[PATCH v4] crypto: rsassa-pkcs1 - Avoid cacheline sharing with underlying driver

[PATCH v4] crypto: rsassa-pkcs1 - Avoid cacheline sharing with underlying driver

[Changwei Zou]

out_buf is used as a DMA buffer for the RSA verification operation.
If out_buf is not aligned to CRYPTO_DMA_ALIGN, cacheline sharing
problems (data corruption) would occur on CPUs with DMA-incoherent caches,
leading to -EKEYREJECTED.

Allocate out_buf separately via kmalloc(), which guarantees cacheline
alignment on architectures without fully coherent DMA.
This acts as a defensive measure, and avoids the need for an extra copy
in the underlying driver, which should check alignment before supplying
buffers to the hardware.

The intermittent error 'Key was rejected by service' on i.MX8 with CAAM
can be triggered when loading signed kernel modules.

    for i in $(seq 1 100); do
        sudo modprobe xfs 2>&1 && echo "SUCCESS on attempt $i" \
        && sudo rmmod xfs || echo "FAILED on attempt $i"
    done

Signed-off-by: Changwei Zou <changwei.zou@canonical.com>
---
 crypto/rsassa-pkcs1.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/crypto/rsassa-pkcs1.c b/crypto/rsassa-pkcs1.c
index 94fa5e9600e7..cbd76394ebf0 100644
--- a/crypto/rsassa-pkcs1.c
+++ b/crypto/rsassa-pkcs1.c
@@ -227,6 +227,7 @@ static int rsassa_pkcs1_verify(struct crypto_sig *tfm,
 	struct scatterlist sg;
 	unsigned int dst_len;
 	unsigned int pos;
+	u8 *key_buf __free(kfree_sensitive) = NULL;
 	u8 *out_buf;
 	int err;
 
@@ -237,12 +238,12 @@ static int rsassa_pkcs1_verify(struct crypto_sig *tfm,
 		return -EINVAL;
 
 	/* RFC 8017 sec 8.2.2 step 2 - RSA verification */
-	child_req = kmalloc(sizeof(*child_req) + child_reqsize + ctx->key_size,
-			    GFP_KERNEL);
-	if (!child_req)
+	child_req = kmalloc(sizeof(*child_req) + child_reqsize, GFP_KERNEL);
+	key_buf = kmalloc(ctx->key_size, GFP_KERNEL);
+	if (!child_req || !key_buf)
 		return -ENOMEM;
 
-	out_buf = (u8 *)(child_req + 1) + child_reqsize;
+	out_buf = key_buf;
 	memcpy(out_buf, src, slen);
 
 	crypto_init_wait(&cwait);
-- 
2.43.0

Re: [PATCH v4] crypto: rsassa-pkcs1 - Avoid cacheline sharing with underlying driver

[Lukas Wunner]

On Thu, Jul 30, 2026 at 09:20:26PM +1000, Changwei Zou wrote:
> +++ b/crypto/rsassa-pkcs1.c
> @@ -227,6 +227,7 @@ static int rsassa_pkcs1_verify(struct crypto_sig *tfm,
>  	struct scatterlist sg;
>  	unsigned int dst_len;
>  	unsigned int pos;
> +	u8 *key_buf __free(kfree_sensitive) = NULL;
>  	u8 *out_buf;
>  	int err;
>

Hm, why use an additional key_buf variable instead of using the existing
out_buf?

key_buf also seems to be misnomer, the buffer contains a digest.

For neatness, could you move the new declaration up below the one for
child_req so that the variable declarations sort of adhere to inverse
christmas tree convention.

Thanks,

Lukas

Re: [PATCH v4] crypto: rsassa-pkcs1 - Avoid cacheline sharing with underlying driver

[Changwei Zou]

Hi Lukas,

I will move the new declaration up below the one for child_req.

Since out_buf is incremented later in the function rsassa_pkcs1_verify(),
key_buf was introduced to preserve the original address returned by kmalloc().

I tried the following approach, but it would require replacing all existing
occurrences of out_buf with ptr.

	u8 *out_buf __free(kfree_sensitive) = NULL;
	
	u8 *ptr;

	ptr = out_buf;

Could you please give me some advice on this?
Thanks a lot.

Kind regards,
Changwei