From: Ondrej Mosnacek <omosnace@redhat.com>
To: Eric Biggers <ebiggers@kernel.org>
Cc: linux-crypto@vger.kernel.org,
Herbert Xu <herbert@gondor.apana.org.au>,
Linux kernel mailing list <linux-kernel@vger.kernel.org>,
stable@vger.kernel.org
Subject: Re: [PATCH v2 02/15] crypto: morus - fix handling chunked inputs
Date: Tue, 5 Feb 2019 10:30:57 +0100 [thread overview]
Message-ID: <CAFqZXNtqwiEZCd1Ua2NMHX8Lr20ptbM7yQL5m-bwXUztXGAWdA@mail.gmail.com> (raw)
In-Reply-To: <20190201075150.18644-3-ebiggers@kernel.org>
On Fri, Feb 1, 2019 at 8:52 AM Eric Biggers <ebiggers@kernel.org> wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> The generic MORUS implementations all fail the improved AEAD tests
> because they produce the wrong result with some data layouts. The issue
> is that they assume that if the skcipher_walk API gives 'nbytes' not
> aligned to the walksize (a.k.a. walk.stride), then it is the end of the
> data. In fact, this can happen before the end. Fix them.
>
> Fixes: 396be41f16fd ("crypto: morus - Add generic MORUS AEAD implementations")
> Cc: <stable@vger.kernel.org> # v4.18+
> Cc: Ondrej Mosnacek <omosnace@redhat.com>
> Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
> ---
> crypto/morus1280.c | 13 +++++++------
> crypto/morus640.c | 13 +++++++------
> 2 files changed, 14 insertions(+), 12 deletions(-)
>
> diff --git a/crypto/morus1280.c b/crypto/morus1280.c
> index 78ba09db7328c..0747732d5b78a 100644
> --- a/crypto/morus1280.c
> +++ b/crypto/morus1280.c
> @@ -362,18 +362,19 @@ static void crypto_morus1280_process_crypt(struct morus1280_state *state,
> const struct morus1280_ops *ops)
> {
> struct skcipher_walk walk;
> - u8 *dst;
> - const u8 *src;
>
> ops->skcipher_walk_init(&walk, req, false);
>
> while (walk.nbytes) {
> - src = walk.src.virt.addr;
> - dst = walk.dst.virt.addr;
> + unsigned int nbytes = walk.nbytes;
>
> - ops->crypt_chunk(state, dst, src, walk.nbytes);
> + if (nbytes < walk.total)
> + nbytes = round_down(nbytes, walk.stride);
>
> - skcipher_walk_done(&walk, 0);
> + ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
> + nbytes);
> +
> + skcipher_walk_done(&walk, walk.nbytes - nbytes);
> }
> }
>
> diff --git a/crypto/morus640.c b/crypto/morus640.c
> index 5cf530139b271..1617a1eb8be13 100644
> --- a/crypto/morus640.c
> +++ b/crypto/morus640.c
> @@ -361,18 +361,19 @@ static void crypto_morus640_process_crypt(struct morus640_state *state,
> const struct morus640_ops *ops)
> {
> struct skcipher_walk walk;
> - u8 *dst;
> - const u8 *src;
>
> ops->skcipher_walk_init(&walk, req, false);
>
> while (walk.nbytes) {
> - src = walk.src.virt.addr;
> - dst = walk.dst.virt.addr;
> + unsigned int nbytes = walk.nbytes;
>
> - ops->crypt_chunk(state, dst, src, walk.nbytes);
> + if (nbytes < walk.total)
> + nbytes = round_down(nbytes, walk.stride);
>
> - skcipher_walk_done(&walk, 0);
> + ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
> + nbytes);
> +
> + skcipher_walk_done(&walk, walk.nbytes - nbytes);
> }
> }
>
> --
> 2.20.1
>
--
Ondrej Mosnacek <omosnace at redhat dot com>
Associate Software Engineer, Security Technologies
Red Hat, Inc.
next prev parent reply other threads:[~2019-02-05 9:31 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-01 7:51 [PATCH v2 00/15] crypto: improved skcipher, aead, and hash tests Eric Biggers
2019-02-01 7:51 ` [PATCH v2 01/15] crypto: aegis - fix handling chunked inputs Eric Biggers
2019-02-05 9:31 ` Ondrej Mosnacek
2019-02-01 7:51 ` [PATCH v2 02/15] crypto: morus " Eric Biggers
2019-02-05 9:30 ` Ondrej Mosnacek [this message]
2019-02-01 7:51 ` [PATCH v2 03/15] crypto: x86/aegis - fix handling chunked inputs and MAY_SLEEP Eric Biggers
2019-02-05 9:31 ` Ondrej Mosnacek
2019-02-01 7:51 ` [PATCH v2 04/15] crypto: x86/morus " Eric Biggers
2019-02-05 9:32 ` Ondrej Mosnacek
2019-02-01 7:51 ` [PATCH v2 05/15] crypto: x86/aesni-gcm - fix crash on empty plaintext Eric Biggers
2019-02-01 7:51 ` [PATCH v2 06/15] crypto: ahash - fix another early termination in hash walk Eric Biggers
2019-02-01 7:51 ` [PATCH v2 07/15] crypto: arm64/aes-neonbs - fix returning final keystream block Eric Biggers
2019-02-01 7:51 ` [PATCH v2 08/15] crypto: testmgr - add testvec_config struct and helper functions Eric Biggers
2019-02-01 7:51 ` [PATCH v2 09/15] crypto: testmgr - introduce CONFIG_CRYPTO_MANAGER_EXTRA_TESTS Eric Biggers
2019-02-01 7:51 ` [PATCH v2 10/15] crypto: testmgr - implement random testvec_config generation Eric Biggers
2019-02-01 7:51 ` [PATCH v2 11/15] crypto: testmgr - convert skcipher testing to use testvec_configs Eric Biggers
2019-02-01 7:51 ` [PATCH v2 12/15] crypto: testmgr - convert aead " Eric Biggers
2019-02-01 7:51 ` [PATCH v2 13/15] crypto: testmgr - convert hash " Eric Biggers
2019-08-29 15:32 ` Christophe Leroy
2019-08-29 15:58 ` Eric Biggers
2019-02-01 7:51 ` [PATCH v2 14/15] crypto: testmgr - check for skcipher_request corruption Eric Biggers
2019-02-01 7:51 ` [PATCH v2 15/15] crypto: testmgr - check for aead_request corruption Eric Biggers
2019-02-08 7:47 ` [PATCH v2 00/15] crypto: improved skcipher, aead, and hash tests Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFqZXNtqwiEZCd1Ua2NMHX8Lr20ptbM7yQL5m-bwXUztXGAWdA@mail.gmail.com \
--to=omosnace@redhat.com \
--cc=ebiggers@kernel.org \
--cc=herbert@gondor.apana.org.au \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).