[PATCH 0/11] crypto: aead - Tweaks/fixes to new AEAD interface

[PATCH 0/11] crypto: aead - Tweaks/fixes to new AEAD interface

[Herbert Xu]

Hi:

Previously the AD was required to exist in both the source and
destination buffers.  This creates a rather confusing situation
where the destination served as both input as well as output.

This series rectifies by allowing the destination to contain
the AD (e.g., it always does for in-place encryption) but not
require it.  Those AEAD algorithms that need the AD to be in
the destination buffer will do their own copying.

This series also merges some common code between echainiv and
seqiv.  In particular, the entire compatibility layer is now
shared.

Finally a number of bugs have been quashed.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[PATCH 1/11] crypto: aead - Document behaviour of AD in destination buffer

[Herbert Xu]

This patch defines the behaviour of AD in the new interface more
clearly.  In particular, it specifies that if the user must copy
the AD to the destination manually when src != dst if they wish
to guarantee that the destination buffer contains a copy of the
AD.

The reason for this is that otherwise every AEAD implementation
would have to perform such a copy when src != dst.  In reality
most users do in-place processing where src == dst so this is
not an issue.

This patch also kills some remaining references to cryptoff.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 include/crypto/aead.h |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/include/crypto/aead.h b/include/crypto/aead.h
index 94141dc..61306ed 100644
--- a/include/crypto/aead.h
+++ b/include/crypto/aead.h
@@ -473,8 +473,15 @@ static inline void aead_request_set_callback(struct aead_request *req,
  * destination is the ciphertext. For a decryption operation, the use is
  * reversed - the source is the ciphertext and the destination is the plaintext.
  *
- * For both src/dst the layout is associated data, skipped data,
- * plain/cipher text, authentication tag.
+ * For both src/dst the layout is associated data, plain/cipher text,
+ * authentication tag.
+ *
+ * The content of the AD in the destination buffer after processing
+ * will either be untouched, or it will contain a copy of the AD
+ * from the source buffer.  In order to ensure that it always has
+ * a copy of the AD, the user must copy the AD over either before
+ * or after processing.  Of course this is not relevant if the user
+ * is doing in-place processing where src == dst.
  *
  * IMPORTANT NOTE AEAD requires an authentication tag (MAC). For decryption,
  *		  the caller must concatenate the ciphertext followed by the
@@ -525,8 +532,7 @@ static inline void aead_request_set_assoc(struct aead_request *req,
  * @assoclen: number of bytes in associated data
  *
  * Setting the AD information.  This function sets the length of
- * the associated data and the number of bytes to skip after it to
- * access the plain/cipher text.
+ * the associated data.
  */
 static inline void aead_request_set_ad(struct aead_request *req,
 				       unsigned int assoclen)

[PATCH 2/11] crypto: scatterwalk - Add missing sg_init_table to scatterwalk_ffwd

[Herbert Xu]

We need to call sg_init_table as otherwise the first entry may
inadvertently become the last.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/scatterwalk.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
index 8690324..2ef9cbb 100644
--- a/crypto/scatterwalk.c
+++ b/crypto/scatterwalk.c
@@ -158,6 +158,7 @@ struct scatterlist *scatterwalk_ffwd(struct scatterlist dst[2],
 		src = sg_next(src);
 	}
 
+	sg_init_table(dst, 2);
 	sg_set_page(dst, sg_page(src), src->length - len, src->offset + len);
 	scatterwalk_crypto_chain(dst, sg_next(src), 0, 2);
 

[PATCH 3/11] crypto: aead - Preserve in-place processing in old_crypt

[Herbert Xu]

This patch tries to preserve in-place processing in old_crypt as
various algorithms are optimised for in-place processing where
src == dst.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/aead.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crypto/aead.c b/crypto/aead.c
index 7c3d725..35c55e0 100644
--- a/crypto/aead.c
+++ b/crypto/aead.c
@@ -107,7 +107,8 @@ static int old_crypt(struct aead_request *req,
 		return crypt(req);
 
 	src = scatterwalk_ffwd(nreq->srcbuf, req->src, req->assoclen);
-	dst = scatterwalk_ffwd(nreq->dstbuf, req->dst, req->assoclen);
+	dst = req->src == req->dst ?
+	      src : scatterwalk_ffwd(nreq->dstbuf, req->dst, req->assoclen);
 
 	aead_request_set_tfm(&nreq->subreq, aead);
 	aead_request_set_callback(&nreq->subreq, aead_request_flags(req),

[PATCH 4/11] crypto: aead - Add common IV generation code

[Herbert Xu]

This patch adds some common IV generation code currently duplicated
by seqiv and echainiv.  For example, the setkey and setauthsize
functions are completely identical.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/aead.c                   |  205 +++++++++++++++++++++++++++++++++++++++-
 include/crypto/internal/geniv.h |   24 ++++
 2 files changed, 226 insertions(+), 3 deletions(-)

diff --git a/crypto/aead.c b/crypto/aead.c
index 35c55e0..8cdea89 100644
--- a/crypto/aead.c
+++ b/crypto/aead.c
@@ -12,7 +12,7 @@
  *
  */
 
-#include <crypto/internal/aead.h>
+#include <crypto/internal/geniv.h>
 #include <crypto/scatterwalk.h>
 #include <linux/err.h>
 #include <linux/init.h>
@@ -27,6 +27,14 @@
 
 #include "internal.h"
 
+struct compat_request_ctx {
+	struct scatterlist src[2];
+	struct scatterlist dst[2];
+	struct scatterlist ivbuf[2];
+	struct scatterlist *ivsg;
+	struct aead_givcrypt_request subreq;
+};
+
 static int aead_null_givencrypt(struct aead_givcrypt_request *req);
 static int aead_null_givdecrypt(struct aead_givcrypt_request *req);
 
@@ -373,6 +381,185 @@ static int crypto_grab_nivaead(struct crypto_aead_spawn *spawn,
 	return crypto_grab_spawn(&spawn->base, name, type, mask);
 }
 
+static int aead_geniv_setkey(struct crypto_aead *tfm,
+			     const u8 *key, unsigned int keylen)
+{
+	struct aead_geniv_ctx *ctx = crypto_aead_ctx(tfm);
+
+	return crypto_aead_setkey(ctx->child, key, keylen);
+}
+
+static int aead_geniv_setauthsize(struct crypto_aead *tfm,
+				  unsigned int authsize)
+{
+	struct aead_geniv_ctx *ctx = crypto_aead_ctx(tfm);
+
+	return crypto_aead_setauthsize(ctx->child, authsize);
+}
+
+static void compat_encrypt_complete2(struct aead_request *req, int err)
+{
+	struct compat_request_ctx *rctx = aead_request_ctx(req);
+	struct aead_givcrypt_request *subreq = &rctx->subreq;
+	struct crypto_aead *geniv;
+
+	if (err == -EINPROGRESS)
+		return;
+
+	if (err)
+		goto out;
+
+	geniv = crypto_aead_reqtfm(req);
+	scatterwalk_map_and_copy(subreq->giv, rctx->ivsg, 0,
+				 crypto_aead_ivsize(geniv), 1);
+
+out:
+	kzfree(subreq->giv);
+}
+
+static void compat_encrypt_complete(struct crypto_async_request *base, int err)
+{
+	struct aead_request *req = base->data;
+
+	compat_encrypt_complete2(req, err);
+	aead_request_complete(req, err);
+}
+
+static int compat_encrypt(struct aead_request *req)
+{
+	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
+	struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
+	struct compat_request_ctx *rctx = aead_request_ctx(req);
+	struct aead_givcrypt_request *subreq = &rctx->subreq;
+	unsigned int ivsize = crypto_aead_ivsize(geniv);
+	struct scatterlist *src, *dst;
+	crypto_completion_t compl;
+	void *data;
+	u8 *info;
+	__be64 seq;
+	int err;
+
+	if (req->cryptlen < ivsize)
+		return -EINVAL;
+
+	compl = req->base.complete;
+	data = req->base.data;
+
+	rctx->ivsg = scatterwalk_ffwd(rctx->ivbuf, req->dst, req->assoclen);
+	info = PageHighMem(sg_page(rctx->ivsg)) ? NULL : sg_virt(rctx->ivsg);
+
+	if (!info) {
+		info = kmalloc(ivsize, req->base.flags &
+				       CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
+								  GFP_ATOMIC);
+		if (!info)
+			return -ENOMEM;
+
+		compl = compat_encrypt_complete;
+		data = req;
+	}
+
+	memcpy(&seq, req->iv + ivsize - sizeof(seq), sizeof(seq));
+
+	src = scatterwalk_ffwd(rctx->src, req->src, req->assoclen + ivsize);
+	dst = req->src == req->dst ?
+	      src : scatterwalk_ffwd(rctx->dst, rctx->ivsg, ivsize);
+
+	aead_givcrypt_set_tfm(subreq, ctx->child);
+	aead_givcrypt_set_callback(subreq, req->base.flags,
+				   req->base.complete, req->base.data);
+	aead_givcrypt_set_crypt(subreq, src, dst,
+				req->cryptlen - ivsize, req->iv);
+	aead_givcrypt_set_assoc(subreq, req->src, req->assoclen);
+	aead_givcrypt_set_giv(subreq, info, be64_to_cpu(seq));
+
+	err = crypto_aead_givencrypt(subreq);
+	if (unlikely(PageHighMem(sg_page(rctx->ivsg))))
+		compat_encrypt_complete2(req, err);
+	return err;
+}
+
+static int compat_decrypt(struct aead_request *req)
+{
+	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
+	struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
+	struct compat_request_ctx *rctx = aead_request_ctx(req);
+	struct aead_request *subreq = &rctx->subreq.areq;
+	unsigned int ivsize = crypto_aead_ivsize(geniv);
+	struct scatterlist *src, *dst;
+	crypto_completion_t compl;
+	void *data;
+
+	if (req->cryptlen < ivsize)
+		return -EINVAL;
+
+	aead_request_set_tfm(subreq, ctx->child);
+
+	compl = req->base.complete;
+	data = req->base.data;
+
+	src = scatterwalk_ffwd(rctx->src, req->src, req->assoclen + ivsize);
+	dst = req->src == req->dst ?
+	      src : scatterwalk_ffwd(rctx->dst, req->dst,
+				     req->assoclen + ivsize);
+
+	aead_request_set_callback(subreq, req->base.flags, compl, data);
+	aead_request_set_crypt(subreq, src, dst,
+			       req->cryptlen - ivsize, req->iv);
+	aead_request_set_assoc(subreq, req->src, req->assoclen);
+
+	scatterwalk_map_and_copy(req->iv, req->src, req->assoclen, ivsize, 0);
+
+	return crypto_aead_decrypt(subreq);
+}
+
+static int compat_encrypt_first(struct aead_request *req)
+{
+	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
+	struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
+	int err = 0;
+
+	spin_lock_bh(&ctx->lock);
+	if (geniv->encrypt != compat_encrypt_first)
+		goto unlock;
+
+	geniv->encrypt = compat_encrypt;
+
+unlock:
+	spin_unlock_bh(&ctx->lock);
+
+	if (err)
+		return err;
+
+	return compat_encrypt(req);
+}
+
+static int aead_geniv_init_compat(struct crypto_tfm *tfm)
+{
+	struct crypto_aead *geniv = __crypto_aead_cast(tfm);
+	struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
+	int err;
+
+	spin_lock_init(&ctx->lock);
+
+	crypto_aead_set_reqsize(geniv, sizeof(struct compat_request_ctx));
+
+	err = aead_geniv_init(tfm);
+
+	ctx->child = geniv->child;
+	geniv->child = geniv;
+
+	return err;
+}
+
+static void aead_geniv_exit_compat(struct crypto_tfm *tfm)
+{
+	struct crypto_aead *geniv = __crypto_aead_cast(tfm);
+	struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
+
+	crypto_free_aead(ctx->child);
+}
+
 struct aead_instance *aead_geniv_alloc(struct crypto_template *tmpl,
 				       struct rtattr **tb, u32 type, u32 mask)
 {
@@ -407,7 +594,9 @@ struct aead_instance *aead_geniv_alloc(struct crypto_template *tmpl,
 	mask |= crypto_requires_sync(algt->type, algt->mask);
 
 	crypto_set_aead_spawn(spawn, aead_crypto_instance(inst));
-	err = crypto_grab_nivaead(spawn, name, type, mask);
+	err = (algt->mask & CRYPTO_ALG_GENIV) ?
+	      crypto_grab_nivaead(spawn, name, type, mask) :
+	      crypto_grab_aead(spawn, name, type, mask);
 	if (err)
 		goto err_free_inst;
 
@@ -417,7 +606,7 @@ struct aead_instance *aead_geniv_alloc(struct crypto_template *tmpl,
 	maxauthsize = crypto_aead_alg_maxauthsize(alg);
 
 	err = -EINVAL;
-	if (!ivsize)
+	if (ivsize < sizeof(u64))
 		goto err_drop_alg;
 
 	/*
@@ -471,10 +660,20 @@ struct aead_instance *aead_geniv_alloc(struct crypto_template *tmpl,
 	inst->alg.base.cra_priority = alg->base.cra_priority;
 	inst->alg.base.cra_blocksize = alg->base.cra_blocksize;
 	inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
+	inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
+
+	inst->alg.setkey = aead_geniv_setkey;
+	inst->alg.setauthsize = aead_geniv_setauthsize;
 
 	inst->alg.ivsize = ivsize;
 	inst->alg.maxauthsize = maxauthsize;
 
+	inst->alg.encrypt = compat_encrypt_first;
+	inst->alg.decrypt = compat_decrypt;
+
+	inst->alg.base.cra_init = aead_geniv_init_compat;
+	inst->alg.base.cra_exit = aead_geniv_exit_compat;
+
 out:
 	return inst;
 
diff --git a/include/crypto/internal/geniv.h b/include/crypto/internal/geniv.h
new file mode 100644
index 0000000..9ca9b87
--- /dev/null
+++ b/include/crypto/internal/geniv.h
@@ -0,0 +1,24 @@
+/*
+ * geniv: IV generation
+ *
+ * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#ifndef _CRYPTO_INTERNAL_GENIV_H
+#define _CRYPTO_INTERNAL_GENIV_H
+
+#include <crypto/internal/aead.h>
+#include <linux/spinlock.h>
+
+struct aead_geniv_ctx {
+	spinlock_t lock;
+	struct crypto_aead *child;
+};
+
+#endif	/* _CRYPTO_INTERNAL_GENIV_H */

[PATCH 5/11] crypto: echainiv - Copy AD along with plain text

[Herbert Xu]

As the AD does not necessarily exist in the destination buffer
it must be copied along with the plain text.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/echainiv.c |   10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/crypto/echainiv.c b/crypto/echainiv.c
index bd85dcc..02d0543 100644
--- a/crypto/echainiv.c
+++ b/crypto/echainiv.c
@@ -228,19 +228,13 @@ static int echainiv_encrypt(struct aead_request *req)
 	info = req->iv;
 
 	if (req->src != req->dst) {
-		struct scatterlist src[2];
-		struct scatterlist dst[2];
 		struct blkcipher_desc desc = {
 			.tfm = ctx->null,
 		};
 
 		err = crypto_blkcipher_encrypt(
-			&desc,
-			scatterwalk_ffwd(dst, req->dst,
-					 req->assoclen + ivsize),
-			scatterwalk_ffwd(src, req->src,
-					 req->assoclen + ivsize),
-			req->cryptlen - ivsize);
+			&desc, req->dst, req->src,
+			req->assoclen + req->cryptlen);
 		if (err)
 			return err;
 	}

[PATCH 6/11] crypto: echainiv - Use common IV generation code

[Herbert Xu]

This patch makes use of the new common IV generation code.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/echainiv.c |  230 ++++--------------------------------------------------
 1 file changed, 18 insertions(+), 212 deletions(-)

diff --git a/crypto/echainiv.c b/crypto/echainiv.c
index 02d0543..0f79fc6 100644
--- a/crypto/echainiv.c
+++ b/crypto/echainiv.c
@@ -18,7 +18,7 @@
  *
  */
 
-#include <crypto/internal/aead.h>
+#include <crypto/internal/geniv.h>
 #include <crypto/null.h>
 #include <crypto/rng.h>
 #include <crypto/scatterwalk.h>
@@ -33,39 +33,15 @@
 
 #define MAX_IV_SIZE 16
 
-struct echainiv_request_ctx {
-	struct scatterlist src[2];
-	struct scatterlist dst[2];
-	struct scatterlist ivbuf[2];
-	struct scatterlist *ivsg;
-	struct aead_givcrypt_request subreq;
-};
-
 struct echainiv_ctx {
-	struct crypto_aead *child;
-	spinlock_t lock;
+	/* aead_geniv_ctx must be first the element */
+	struct aead_geniv_ctx geniv;
 	struct crypto_blkcipher *null;
 	u8 salt[] __attribute__ ((aligned(__alignof__(u32))));
 };
 
 static DEFINE_PER_CPU(u32 [MAX_IV_SIZE / sizeof(u32)], echainiv_iv);
 
-static int echainiv_setkey(struct crypto_aead *tfm,
-			      const u8 *key, unsigned int keylen)
-{
-	struct echainiv_ctx *ctx = crypto_aead_ctx(tfm);
-
-	return crypto_aead_setkey(ctx->child, key, keylen);
-}
-
-static int echainiv_setauthsize(struct crypto_aead *tfm,
-				  unsigned int authsize)
-{
-	struct echainiv_ctx *ctx = crypto_aead_ctx(tfm);
-
-	return crypto_aead_setauthsize(ctx->child, authsize);
-}
-
 /* We don't care if we get preempted and read/write IVs from the next CPU. */
 static void echainiv_read_iv(u8 *dst, unsigned size)
 {
@@ -90,36 +66,6 @@ static void echainiv_write_iv(const u8 *src, unsigned size)
 	}
 }
 
-static void echainiv_encrypt_compat_complete2(struct aead_request *req,
-						 int err)
-{
-	struct echainiv_request_ctx *rctx = aead_request_ctx(req);
-	struct aead_givcrypt_request *subreq = &rctx->subreq;
-	struct crypto_aead *geniv;
-
-	if (err == -EINPROGRESS)
-		return;
-
-	if (err)
-		goto out;
-
-	geniv = crypto_aead_reqtfm(req);
-	scatterwalk_map_and_copy(subreq->giv, rctx->ivsg, 0,
-				 crypto_aead_ivsize(geniv), 1);
-
-out:
-	kzfree(subreq->giv);
-}
-
-static void echainiv_encrypt_compat_complete(
-	struct crypto_async_request *base, int err)
-{
-	struct aead_request *req = base->data;
-
-	echainiv_encrypt_compat_complete2(req, err);
-	aead_request_complete(req, err);
-}
-
 static void echainiv_encrypt_complete2(struct aead_request *req, int err)
 {
 	struct aead_request *subreq = aead_request_ctx(req);
@@ -154,59 +100,6 @@ static void echainiv_encrypt_complete(struct crypto_async_request *base,
 	aead_request_complete(req, err);
 }
 
-static int echainiv_encrypt_compat(struct aead_request *req)
-{
-	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
-	struct echainiv_ctx *ctx = crypto_aead_ctx(geniv);
-	struct echainiv_request_ctx *rctx = aead_request_ctx(req);
-	struct aead_givcrypt_request *subreq = &rctx->subreq;
-	unsigned int ivsize = crypto_aead_ivsize(geniv);
-	crypto_completion_t compl;
-	void *data;
-	u8 *info;
-	__be64 seq;
-	int err;
-
-	if (req->cryptlen < ivsize)
-		return -EINVAL;
-
-	compl = req->base.complete;
-	data = req->base.data;
-
-	rctx->ivsg = scatterwalk_ffwd(rctx->ivbuf, req->dst, req->assoclen);
-	info = PageHighMem(sg_page(rctx->ivsg)) ? NULL : sg_virt(rctx->ivsg);
-
-	if (!info) {
-		info = kmalloc(ivsize, req->base.flags &
-				       CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
-								  GFP_ATOMIC);
-		if (!info)
-			return -ENOMEM;
-
-		compl = echainiv_encrypt_compat_complete;
-		data = req;
-	}
-
-	memcpy(&seq, req->iv + ivsize - sizeof(seq), sizeof(seq));
-
-	aead_givcrypt_set_tfm(subreq, ctx->child);
-	aead_givcrypt_set_callback(subreq, req->base.flags,
-				   req->base.complete, req->base.data);
-	aead_givcrypt_set_crypt(subreq,
-				scatterwalk_ffwd(rctx->src, req->src,
-						 req->assoclen + ivsize),
-				scatterwalk_ffwd(rctx->dst, rctx->ivsg,
-						 ivsize),
-				req->cryptlen - ivsize, req->iv);
-	aead_givcrypt_set_assoc(subreq, req->src, req->assoclen);
-	aead_givcrypt_set_giv(subreq, info, be64_to_cpu(seq));
-
-	err = crypto_aead_givencrypt(subreq);
-	if (unlikely(PageHighMem(sg_page(rctx->ivsg))))
-		echainiv_encrypt_compat_complete2(req, err);
-	return err;
-}
-
 static int echainiv_encrypt(struct aead_request *req)
 {
 	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
@@ -221,7 +114,7 @@ static int echainiv_encrypt(struct aead_request *req)
 	if (req->cryptlen < ivsize)
 		return -EINVAL;
 
-	aead_request_set_tfm(subreq, ctx->child);
+	aead_request_set_tfm(subreq, ctx->geniv.child);
 
 	compl = echainiv_encrypt_complete;
 	data = req;
@@ -264,38 +157,6 @@ static int echainiv_encrypt(struct aead_request *req)
 	return err;
 }
 
-static int echainiv_decrypt_compat(struct aead_request *req)
-{
-	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
-	struct echainiv_ctx *ctx = crypto_aead_ctx(geniv);
-	struct echainiv_request_ctx *rctx = aead_request_ctx(req);
-	struct aead_request *subreq = &rctx->subreq.areq;
-	crypto_completion_t compl;
-	void *data;
-	unsigned int ivsize = crypto_aead_ivsize(geniv);
-
-	if (req->cryptlen < ivsize + crypto_aead_authsize(geniv))
-		return -EINVAL;
-
-	aead_request_set_tfm(subreq, ctx->child);
-
-	compl = req->base.complete;
-	data = req->base.data;
-
-	aead_request_set_callback(subreq, req->base.flags, compl, data);
-	aead_request_set_crypt(subreq,
-			       scatterwalk_ffwd(rctx->src, req->src,
-						req->assoclen + ivsize),
-			       scatterwalk_ffwd(rctx->dst, req->dst,
-						req->assoclen + ivsize),
-			       req->cryptlen - ivsize, req->iv);
-	aead_request_set_assoc(subreq, req->src, req->assoclen);
-
-	scatterwalk_map_and_copy(req->iv, req->src, req->assoclen, ivsize, 0);
-
-	return crypto_aead_decrypt(subreq);
-}
-
 static int echainiv_decrypt(struct aead_request *req)
 {
 	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
@@ -308,7 +169,7 @@ static int echainiv_decrypt(struct aead_request *req)
 	if (req->cryptlen < ivsize + crypto_aead_authsize(geniv))
 		return -EINVAL;
 
-	aead_request_set_tfm(subreq, ctx->child);
+	aead_request_set_tfm(subreq, ctx->geniv.child);
 
 	compl = req->base.complete;
 	data = req->base.data;
@@ -326,36 +187,13 @@ static int echainiv_decrypt(struct aead_request *req)
 	return crypto_aead_decrypt(subreq);
 }
 
-static int echainiv_encrypt_compat_first(struct aead_request *req)
-{
-	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
-	struct echainiv_ctx *ctx = crypto_aead_ctx(geniv);
-	int err = 0;
-
-	spin_lock_bh(&ctx->lock);
-	if (geniv->encrypt != echainiv_encrypt_compat_first)
-		goto unlock;
-
-	geniv->encrypt = echainiv_encrypt_compat;
-	err = crypto_rng_get_bytes(crypto_default_rng, ctx->salt,
-				   crypto_aead_ivsize(geniv));
-
-unlock:
-	spin_unlock_bh(&ctx->lock);
-
-	if (err)
-		return err;
-
-	return echainiv_encrypt_compat(req);
-}
-
 static int echainiv_encrypt_first(struct aead_request *req)
 {
 	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 	struct echainiv_ctx *ctx = crypto_aead_ctx(geniv);
 	int err = 0;
 
-	spin_lock_bh(&ctx->lock);
+	spin_lock_bh(&ctx->geniv.lock);
 	if (geniv->encrypt != echainiv_encrypt_first)
 		goto unlock;
 
@@ -364,7 +202,7 @@ static int echainiv_encrypt_first(struct aead_request *req)
 				   crypto_aead_ivsize(geniv));
 
 unlock:
-	spin_unlock_bh(&ctx->lock);
+	spin_unlock_bh(&ctx->geniv.lock);
 
 	if (err)
 		return err;
@@ -372,31 +210,13 @@ unlock:
 	return echainiv_encrypt(req);
 }
 
-static int echainiv_compat_init(struct crypto_tfm *tfm)
-{
-	struct crypto_aead *geniv = __crypto_aead_cast(tfm);
-	struct echainiv_ctx *ctx = crypto_aead_ctx(geniv);
-	int err;
-
-	spin_lock_init(&ctx->lock);
-
-	crypto_aead_set_reqsize(geniv, sizeof(struct echainiv_request_ctx));
-
-	err = aead_geniv_init(tfm);
-
-	ctx->child = geniv->child;
-	geniv->child = geniv;
-
-	return err;
-}
-
 static int echainiv_init(struct crypto_tfm *tfm)
 {
 	struct crypto_aead *geniv = __crypto_aead_cast(tfm);
 	struct echainiv_ctx *ctx = crypto_aead_ctx(geniv);
 	int err;
 
-	spin_lock_init(&ctx->lock);
+	spin_lock_init(&ctx->geniv.lock);
 
 	crypto_aead_set_reqsize(geniv, sizeof(struct aead_request));
 
@@ -409,7 +229,7 @@ static int echainiv_init(struct crypto_tfm *tfm)
 	if (err)
 		goto drop_null;
 
-	ctx->child = geniv->child;
+	ctx->geniv.child = geniv->child;
 	geniv->child = geniv;
 
 out:
@@ -420,18 +240,11 @@ drop_null:
 	goto out;
 }
 
-static void echainiv_compat_exit(struct crypto_tfm *tfm)
-{
-	struct echainiv_ctx *ctx = crypto_tfm_ctx(tfm);
-
-	crypto_free_aead(ctx->child);
-}
-
 static void echainiv_exit(struct crypto_tfm *tfm)
 {
 	struct echainiv_ctx *ctx = crypto_tfm_ctx(tfm);
 
-	crypto_free_aead(ctx->child);
+	crypto_free_aead(ctx->geniv.child);
 	crypto_put_default_null_skcipher();
 }
 
@@ -448,17 +261,17 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
 	if (IS_ERR(inst))
 		return PTR_ERR(inst);
 
+	spawn = aead_instance_ctx(inst);
+	alg = crypto_spawn_aead_alg(spawn);
+
+	if (alg->base.cra_aead.encrypt)
+		goto done;
+
 	err = -EINVAL;
-	if (inst->alg.ivsize < sizeof(u64) ||
-	    inst->alg.ivsize & (sizeof(u32) - 1) ||
+	if (inst->alg.ivsize & (sizeof(u32) - 1) ||
 	    inst->alg.ivsize > MAX_IV_SIZE)
 		goto free_inst;
 
-	spawn = aead_instance_ctx(inst);
-	alg = crypto_spawn_aead_alg(spawn);
-
-	inst->alg.setkey = echainiv_setkey;
-	inst->alg.setauthsize = echainiv_setauthsize;
 	inst->alg.encrypt = echainiv_encrypt_first;
 	inst->alg.decrypt = echainiv_decrypt;
 
@@ -469,14 +282,7 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
 	inst->alg.base.cra_ctxsize = sizeof(struct echainiv_ctx);
 	inst->alg.base.cra_ctxsize += inst->alg.base.cra_aead.ivsize;
 
-	if (alg->base.cra_aead.encrypt) {
-		inst->alg.encrypt = echainiv_encrypt_compat_first;
-		inst->alg.decrypt = echainiv_decrypt_compat;
-
-		inst->alg.base.cra_init = echainiv_compat_init;
-		inst->alg.base.cra_exit = echainiv_compat_exit;
-	}
-
+done:
 	err = aead_register_instance(tmpl, inst);
 	if (err)
 		goto free_inst;

[PATCH 7/11] crypto: echainiv - Fix IV size in context size calculation

[Herbert Xu]

This patch fixes a bug in the context size calculation where we
were still referring to the old cra_aead.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/echainiv.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/echainiv.c b/crypto/echainiv.c
index 0f79fc6..62a817f 100644
--- a/crypto/echainiv.c
+++ b/crypto/echainiv.c
@@ -280,7 +280,7 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
 
 	inst->alg.base.cra_alignmask |= __alignof__(u32) - 1;
 	inst->alg.base.cra_ctxsize = sizeof(struct echainiv_ctx);
-	inst->alg.base.cra_ctxsize += inst->alg.base.cra_aead.ivsize;
+	inst->alg.base.cra_ctxsize += inst->alg.ivsize;
 
 done:
 	err = aead_register_instance(tmpl, inst);

[PATCH 8/11] crypto: seqiv - Copy AD along with plain/cipher text

[Herbert Xu]

As the AD does not necessarily exist in the destination buffer
it must be copied along with the plain/cipher text.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/seqiv.c |   33 ++++++---------------------------
 1 file changed, 6 insertions(+), 27 deletions(-)

diff --git a/crypto/seqiv.c b/crypto/seqiv.c
index 127970a..b55c685 100644
--- a/crypto/seqiv.c
+++ b/crypto/seqiv.c
@@ -315,19 +315,12 @@ static int seqiv_aead_encrypt_compat(struct aead_request *req)
 	data = req;
 
 	if (req->src != req->dst) {
-		struct scatterlist srcbuf[2];
-		struct scatterlist dstbuf[2];
 		struct blkcipher_desc desc = {
 			.tfm = ctx->null,
 		};
 
-		err = crypto_blkcipher_encrypt(
-			&desc,
-			scatterwalk_ffwd(dstbuf, req->dst,
-					 req->assoclen + ivsize),
-			scatterwalk_ffwd(srcbuf, req->src,
-					 req->assoclen + ivsize),
-			req->cryptlen - ivsize);
+		err = crypto_blkcipher_encrypt(&desc, req->dst, req->src,
+					       req->assoclen + req->cryptlen);
 		if (err)
 			return err;
 	}
@@ -373,19 +366,12 @@ static int seqiv_aead_encrypt(struct aead_request *req)
 	info = req->iv;
 
 	if (req->src != req->dst) {
-		struct scatterlist src[2];
-		struct scatterlist dst[2];
 		struct blkcipher_desc desc = {
 			.tfm = ctx->null,
 		};
 
-		err = crypto_blkcipher_encrypt(
-			&desc,
-			scatterwalk_ffwd(dst, req->dst,
-					 req->assoclen + ivsize),
-			scatterwalk_ffwd(src, req->src,
-					 req->assoclen + ivsize),
-			req->cryptlen - ivsize);
+		err = crypto_blkcipher_encrypt(&desc, req->dst, req->src,
+					       req->assoclen + req->cryptlen);
 		if (err)
 			return err;
 	}
@@ -446,19 +432,12 @@ static int seqiv_aead_decrypt_compat(struct aead_request *req)
 	}
 
 	if (req->src != req->dst) {
-		struct scatterlist srcbuf[2];
-		struct scatterlist dstbuf[2];
 		struct blkcipher_desc desc = {
 			.tfm = ctx->null,
 		};
 
-		err = crypto_blkcipher_encrypt(
-			&desc,
-			scatterwalk_ffwd(dstbuf, req->dst,
-					 req->assoclen + ivsize),
-			scatterwalk_ffwd(srcbuf, req->src,
-					 req->assoclen + ivsize),
-			req->cryptlen - ivsize);
+		err = crypto_blkcipher_encrypt(&desc, req->dst, req->src,
+					       req->assoclen + req->cryptlen);
 		if (err)
 			return err;
 	}

[PATCH 9/11] crypto: seqiv - Use common IV generation code

[Herbert Xu]

This patch makes use of the new common IV generation code.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/seqiv.c |   92 ++++++++++++++++++++++-----------------------------------
 1 file changed, 36 insertions(+), 56 deletions(-)

diff --git a/crypto/seqiv.c b/crypto/seqiv.c
index b55c685..9c4490b 100644
--- a/crypto/seqiv.c
+++ b/crypto/seqiv.c
@@ -13,7 +13,7 @@
  *
  */
 
-#include <crypto/internal/aead.h>
+#include <crypto/internal/geniv.h>
 #include <crypto/internal/skcipher.h>
 #include <crypto/null.h>
 #include <crypto/rng.h>
@@ -37,30 +37,14 @@ struct seqiv_ctx {
 };
 
 struct seqiv_aead_ctx {
-	struct crypto_aead *child;
-	spinlock_t lock;
+	/* aead_geniv_ctx must be first the element */
+	struct aead_geniv_ctx geniv;
 	struct crypto_blkcipher *null;
 	u8 salt[] __attribute__ ((aligned(__alignof__(u32))));
 };
 
 static void seqiv_free(struct crypto_instance *inst);
 
-static int seqiv_aead_setkey(struct crypto_aead *tfm,
-			     const u8 *key, unsigned int keylen)
-{
-	struct seqiv_aead_ctx *ctx = crypto_aead_ctx(tfm);
-
-	return crypto_aead_setkey(ctx->child, key, keylen);
-}
-
-static int seqiv_aead_setauthsize(struct crypto_aead *tfm,
-				  unsigned int authsize)
-{
-	struct seqiv_aead_ctx *ctx = crypto_aead_ctx(tfm);
-
-	return crypto_aead_setauthsize(ctx->child, authsize);
-}
-
 static void seqiv_complete2(struct skcipher_givcrypt_request *req, int err)
 {
 	struct ablkcipher_request *subreq = skcipher_givcrypt_reqctx(req);
@@ -289,7 +273,7 @@ static int seqiv_aead_givencrypt(struct aead_givcrypt_request *req)
 	return err;
 }
 
-static int seqiv_aead_encrypt_compat(struct aead_request *req)
+static int seqniv_aead_encrypt(struct aead_request *req)
 {
 	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 	struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
@@ -309,7 +293,7 @@ static int seqiv_aead_encrypt_compat(struct aead_request *req)
 	if (req->assoclen > 12)
 		return -EINVAL;
 
-	aead_request_set_tfm(subreq, ctx->child);
+	aead_request_set_tfm(subreq, ctx->geniv.child);
 
 	compl = seqniv_aead_encrypt_complete;
 	data = req;
@@ -359,7 +343,7 @@ static int seqiv_aead_encrypt(struct aead_request *req)
 	if (req->cryptlen < ivsize)
 		return -EINVAL;
 
-	aead_request_set_tfm(subreq, ctx->child);
+	aead_request_set_tfm(subreq, ctx->geniv.child);
 
 	compl = req->base.complete;
 	data = req->base.data;
@@ -403,7 +387,7 @@ static int seqiv_aead_encrypt(struct aead_request *req)
 	return err;
 }
 
-static int seqiv_aead_decrypt_compat(struct aead_request *req)
+static int seqniv_aead_decrypt(struct aead_request *req)
 {
 	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 	struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
@@ -419,7 +403,7 @@ static int seqiv_aead_decrypt_compat(struct aead_request *req)
 	if (req->cryptlen < ivsize + crypto_aead_authsize(geniv))
 		return -EINVAL;
 
-	aead_request_set_tfm(subreq, ctx->child);
+	aead_request_set_tfm(subreq, ctx->geniv.child);
 
 	compl = req->base.complete;
 	data = req->base.data;
@@ -472,7 +456,7 @@ static int seqiv_aead_decrypt(struct aead_request *req)
 	if (req->cryptlen < ivsize + crypto_aead_authsize(geniv))
 		return -EINVAL;
 
-	aead_request_set_tfm(subreq, ctx->child);
+	aead_request_set_tfm(subreq, ctx->geniv.child);
 
 	compl = req->base.complete;
 	data = req->base.data;
@@ -536,27 +520,27 @@ unlock:
 	return seqiv_aead_givencrypt(req);
 }
 
-static int seqiv_aead_encrypt_compat_first(struct aead_request *req)
+static int seqniv_aead_encrypt_first(struct aead_request *req)
 {
 	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 	struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 	int err = 0;
 
-	spin_lock_bh(&ctx->lock);
-	if (geniv->encrypt != seqiv_aead_encrypt_compat_first)
+	spin_lock_bh(&ctx->geniv.lock);
+	if (geniv->encrypt != seqniv_aead_encrypt_first)
 		goto unlock;
 
-	geniv->encrypt = seqiv_aead_encrypt_compat;
+	geniv->encrypt = seqniv_aead_encrypt;
 	err = crypto_rng_get_bytes(crypto_default_rng, ctx->salt,
 				   crypto_aead_ivsize(geniv));
 
 unlock:
-	spin_unlock_bh(&ctx->lock);
+	spin_unlock_bh(&ctx->geniv.lock);
 
 	if (err)
 		return err;
 
-	return seqiv_aead_encrypt_compat(req);
+	return seqniv_aead_encrypt(req);
 }
 
 static int seqiv_aead_encrypt_first(struct aead_request *req)
@@ -565,7 +549,7 @@ static int seqiv_aead_encrypt_first(struct aead_request *req)
 	struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 	int err = 0;
 
-	spin_lock_bh(&ctx->lock);
+	spin_lock_bh(&ctx->geniv.lock);
 	if (geniv->encrypt != seqiv_aead_encrypt_first)
 		goto unlock;
 
@@ -574,7 +558,7 @@ static int seqiv_aead_encrypt_first(struct aead_request *req)
 				   crypto_aead_ivsize(geniv));
 
 unlock:
-	spin_unlock_bh(&ctx->lock);
+	spin_unlock_bh(&ctx->geniv.lock);
 
 	if (err)
 		return err;
@@ -613,7 +597,7 @@ static int seqiv_aead_init_common(struct crypto_tfm *tfm, unsigned int reqsize)
 	struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 	int err;
 
-	spin_lock_init(&ctx->lock);
+	spin_lock_init(&ctx->geniv.lock);
 
 	crypto_aead_set_reqsize(geniv, sizeof(struct aead_request));
 
@@ -626,7 +610,7 @@ static int seqiv_aead_init_common(struct crypto_tfm *tfm, unsigned int reqsize)
 	if (err)
 		goto drop_null;
 
-	ctx->child = geniv->child;
+	ctx->geniv.child = geniv->child;
 	geniv->child = geniv;
 
 out:
@@ -651,7 +635,7 @@ static void seqiv_aead_exit(struct crypto_tfm *tfm)
 {
 	struct seqiv_aead_ctx *ctx = crypto_tfm_ctx(tfm);
 
-	crypto_free_aead(ctx->child);
+	crypto_free_aead(ctx->geniv.child);
 	crypto_put_default_null_skcipher();
 }
 
@@ -738,15 +722,16 @@ static int seqiv_aead_create(struct crypto_template *tmpl, struct rtattr **tb)
 	if (inst->alg.base.cra_aead.encrypt)
 		return seqiv_old_aead_create(tmpl, inst);
 
+	spawn = aead_instance_ctx(inst);
+	alg = crypto_spawn_aead_alg(spawn);
+
+	if (alg->base.cra_aead.encrypt)
+		goto done;
+
 	err = -EINVAL;
 	if (inst->alg.ivsize != sizeof(u64))
 		goto free_inst;
 
-	spawn = aead_instance_ctx(inst);
-	alg = crypto_spawn_aead_alg(spawn);
-
-	inst->alg.setkey = seqiv_aead_setkey;
-	inst->alg.setauthsize = seqiv_aead_setauthsize;
 	inst->alg.encrypt = seqiv_aead_encrypt_first;
 	inst->alg.decrypt = seqiv_aead_decrypt;
 
@@ -756,14 +741,7 @@ static int seqiv_aead_create(struct crypto_template *tmpl, struct rtattr **tb)
 	inst->alg.base.cra_ctxsize = sizeof(struct seqiv_aead_ctx);
 	inst->alg.base.cra_ctxsize += inst->alg.base.cra_aead.ivsize;
 
-	if (alg->base.cra_aead.encrypt) {
-		inst->alg.encrypt = seqiv_aead_encrypt_compat_first;
-		inst->alg.decrypt = seqiv_aead_decrypt_compat;
-
-		inst->alg.base.cra_init = seqniv_aead_init;
-		inst->alg.base.cra_exit = seqiv_aead_exit;
-	}
-
+done:
 	err = aead_register_instance(tmpl, inst);
 	if (err)
 		goto free_inst;
@@ -816,17 +794,18 @@ static int seqniv_create(struct crypto_template *tmpl, struct rtattr **tb)
 	if (IS_ERR(inst))
 		goto put_rng;
 
+	spawn = aead_instance_ctx(inst);
+	alg = crypto_spawn_aead_alg(spawn);
+
+	if (alg->base.cra_aead.encrypt)
+		goto done;
+
 	err = -EINVAL;
 	if (inst->alg.ivsize != sizeof(u64))
 		goto free_inst;
 
-	spawn = aead_instance_ctx(inst);
-	alg = crypto_spawn_aead_alg(spawn);
-
-	inst->alg.setkey = seqiv_aead_setkey;
-	inst->alg.setauthsize = seqiv_aead_setauthsize;
-	inst->alg.encrypt = seqiv_aead_encrypt_compat_first;
-	inst->alg.decrypt = seqiv_aead_decrypt_compat;
+	inst->alg.encrypt = seqniv_aead_encrypt_first;
+	inst->alg.decrypt = seqniv_aead_decrypt;
 
 	inst->alg.base.cra_init = seqniv_aead_init;
 	inst->alg.base.cra_exit = seqiv_aead_exit;
@@ -835,6 +814,7 @@ static int seqniv_create(struct crypto_template *tmpl, struct rtattr **tb)
 	inst->alg.base.cra_ctxsize = sizeof(struct seqiv_aead_ctx);
 	inst->alg.base.cra_ctxsize += inst->alg.base.cra_aead.ivsize;
 
+done:
 	err = aead_register_instance(tmpl, inst);
 	if (err)
 		goto free_inst;

[PATCH 10/11] crypto: seqiv - Fix IV size in context size calculation

[Herbert Xu]

This patch fixes a bug in the context size calculation where we
were still referring to the old cra_aead.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/seqiv.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/seqiv.c b/crypto/seqiv.c
index 9c4490b..c0dba8f 100644
--- a/crypto/seqiv.c
+++ b/crypto/seqiv.c
@@ -812,7 +812,7 @@ static int seqniv_create(struct crypto_template *tmpl, struct rtattr **tb)
 
 	inst->alg.base.cra_alignmask |= __alignof__(u32) - 1;
 	inst->alg.base.cra_ctxsize = sizeof(struct seqiv_aead_ctx);
-	inst->alg.base.cra_ctxsize += inst->alg.base.cra_aead.ivsize;
+	inst->alg.base.cra_ctxsize += inst->alg.ivsize;
 
 done:
 	err = aead_register_instance(tmpl, inst);

[PATCH 11/11] crypto: seqiv - Fix module unload/reload crash

[Herbert Xu]

On module unload we weren't unregistering the seqniv template,
thus leading to a crash the next time someone walks the template
list.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

 crypto/seqiv.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/crypto/seqiv.c b/crypto/seqiv.c
index c0dba8f..2333974 100644
--- a/crypto/seqiv.c
+++ b/crypto/seqiv.c
@@ -874,6 +874,7 @@ out_undo_niv:
 
 static void __exit seqiv_module_exit(void)
 {
+	crypto_unregister_template(&seqniv_tmpl);
 	crypto_unregister_template(&seqiv_tmpl);
 }
 

Re: [PATCH 2/11] crypto: scatterwalk - Add missing sg_init_table to scatterwalk_ffwd

[Stephan Mueller]

Am Mittwoch, 27. Mai 2015, 14:37:27 schrieb Herbert Xu:

Hi Herbert,

>We need to call sg_init_table as otherwise the first entry may
>inadvertently become the last.
>
>Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Although the following remark is to the previous patch to add 
scatterwalk_ffwd, I would like to ask it here:
>---
>
> crypto/scatterwalk.c |    1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
>index 8690324..2ef9cbb 100644
>--- a/crypto/scatterwalk.c
>+++ b/crypto/scatterwalk.c
>@@ -158,6 +158,7 @@ struct scatterlist *scatterwalk_ffwd(struct scatterlist
>dst[2],
>		src = sg_next(src);

Shouldn't there be a check for src == NULL here? I see the scatterwalk_ffwd 
being used in the IV generators where they simply use the AD len and others. 
For AF_ALG, those values may be set by user space in a deliberately wrong way 
(e.g. more AD len than provided buffers).


Ciao
Stephan

Re: [PATCH 2/11] crypto: scatterwalk - Add missing sg_init_table to scatterwalk_ffwd

[Herbert Xu]

On Wed, May 27, 2015 at 11:00:55AM +0200, Stephan Mueller wrote:
>
> Shouldn't there be a check for src == NULL here? I see the scatterwalk_ffwd 
> being used in the IV generators where they simply use the AD len and others. 
> For AF_ALG, those values may be set by user space in a deliberately wrong way 
> (e.g. more AD len than provided buffers).

algif_aead should be verifying the user provided input.  AFAICS it
is doing exactly that.  The crash we had previously were due to
bugs in my algif_aead patch.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH 2/11] crypto: scatterwalk - Add missing sg_init_table to scatterwalk_ffwd

[Stephan Mueller]

Am Mittwoch, 27. Mai 2015, 17:08:55 schrieb Herbert Xu:

Hi Herbert,

>On Wed, May 27, 2015 at 11:00:55AM +0200, Stephan Mueller wrote:
>> Shouldn't there be a check for src == NULL here? I see the scatterwalk_ffwd
>> being used in the IV generators where they simply use the AD len and
>> others.
>> For AF_ALG, those values may be set by user space in a deliberately wrong
>> way (e.g. more AD len than provided buffers).
>
>algif_aead should be verifying the user provided input.  AFAICS it
>is doing exactly that.  The crash we had previously were due to
>bugs in my algif_aead patch.

To be precise, the concern I currently have are as follows. But I will test it 
later and report back:

The seqiv.c uses the following call:

                        scatterwalk_ffwd(dstbuf, req->dst,
                                         req->assoclen + ivsize),
                        scatterwalk_ffwd(srcbuf, req->src,
                                         req->assoclen + ivsize),

That together with my other tests for seqniv(rfc4106()) this indicates that 
the input SGL must contain AD || IV || PT.

The algif_aead, however only slurps in AD || PT via the sendmsg call and 
processes that as documented in the recvmsg call. So, the IV part is missing 
in the picture as the IV is set via the setsockopt.

So, the aforementioned call unconditionally advances the SGL by AD + 8 bytes 
where I am not sure that the 8 bytes are always accounted for by algif_aead.


Ciao
Stephan

Re: [PATCH 2/11] crypto: scatterwalk - Add missing sg_init_table to scatterwalk_ffwd

[Herbert Xu]

On Wed, May 27, 2015 at 01:24:48PM +0200, Stephan Mueller wrote:
> 
> To be precise, the concern I currently have are as follows. But I will test it 
> later and report back:
> 
> The seqiv.c uses the following call:
> 
>                         scatterwalk_ffwd(dstbuf, req->dst,
>                                          req->assoclen + ivsize),
>                         scatterwalk_ffwd(srcbuf, req->src,
>                                          req->assoclen + ivsize),
> 
> That together with my other tests for seqniv(rfc4106()) this indicates that 
> the input SGL must contain AD || IV || PT.

seqniv verifies that the IV is present.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt