From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Junaid Shahid <junaids@google.com>,
Herbert Xu <herbert@gondor.apana.org.au>
Subject: [PATCH 4.15 11/55] crypto: aesni - Fix out-of-bounds access of the AAD buffer in generic-gcm-aesni
Date: Fri, 2 Feb 2018 17:58:29 +0100 [thread overview]
Message-ID: <20180202140827.054720047@linuxfoundation.org> (raw)
In-Reply-To: <20180202140826.117602411@linuxfoundation.org>
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junaid Shahid <junaids@google.com>
commit 1ecdd37e308ca149dc378cce225068cbac54e3a6 upstream.
The aesni_gcm_enc/dec functions can access memory after the end of
the AAD buffer if the AAD length is not a multiple of 4 bytes.
It didn't matter with rfc4106-gcm-aesni as in that case the AAD was
always followed by the 8 byte IV, but that is no longer the case with
generic-gcm-aesni. This can potentially result in accessing a page that
is not mapped and thus causing the machine to crash. This patch fixes
that by reading the last <16 byte block of the AAD byte-by-byte and
optionally via an 8-byte load if the block was at least 8 bytes.
Fixes: 0487ccac ("crypto: aesni - make non-AVX AES-GCM work with any aadlen")
Signed-off-by: Junaid Shahid <junaids@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/crypto/aesni-intel_asm.S | 112 ++++----------------------------------
1 file changed, 12 insertions(+), 100 deletions(-)
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -90,30 +90,6 @@ SHIFT_MASK: .octa 0x0f0e0d0c0b0a09080706
ALL_F: .octa 0xffffffffffffffffffffffffffffffff
.octa 0x00000000000000000000000000000000
-.section .rodata
-.align 16
-.type aad_shift_arr, @object
-.size aad_shift_arr, 272
-aad_shift_arr:
- .octa 0xffffffffffffffffffffffffffffffff
- .octa 0xffffffffffffffffffffffffffffff0C
- .octa 0xffffffffffffffffffffffffffff0D0C
- .octa 0xffffffffffffffffffffffffff0E0D0C
- .octa 0xffffffffffffffffffffffff0F0E0D0C
- .octa 0xffffffffffffffffffffff0C0B0A0908
- .octa 0xffffffffffffffffffff0D0C0B0A0908
- .octa 0xffffffffffffffffff0E0D0C0B0A0908
- .octa 0xffffffffffffffff0F0E0D0C0B0A0908
- .octa 0xffffffffffffff0C0B0A090807060504
- .octa 0xffffffffffff0D0C0B0A090807060504
- .octa 0xffffffffff0E0D0C0B0A090807060504
- .octa 0xffffffff0F0E0D0C0B0A090807060504
- .octa 0xffffff0C0B0A09080706050403020100
- .octa 0xffff0D0C0B0A09080706050403020100
- .octa 0xff0E0D0C0B0A09080706050403020100
- .octa 0x0F0E0D0C0B0A09080706050403020100
-
-
.text
@@ -304,62 +280,30 @@ _done_read_partial_block_\@:
XMM2 XMM3 XMM4 XMMDst TMP6 TMP7 i i_seq operation
MOVADQ SHUF_MASK(%rip), %xmm14
mov arg7, %r10 # %r10 = AAD
- mov arg8, %r12 # %r12 = aadLen
- mov %r12, %r11
+ mov arg8, %r11 # %r11 = aadLen
pxor %xmm\i, %xmm\i
pxor \XMM2, \XMM2
cmp $16, %r11
- jl _get_AAD_rest8\num_initial_blocks\operation
+ jl _get_AAD_rest\num_initial_blocks\operation
_get_AAD_blocks\num_initial_blocks\operation:
movdqu (%r10), %xmm\i
PSHUFB_XMM %xmm14, %xmm\i # byte-reflect the AAD data
pxor %xmm\i, \XMM2
GHASH_MUL \XMM2, \TMP3, \TMP1, \TMP2, \TMP4, \TMP5, \XMM1
add $16, %r10
- sub $16, %r12
sub $16, %r11
cmp $16, %r11
jge _get_AAD_blocks\num_initial_blocks\operation
movdqu \XMM2, %xmm\i
+
+ /* read the last <16B of AAD */
+_get_AAD_rest\num_initial_blocks\operation:
cmp $0, %r11
je _get_AAD_done\num_initial_blocks\operation
- pxor %xmm\i,%xmm\i
-
- /* read the last <16B of AAD. since we have at least 4B of
- data right after the AAD (the ICV, and maybe some CT), we can
- read 4B/8B blocks safely, and then get rid of the extra stuff */
-_get_AAD_rest8\num_initial_blocks\operation:
- cmp $4, %r11
- jle _get_AAD_rest4\num_initial_blocks\operation
- movq (%r10), \TMP1
- add $8, %r10
- sub $8, %r11
- pslldq $8, \TMP1
- psrldq $8, %xmm\i
- pxor \TMP1, %xmm\i
- jmp _get_AAD_rest8\num_initial_blocks\operation
-_get_AAD_rest4\num_initial_blocks\operation:
- cmp $0, %r11
- jle _get_AAD_rest0\num_initial_blocks\operation
- mov (%r10), %eax
- movq %rax, \TMP1
- add $4, %r10
- sub $4, %r10
- pslldq $12, \TMP1
- psrldq $4, %xmm\i
- pxor \TMP1, %xmm\i
-_get_AAD_rest0\num_initial_blocks\operation:
- /* finalize: shift out the extra bytes we read, and align
- left. since pslldq can only shift by an immediate, we use
- vpshufb and an array of shuffle masks */
- movq %r12, %r11
- salq $4, %r11
- movdqu aad_shift_arr(%r11), \TMP1
- PSHUFB_XMM \TMP1, %xmm\i
-_get_AAD_rest_final\num_initial_blocks\operation:
+ READ_PARTIAL_BLOCK %r10, %r11, \TMP1, %xmm\i
PSHUFB_XMM %xmm14, %xmm\i # byte-reflect the AAD data
pxor \XMM2, %xmm\i
GHASH_MUL %xmm\i, \TMP3, \TMP1, \TMP2, \TMP4, \TMP5, \XMM1
@@ -563,62 +507,30 @@ _initial_blocks_done\num_initial_blocks\
XMM2 XMM3 XMM4 XMMDst TMP6 TMP7 i i_seq operation
MOVADQ SHUF_MASK(%rip), %xmm14
mov arg7, %r10 # %r10 = AAD
- mov arg8, %r12 # %r12 = aadLen
- mov %r12, %r11
+ mov arg8, %r11 # %r11 = aadLen
pxor %xmm\i, %xmm\i
pxor \XMM2, \XMM2
cmp $16, %r11
- jl _get_AAD_rest8\num_initial_blocks\operation
+ jl _get_AAD_rest\num_initial_blocks\operation
_get_AAD_blocks\num_initial_blocks\operation:
movdqu (%r10), %xmm\i
PSHUFB_XMM %xmm14, %xmm\i # byte-reflect the AAD data
pxor %xmm\i, \XMM2
GHASH_MUL \XMM2, \TMP3, \TMP1, \TMP2, \TMP4, \TMP5, \XMM1
add $16, %r10
- sub $16, %r12
sub $16, %r11
cmp $16, %r11
jge _get_AAD_blocks\num_initial_blocks\operation
movdqu \XMM2, %xmm\i
+
+ /* read the last <16B of AAD */
+_get_AAD_rest\num_initial_blocks\operation:
cmp $0, %r11
je _get_AAD_done\num_initial_blocks\operation
- pxor %xmm\i,%xmm\i
-
- /* read the last <16B of AAD. since we have at least 4B of
- data right after the AAD (the ICV, and maybe some PT), we can
- read 4B/8B blocks safely, and then get rid of the extra stuff */
-_get_AAD_rest8\num_initial_blocks\operation:
- cmp $4, %r11
- jle _get_AAD_rest4\num_initial_blocks\operation
- movq (%r10), \TMP1
- add $8, %r10
- sub $8, %r11
- pslldq $8, \TMP1
- psrldq $8, %xmm\i
- pxor \TMP1, %xmm\i
- jmp _get_AAD_rest8\num_initial_blocks\operation
-_get_AAD_rest4\num_initial_blocks\operation:
- cmp $0, %r11
- jle _get_AAD_rest0\num_initial_blocks\operation
- mov (%r10), %eax
- movq %rax, \TMP1
- add $4, %r10
- sub $4, %r10
- pslldq $12, \TMP1
- psrldq $4, %xmm\i
- pxor \TMP1, %xmm\i
-_get_AAD_rest0\num_initial_blocks\operation:
- /* finalize: shift out the extra bytes we read, and align
- left. since pslldq can only shift by an immediate, we use
- vpshufb and an array of shuffle masks */
- movq %r12, %r11
- salq $4, %r11
- movdqu aad_shift_arr(%r11), \TMP1
- PSHUFB_XMM \TMP1, %xmm\i
-_get_AAD_rest_final\num_initial_blocks\operation:
+ READ_PARTIAL_BLOCK %r10, %r11, \TMP1, %xmm\i
PSHUFB_XMM %xmm14, %xmm\i # byte-reflect the AAD data
pxor \XMM2, %xmm\i
GHASH_MUL %xmm\i, \TMP3, \TMP1, \TMP2, \TMP4, \TMP5, \XMM1
next prev parent reply other threads:[~2018-02-02 17:14 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-02 16:58 [PATCH 4.15 00/55] 4.15.1-stable review Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 01/55] Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 02/55] tools/gpio: Fix build error with musl libc Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 03/55] gpio: stmpe: i2c transfer are forbiden in atomic context Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 04/55] gpio: Fix kernel stack leak to userspace Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 05/55] ALSA: hda - Reduce the suspend time consumption for ALC256 Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 06/55] crypto: ecdh - fix typo in KPP dependency of CRYPTO_ECDH Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 07/55] crypto: aesni - handle zero length dst buffer Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 08/55] crypto: aesni - fix typo in generic_gcmaes_decrypt Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 09/55] crypto: aesni - add wrapper for generic gcm(aes) Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 10/55] crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-aesni Greg Kroah-Hartman
2018-02-02 16:58 ` Greg Kroah-Hartman [this message]
2018-02-02 16:58 ` [PATCH 4.15 12/55] crypto: inside-secure - fix hash when length is a multiple of a block Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 13/55] crypto: inside-secure - avoid unmapping DMA memory that was not mapped Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 14/55] crypto: sha3-generic - fixes for alignment and big endian operation Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 15/55] crypto: af_alg - whitelist mask and type Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 16/55] HID: wacom: EKR: ensure devres groups at higher indexes are released Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 17/55] HID: wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 18/55] power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 19/55] gpio: iop: " Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 20/55] gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 21/55] mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 22/55] igb: Free IRQs when device is hotplugged Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 23/55] ima/policy: fix parsing of fsuuid Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 24/55] scsi: aacraid: Fix udev inquiry race condition Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 25/55] scsi: aacraid: Fix hang in kdump Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 26/55] scsi: storvsc: missing error code in storvsc_probe() Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 27/55] staging: lustre: separate a connection destroy from free struct kib_conn Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 28/55] staging: ccree: NULLify backup_info when unused Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 29/55] staging: ccree: fix fips event irq handling build Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 30/55] tty: fix data race between tty_init_dev and flush of buf Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 31/55] usb: option: Add support for FS040U modem Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 32/55] USB: serial: pl2303: new device id for Chilitag Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 33/55] USB: cdc-acm: Do not log urb submission errors on disconnect Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 34/55] CDC-ACM: apply quirk for card reader Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 35/55] USB: serial: io_edgeport: fix possible sleep-in-atomic Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 36/55] usbip: prevent bind loops on devices attached to vhci_hcd Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 37/55] usbip: list: dont list " Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 38/55] USB: serial: simple: add Motorola Tetra driver Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 39/55] usb: f_fs: Prevent gadget unbind if it is already unbound Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 40/55] usb: uas: unconditionally bring back host after reset Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 41/55] usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc() Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 42/55] ANDROID: binder: remove waitqueue when thread exits Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 43/55] android: binder: use VM_ALLOC to get vm area Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 44/55] mei: me: allow runtime pm for platform with D0i3 Greg Kroah-Hartman
2018-02-02 16:59 ` Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 45/55] serial: 8250_of: fix return code when probe function fails to get reset Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 46/55] serial: 8250_uniphier: fix error return code in uniphier_uart_probe() Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 47/55] serial: 8250_dw: Revert "Improve clock rate setting" Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 48/55] serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 49/55] spi: imx: do not access registers while clocks disabled Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 50/55] iio: adc: stm32: fix scan of multiple channels with DMA Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 51/55] iio: chemical: ccs811: Fix output of IIO_CONCENTRATION channels Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 52/55] test_firmware: fix missing unlock on error in config_num_requests_store() Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 53/55] Input: synaptics-rmi4 - unmask F03 interrupts when port is opened Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 54/55] Input: synaptics-rmi4 - do not delete interrupt memory too early Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 55/55] x86/efi: Clarify that reset attack mitigation needs appropriate userspace Greg Kroah-Hartman
2018-02-02 22:17 ` [PATCH 4.15 00/55] 4.15.1-stable review Shuah Khan
2018-02-03 5:16 ` Greg Kroah-Hartman
2018-02-03 4:35 ` Dan Rue
2018-02-03 5:18 ` Greg Kroah-Hartman
2018-02-05 15:50 ` Milosz Wasilewski
2018-02-03 15:34 ` Guenter Roeck
2018-02-03 15:44 ` Greg Kroah-Hartman
2018-02-03 16:46 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180202140827.054720047@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=junaids@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.