Re: [PATCH] crypto: s390/hmac - Fix counter in export state

[Ingo Franzki <ifranzki@linux.ibm.com>]

On 23.05.2025 13:24, Herbert Xu wrote:
> On Fri, May 23, 2025 at 10:02:18AM +0200, Ingo Franzki wrote:
>>
>> Yes, indeed, reverting this commit makes the problem to go away. 
> 
> Great.  While I've got your attenttion, could you also test this
> patch to see if it makes the hmac errors go away?

Yes, with your fix below and with commit 18c438b228558e05ede7dccf947a6547516fc0c7 the HMAC failures are no longer seen, but the SHA3 failures are still there (I guess that's as you have expected it). 

> 
> Thanks,
> 
> ---8<---
> The hmac export state needs to be one block-size bigger to account
> for the ipad.
> 
> Reported-by: Ingo Franzki <ifranzki@linux.ibm.com>
> Fixes: 08811169ac01 ("crypto: s390/hmac - Use API partial block handling")
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> 
> diff --git a/arch/s390/crypto/hmac_s390.c b/arch/s390/crypto/hmac_s390.c
> index 93a1098d9f8d..58444da9b004 100644
> --- a/arch/s390/crypto/hmac_s390.c
> +++ b/arch/s390/crypto/hmac_s390.c
> @@ -290,6 +290,7 @@ static int s390_hmac_export(struct shash_desc *desc, void *out)
>  	struct s390_kmac_sha2_ctx *ctx = shash_desc_ctx(desc);
>  	unsigned int bs = crypto_shash_blocksize(desc->tfm);
>  	unsigned int ds = bs / 2;
> +	u64 lo = ctx->buflen[0];
>  	union {
>  		u8 *u8;
>  		u64 *u64;
> @@ -301,9 +302,10 @@ static int s390_hmac_export(struct shash_desc *desc, void *out)
>  	else
>  		memcpy(p.u8, ctx->param, ds);
>  	p.u8 += ds;
> -	put_unaligned(ctx->buflen[0], p.u64++);
> +	lo += bs;
> +	put_unaligned(lo, p.u64++);
>  	if (ds == SHA512_DIGEST_SIZE)
> -		put_unaligned(ctx->buflen[1], p.u64);
> +		put_unaligned(ctx->buflen[1] + (lo < bs), p.u64);
>  	return err;
>  }
>  
> @@ -316,14 +318,16 @@ static int s390_hmac_import(struct shash_desc *desc, const void *in)
>  		const u8 *u8;
>  		const u64 *u64;
>  	} p = { .u8 = in };
> +	u64 lo;
>  	int err;
>  
>  	err = s390_hmac_sha2_init(desc);
>  	memcpy(ctx->param, p.u8, ds);
>  	p.u8 += ds;
> -	ctx->buflen[0] = get_unaligned(p.u64++);
> +	lo = get_unaligned(p.u64++);
> +	ctx->buflen[0] = lo - bs;
>  	if (ds == SHA512_DIGEST_SIZE)
> -		ctx->buflen[1] = get_unaligned(p.u64);
> +		ctx->buflen[1] = get_unaligned(p.u64) - (lo < bs);
>  	if (ctx->buflen[0] | ctx->buflen[1])
>  		ctx->gr0.ikp = 1;
>  	return err;


-- 
Ingo Franzki
eMail: ifranzki@linux.ibm.com  
Tel: ++49 (0)7031-16-4648
Linux on IBM Z Development, Schoenaicher Str. 220, 71032 Boeblingen, Germany

IBM Deutschland Research & Development GmbH
Vorsitzender des Aufsichtsrats: Gregor Pillen
Geschäftsführung: David Faller
Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM DATA Privacy Statement: https://www.ibm.com/privacy/us/en/