Commit 6c3efdc9 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:
 "This fixes a bunch of bugs detected by KASAN in the caam driver"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: caam - fix the address of the last entry of S/G
  crypto: caam - fix use-after-free KASAN issue for RSA algorithms
  crypto: caam - fix use-after-free KASAN issue for HASH algorithms
  crypto: caam - fix use-after-free KASAN issue for AEAD algorithms
  crypto: caam - fix use-after-free KASAN issue for SKCIPHER algorithms
parents 96c9a780 55b3209a
...@@ -963,10 +963,12 @@ static void aead_crypt_done(struct device *jrdev, u32 *desc, u32 err, ...@@ -963,10 +963,12 @@ static void aead_crypt_done(struct device *jrdev, u32 *desc, u32 err,
struct caam_drv_private_jr *jrp = dev_get_drvdata(jrdev); struct caam_drv_private_jr *jrp = dev_get_drvdata(jrdev);
struct aead_edesc *edesc; struct aead_edesc *edesc;
int ecode = 0; int ecode = 0;
bool has_bklog;
dev_dbg(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err); dev_dbg(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err);
edesc = rctx->edesc; edesc = rctx->edesc;
has_bklog = edesc->bklog;
if (err) if (err)
ecode = caam_jr_strstatus(jrdev, err); ecode = caam_jr_strstatus(jrdev, err);
...@@ -979,7 +981,7 @@ static void aead_crypt_done(struct device *jrdev, u32 *desc, u32 err, ...@@ -979,7 +981,7 @@ static void aead_crypt_done(struct device *jrdev, u32 *desc, u32 err,
* If no backlog flag, the completion of the request is done * If no backlog flag, the completion of the request is done
* by CAAM, not crypto engine. * by CAAM, not crypto engine.
*/ */
if (!edesc->bklog) if (!has_bklog)
aead_request_complete(req, ecode); aead_request_complete(req, ecode);
else else
crypto_finalize_aead_request(jrp->engine, req, ecode); crypto_finalize_aead_request(jrp->engine, req, ecode);
...@@ -995,10 +997,12 @@ static void skcipher_crypt_done(struct device *jrdev, u32 *desc, u32 err, ...@@ -995,10 +997,12 @@ static void skcipher_crypt_done(struct device *jrdev, u32 *desc, u32 err,
struct caam_drv_private_jr *jrp = dev_get_drvdata(jrdev); struct caam_drv_private_jr *jrp = dev_get_drvdata(jrdev);
int ivsize = crypto_skcipher_ivsize(skcipher); int ivsize = crypto_skcipher_ivsize(skcipher);
int ecode = 0; int ecode = 0;
bool has_bklog;
dev_dbg(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err); dev_dbg(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err);
edesc = rctx->edesc; edesc = rctx->edesc;
has_bklog = edesc->bklog;
if (err) if (err)
ecode = caam_jr_strstatus(jrdev, err); ecode = caam_jr_strstatus(jrdev, err);
...@@ -1028,7 +1032,7 @@ static void skcipher_crypt_done(struct device *jrdev, u32 *desc, u32 err, ...@@ -1028,7 +1032,7 @@ static void skcipher_crypt_done(struct device *jrdev, u32 *desc, u32 err,
* If no backlog flag, the completion of the request is done * If no backlog flag, the completion of the request is done
* by CAAM, not crypto engine. * by CAAM, not crypto engine.
*/ */
if (!edesc->bklog) if (!has_bklog)
skcipher_request_complete(req, ecode); skcipher_request_complete(req, ecode);
else else
crypto_finalize_skcipher_request(jrp->engine, req, ecode); crypto_finalize_skcipher_request(jrp->engine, req, ecode);
...@@ -1711,7 +1715,7 @@ static struct skcipher_edesc *skcipher_edesc_alloc(struct skcipher_request *req, ...@@ -1711,7 +1715,7 @@ static struct skcipher_edesc *skcipher_edesc_alloc(struct skcipher_request *req,
if (ivsize || mapped_dst_nents > 1) if (ivsize || mapped_dst_nents > 1)
sg_to_sec4_set_last(edesc->sec4_sg + dst_sg_idx + sg_to_sec4_set_last(edesc->sec4_sg + dst_sg_idx +
mapped_dst_nents); mapped_dst_nents - 1 + !!ivsize);
if (sec4_sg_bytes) { if (sec4_sg_bytes) {
edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg, edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg,
......
...@@ -583,10 +583,12 @@ static inline void ahash_done_cpy(struct device *jrdev, u32 *desc, u32 err, ...@@ -583,10 +583,12 @@ static inline void ahash_done_cpy(struct device *jrdev, u32 *desc, u32 err,
struct caam_hash_state *state = ahash_request_ctx(req); struct caam_hash_state *state = ahash_request_ctx(req);
struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash); struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash);
int ecode = 0; int ecode = 0;
bool has_bklog;
dev_dbg(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err); dev_dbg(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err);
edesc = state->edesc; edesc = state->edesc;
has_bklog = edesc->bklog;
if (err) if (err)
ecode = caam_jr_strstatus(jrdev, err); ecode = caam_jr_strstatus(jrdev, err);
...@@ -603,7 +605,7 @@ static inline void ahash_done_cpy(struct device *jrdev, u32 *desc, u32 err, ...@@ -603,7 +605,7 @@ static inline void ahash_done_cpy(struct device *jrdev, u32 *desc, u32 err,
* If no backlog flag, the completion of the request is done * If no backlog flag, the completion of the request is done
* by CAAM, not crypto engine. * by CAAM, not crypto engine.
*/ */
if (!edesc->bklog) if (!has_bklog)
req->base.complete(&req->base, ecode); req->base.complete(&req->base, ecode);
else else
crypto_finalize_hash_request(jrp->engine, req, ecode); crypto_finalize_hash_request(jrp->engine, req, ecode);
...@@ -632,10 +634,12 @@ static inline void ahash_done_switch(struct device *jrdev, u32 *desc, u32 err, ...@@ -632,10 +634,12 @@ static inline void ahash_done_switch(struct device *jrdev, u32 *desc, u32 err,
struct caam_hash_state *state = ahash_request_ctx(req); struct caam_hash_state *state = ahash_request_ctx(req);
int digestsize = crypto_ahash_digestsize(ahash); int digestsize = crypto_ahash_digestsize(ahash);
int ecode = 0; int ecode = 0;
bool has_bklog;
dev_dbg(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err); dev_dbg(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err);
edesc = state->edesc; edesc = state->edesc;
has_bklog = edesc->bklog;
if (err) if (err)
ecode = caam_jr_strstatus(jrdev, err); ecode = caam_jr_strstatus(jrdev, err);
...@@ -663,7 +667,7 @@ static inline void ahash_done_switch(struct device *jrdev, u32 *desc, u32 err, ...@@ -663,7 +667,7 @@ static inline void ahash_done_switch(struct device *jrdev, u32 *desc, u32 err,
* If no backlog flag, the completion of the request is done * If no backlog flag, the completion of the request is done
* by CAAM, not crypto engine. * by CAAM, not crypto engine.
*/ */
if (!edesc->bklog) if (!has_bklog)
req->base.complete(&req->base, ecode); req->base.complete(&req->base, ecode);
else else
crypto_finalize_hash_request(jrp->engine, req, ecode); crypto_finalize_hash_request(jrp->engine, req, ecode);
......
...@@ -121,11 +121,13 @@ static void rsa_pub_done(struct device *dev, u32 *desc, u32 err, void *context) ...@@ -121,11 +121,13 @@ static void rsa_pub_done(struct device *dev, u32 *desc, u32 err, void *context)
struct caam_drv_private_jr *jrp = dev_get_drvdata(dev); struct caam_drv_private_jr *jrp = dev_get_drvdata(dev);
struct rsa_edesc *edesc; struct rsa_edesc *edesc;
int ecode = 0; int ecode = 0;
bool has_bklog;
if (err) if (err)
ecode = caam_jr_strstatus(dev, err); ecode = caam_jr_strstatus(dev, err);
edesc = req_ctx->edesc; edesc = req_ctx->edesc;
has_bklog = edesc->bklog;
rsa_pub_unmap(dev, edesc, req); rsa_pub_unmap(dev, edesc, req);
rsa_io_unmap(dev, edesc, req); rsa_io_unmap(dev, edesc, req);
...@@ -135,7 +137,7 @@ static void rsa_pub_done(struct device *dev, u32 *desc, u32 err, void *context) ...@@ -135,7 +137,7 @@ static void rsa_pub_done(struct device *dev, u32 *desc, u32 err, void *context)
* If no backlog flag, the completion of the request is done * If no backlog flag, the completion of the request is done
* by CAAM, not crypto engine. * by CAAM, not crypto engine.
*/ */
if (!edesc->bklog) if (!has_bklog)
akcipher_request_complete(req, ecode); akcipher_request_complete(req, ecode);
else else
crypto_finalize_akcipher_request(jrp->engine, req, ecode); crypto_finalize_akcipher_request(jrp->engine, req, ecode);
...@@ -152,11 +154,13 @@ static void rsa_priv_f_done(struct device *dev, u32 *desc, u32 err, ...@@ -152,11 +154,13 @@ static void rsa_priv_f_done(struct device *dev, u32 *desc, u32 err,
struct caam_rsa_req_ctx *req_ctx = akcipher_request_ctx(req); struct caam_rsa_req_ctx *req_ctx = akcipher_request_ctx(req);
struct rsa_edesc *edesc; struct rsa_edesc *edesc;
int ecode = 0; int ecode = 0;
bool has_bklog;
if (err) if (err)
ecode = caam_jr_strstatus(dev, err); ecode = caam_jr_strstatus(dev, err);
edesc = req_ctx->edesc; edesc = req_ctx->edesc;
has_bklog = edesc->bklog;
switch (key->priv_form) { switch (key->priv_form) {
case FORM1: case FORM1:
...@@ -176,7 +180,7 @@ static void rsa_priv_f_done(struct device *dev, u32 *desc, u32 err, ...@@ -176,7 +180,7 @@ static void rsa_priv_f_done(struct device *dev, u32 *desc, u32 err,
* If no backlog flag, the completion of the request is done * If no backlog flag, the completion of the request is done
* by CAAM, not crypto engine. * by CAAM, not crypto engine.
*/ */
if (!edesc->bklog) if (!has_bklog)
akcipher_request_complete(req, ecode); akcipher_request_complete(req, ecode);
else else
crypto_finalize_akcipher_request(jrp->engine, req, ecode); crypto_finalize_akcipher_request(jrp->engine, req, ecode);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment