx = ahash_request_ctx(req);
181
-
unsigned int digestsize = crypto_ahash_digestsize(ahash);
182
-
unsigned int blocksize;
183
-
u64 count = in_count;
184
-
185
-
blocksize = crypto_tfm_alg_blocksize(crypto_ahash_tfm(ahash));
186
-
rctx->count = in_count;
187
-
memcpy(rctx->buf, buffer, blocksize);
188
-
189
-
if (in_count <= blocksize) {
190
-
rctx->first_blk = 1;
191
-
} else {
192
-
rctx->first_blk = 0;
193
-
/*
194
-
* For HMAC, there is a hardware padding done when first block
195
-
* is set. Therefore the byte_count must be incremened by 64
196
-
* after the first block operation.
197
-
*/
198
-
if (hmac)
199
-
count += SHA_PADDING;
200
-
}
201
-
202
-
rctx->byte_count[0] = (__force __be32)(count & ~SHA_PADDING_MASK);
203
-
rctx->byte_count[1] = (__force __be32)(count >> 32);
204
-
qce_cpu_to_be32p_array((__be32 *)rctx->digest, (const u8 *)state,
205
-
digestsize);
206
-
rctx->buflen = (unsigned int)(in_count & (blocksize - 1));
145
+
memcpy(export_state->pending_buf, rctx->buf, rctx->buflen);
146
+
memcpy(export_state->partial_digest, rctx->digest, sizeof(rctx->digest));
147
+
export_state->byte_count[0] = rctx->byte_count[0];
148
+
export_state->byte_count[1] = rctx->byte_count[1];
149
+
export_state->pending_buflen = rctx->buflen;
150
+
export_state->count = rctx->count;
151
+
export_state->first_blk = rctx->first_blk;
152
+
export_state->flags = rctx->flags;
207
153
208
154
return 0;
209
155
}
210
156
211
157
static int qce_ahash_import(struct ahash_request *req, const void *in)
212
158
{
213
-
struct qce_sha_reqctx *rctx;
214
-
unsigned long flags;
215
-
bool hmac;
216
-
int ret;
159
+
struct qce_sha_reqctx *rctx = ahash_request_ctx(req);
160
+
const struct qce_sha_saved_state *import_state = in;
217
161
218
-
ret = qce_ahash_init(req);
219
-
if (ret)
220
-
return ret;
162
+
memset(rctx, 0, sizeof(*rctx));
163
+
rctx->count = import_state->count;
164
+
rctx->buflen = import_state->pending_buflen;
165
+
rctx->first_blk = import_state->first_blk;
166
+
rctx->flags = import_state->flags;
167
+
rctx->byte_count[0] = import_state->byte_count[0];
168
+
rctx->byte_count[1] = import_state->byte_count[1];
169
+
memcpy(rctx->buf, import_state->pending_buf, rctx->buflen);
170
+
memcpy(rctx->digest, import_state->partial_digest, sizeof(rctx->digest));
221
171
222
-
rctx = ahash_request_ctx(req);
223
-
flags = rctx->flags;
224
-
hmac = IS_SHA_HMAC(flags);
225
-
226
-
if (IS_SHA1(flags) || IS_SHA1_HMAC(flags)) {
227
-
const struct sha1_state *state = in;
228
-
229
-
ret = qce_import_common(req, state->count, state->state,
230
-
state->buffer, hmac);
231
-
} else if (IS_SHA256(flags) || IS_SHA256_HMAC(flags)) {
232
-
const struct sha256_state *state = in;
233
-
234
-
ret = qce_import_common(req, state->count, state->state,
235
-
state->buf, hmac);
236
-
}
237
-
238
-
return ret;
172
+
return 0;
239
173
}
240
174
241
175
static int qce_ahash_update(struct ahash_request *req)
···
396
450
.drv_name = "sha1-qce",
397
451
.digestsize = SHA1_DIGEST_SIZE,
398
452
.blocksize = SHA1_BLOCK_SIZE,
399
-
.statesize = sizeof(struct sha1_state),
453
+
.statesize = sizeof(struct qce_sha_saved_state),
400
454
.std_iv = std_iv_sha1,
401
455
},
402
456
{
···
405
459
.drv_name = "sha256-qce",
406
460
.digestsize = SHA256_DIGEST_SIZE,
407
461
.blocksize = SHA256_BLOCK_SIZE,
408
-
.statesize = sizeof(struct sha256_state),
462
+
.statesize = sizeof(struct qce_sha_saved_state),
409
463
.std_iv = std_iv_sha256,
410
464
},
411
465
{
···
414
468
.drv_name = "hmac-sha1-qce",
415
469
.digestsize = SHA1_DIGEST_SIZE,
416
470
.blocksize = SHA1_BLOCK_SIZE,
417
-
.statesize = sizeof(struct sha1_state),
471
+
.statesize = sizeof(struct qce_sha_saved_state),
418
472
.std_iv = std_iv_sha1,
419
473
},
420
474
{
···
423
477
.drv_name = "hmac-sha256-qce",
424
478
.digestsize = SHA256_DIGEST_SIZE,
425
479
.blocksize = SHA256_BLOCK_SIZE,
426
-
.statesize = sizeof(struct sha256_state),
480
+
.statesize = sizeof(struct qce_sha_saved_state),
427
481
.std_iv = std_iv_sha256,
428
482
},
429
483
};