From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61AC6C43457 for ; Fri, 16 Oct 2020 09:08:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0CC782145D for ; Fri, 16 Oct 2020 09:08:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839288; bh=OA9ojlJD5BvhFcZM4dGPho+S/jI+oo7Wg7S4ULiNr1o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=0PtpmeiiUtwF8GuV5KBtyZ1Ja8h2mZGPbuA08PRxNH7Jv+d+MyXfryrtxcH4zRXbo Xnq2KY7vbvojYdZo6o62z4W5Q7B2IH4huPazd7FitRlHGGL5otCugG3pyk55nnqsnk plRcVDHAtiZmFXP63UGs2SLbC81JxTG38oSnoZL4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405451AbgJPJIG (ORCPT ); Fri, 16 Oct 2020 05:08:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:36134 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2394923AbgJPJHt (ORCPT ); Fri, 16 Oct 2020 05:07:49 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EA9EF20872; Fri, 16 Oct 2020 09:07:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839268; bh=OA9ojlJD5BvhFcZM4dGPho+S/jI+oo7Wg7S4ULiNr1o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yq0Ddy8I9GxQYlSjIpi3hZpmg0Snl7nXH25deeQAqqTB3hc7So1uWTFeMhLB/U0ek fTMlgR8RqYN1+Eqbv9PLwABTx55MDRS7vA20d/43bXZOfgURs7fJe9F1r07nl/khtP p7QDU6kSHAUk2TMvv8d1m2MIcfNHxXRgUfL0ICz4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dominik Przychodni , Giovanni Cabiddu , Herbert Xu Subject: [PATCH 4.9 16/16] crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA Date: Fri, 16 Oct 2020 11:07:20 +0200 Message-Id: <20201016090438.004719238@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201016090437.205626543@linuxfoundation.org> References: <20201016090437.205626543@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dominik Przychodni commit 45cb6653b0c355fc1445a8069ba78a4ce8720511 upstream. Return -EINVAL for authenc(hmac(sha1),cbc(aes)), authenc(hmac(sha256),cbc(aes)) and authenc(hmac(sha512),cbc(aes)) if the cipher length is not multiple of the AES block. This is to prevent an undefined device behaviour. Fixes: d370cec32194 ("crypto: qat - Intel(R) QAT crypto interface") Cc: Signed-off-by: Dominik Przychodni [giovanni.cabiddu@intel.com: reworded commit message] Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/qat/qat_common/qat_algs.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) --- a/drivers/crypto/qat/qat_common/qat_algs.c +++ b/drivers/crypto/qat/qat_common/qat_algs.c @@ -822,6 +822,11 @@ static int qat_alg_aead_dec(struct aead_ struct icp_qat_fw_la_bulk_req *msg; int digst_size = crypto_aead_authsize(aead_tfm); int ret, ctr = 0; + u32 cipher_len; + + cipher_len = areq->cryptlen - digst_size; + if (cipher_len % AES_BLOCK_SIZE != 0) + return -EINVAL; ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); if (unlikely(ret)) @@ -836,7 +841,7 @@ static int qat_alg_aead_dec(struct aead_ qat_req->req.comn_mid.src_data_addr = qat_req->buf.blp; qat_req->req.comn_mid.dest_data_addr = qat_req->buf.bloutp; cipher_param = (void *)&qat_req->req.serv_specif_rqpars; - cipher_param->cipher_length = areq->cryptlen - digst_size; + cipher_param->cipher_length = cipher_len; cipher_param->cipher_offset = areq->assoclen; memcpy(cipher_param->u.cipher_IV_array, areq->iv, AES_BLOCK_SIZE); auth_param = (void *)((uint8_t *)cipher_param + sizeof(*cipher_param)); @@ -865,6 +870,9 @@ static int qat_alg_aead_enc(struct aead_ uint8_t *iv = areq->iv; int ret, ctr = 0; + if (areq->cryptlen % AES_BLOCK_SIZE != 0) + return -EINVAL; + ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); if (unlikely(ret)) return ret;