From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72CD1C433E7 for ; Fri, 16 Oct 2020 09:14:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DEEEA20872 for ; Fri, 16 Oct 2020 09:14:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839652; bh=X8ZmBhuNsVT9n3vXbjxcf5tdLClOZHm7JoeUkznqPbk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=cfGj2ei1Vp9CvJV3YdcZPPkaUAhpXvERQqJQzmRDG5nxlXmXyrigk4L//govpBVkB U/FdfvXc9VGRhEsH1JFuXx5RTglkN3/LYx2kygq3VpKEKynPjcHlsNI+rcdMMyw//j jPU4inJPsvDxJ7sAEHcu4oJpJEOADdudZ46q4RZw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2395004AbgJPJOK (ORCPT ); Fri, 16 Oct 2020 05:14:10 -0400 Received: from mail.kernel.org ([198.145.29.99]:40742 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405797AbgJPJLO (ORCPT ); Fri, 16 Oct 2020 05:11:14 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C78C522200; Fri, 16 Oct 2020 09:11:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839469; bh=X8ZmBhuNsVT9n3vXbjxcf5tdLClOZHm7JoeUkznqPbk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=crbGlvULyWnZ5MrCbg6IuvvpknojOJxn6WSWE6D32UI7P8NjgaKCm5q8rQwyDdl72 CGOwo1KMSn1jG/9gkbuBaiUCMw3fFracl5gHOaiKXF7qf6oUpEvPPzDiRPDtJVx582 xMhWu88V8EdLBIXlHdoWL6DiPLnzdMJNm9mDRNSU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dominik Przychodni , Giovanni Cabiddu , Herbert Xu Subject: [PATCH 5.8 02/14] crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA Date: Fri, 16 Oct 2020 11:07:47 +0200 Message-Id: <20201016090437.279401863@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201016090437.153175229@linuxfoundation.org> References: <20201016090437.153175229@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dominik Przychodni commit 45cb6653b0c355fc1445a8069ba78a4ce8720511 upstream. Return -EINVAL for authenc(hmac(sha1),cbc(aes)), authenc(hmac(sha256),cbc(aes)) and authenc(hmac(sha512),cbc(aes)) if the cipher length is not multiple of the AES block. This is to prevent an undefined device behaviour. Fixes: d370cec32194 ("crypto: qat - Intel(R) QAT crypto interface") Cc: Signed-off-by: Dominik Przychodni [giovanni.cabiddu@intel.com: reworded commit message] Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/qat/qat_common/qat_algs.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) --- a/drivers/crypto/qat/qat_common/qat_algs.c +++ b/drivers/crypto/qat/qat_common/qat_algs.c @@ -871,6 +871,11 @@ static int qat_alg_aead_dec(struct aead_ struct icp_qat_fw_la_bulk_req *msg; int digst_size = crypto_aead_authsize(aead_tfm); int ret, ctr = 0; + u32 cipher_len; + + cipher_len = areq->cryptlen - digst_size; + if (cipher_len % AES_BLOCK_SIZE != 0) + return -EINVAL; ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); if (unlikely(ret)) @@ -885,7 +890,7 @@ static int qat_alg_aead_dec(struct aead_ qat_req->req.comn_mid.src_data_addr = qat_req->buf.blp; qat_req->req.comn_mid.dest_data_addr = qat_req->buf.bloutp; cipher_param = (void *)&qat_req->req.serv_specif_rqpars; - cipher_param->cipher_length = areq->cryptlen - digst_size; + cipher_param->cipher_length = cipher_len; cipher_param->cipher_offset = areq->assoclen; memcpy(cipher_param->u.cipher_IV_array, areq->iv, AES_BLOCK_SIZE); auth_param = (void *)((uint8_t *)cipher_param + sizeof(*cipher_param)); @@ -914,6 +919,9 @@ static int qat_alg_aead_enc(struct aead_ uint8_t *iv = areq->iv; int ret, ctr = 0; + if (areq->cryptlen % AES_BLOCK_SIZE != 0) + return -EINVAL; + ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); if (unlikely(ret)) return ret;