Commit 6fb972d0 authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Greg Kroah-Hartman

crypto: chacha20 - fix handling of chunked input

commit 4de43726 upstream.

Commit 9ae433bc ("crypto: chacha20 - convert generic and x86 versions
to skcipher") ported the existing chacha20 code to use the new skcipher
API, and introduced a bug along the way. Unfortunately, the tcrypt tests
did not catch the error, and it was only found recently by Tobias.

Stefan kindly diagnosed the error, and proposed a fix which is similar
to the one below, with the exception that 'walk.stride' is used rather
than the hardcoded block size. This does not actually matter in this
case, but it's a better example of how to use the skcipher walk API.

Fixes: 9ae433bc ("crypto: chacha20 - convert generic and x86 ...")
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Reported-by: default avatarTobias Brunner <tobias@strongswan.org>
Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6b31ae87
...@@ -91,9 +91,14 @@ int crypto_chacha20_crypt(struct skcipher_request *req) ...@@ -91,9 +91,14 @@ int crypto_chacha20_crypt(struct skcipher_request *req)
crypto_chacha20_init(state, ctx, walk.iv); crypto_chacha20_init(state, ctx, walk.iv);
while (walk.nbytes > 0) { while (walk.nbytes > 0) {
unsigned int nbytes = walk.nbytes;
if (nbytes < walk.total)
nbytes = round_down(nbytes, walk.stride);
chacha20_docrypt(state, walk.dst.virt.addr, walk.src.virt.addr, chacha20_docrypt(state, walk.dst.virt.addr, walk.src.virt.addr,
walk.nbytes); nbytes);
err = skcipher_walk_done(&walk, 0); err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
} }
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment