Re: [PATCH] crypto: af_alg: Allow cbc(paes)

[Eric Biggers <ebiggers@kernel.org>]

On Sun, Jul 26, 2026 at 09:27:16PM +0200, Richard Weinberger wrote:
> Commit 7524070f26d8 ("crypto: af_alg - Drop support for off-CPU cryptography")
> breaks a special use case.  The cbc-paes-caam driver implements the
> algorithm cbc(paes), it offers a way to use AES in CBC mode with key
> material unknown to userspace.  Instead of an AES key a CAAM BLOB is
> passed to the kernel.  So, this crypto operation cannot be
> implemented in a userspace library and needs always help from the
> kernel.
> 
> Explicitly allow this use case.
> 
> Cc: Demi Marie Obenour <demiobenour@gmail.com>
> Suggested-by: Eric Biggers <ebiggers@kernel.org>
> Fixes: 7524070f26d8 ("crypto: af_alg - Drop support for off-CPU cryptography")
> Signed-off-by: Richard Weinberger <richard@nod.at>
> ---
>  crypto/algif_skcipher.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
> index df20bdfe1f1f..035fed7db81f 100644
> --- a/crypto/algif_skcipher.c
> +++ b/crypto/algif_skcipher.c
> @@ -32,6 +32,7 @@
>  #include <linux/mm.h>
>  #include <linux/module.h>
>  #include <linux/net.h>
> +#include <linux/string.h>
>  #include <net/sock.h>
>  
>  static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg,
> @@ -309,7 +310,12 @@ static struct proto_ops algif_skcipher_ops_nokey = {
>  
>  static void *skcipher_bind(const char *name)
>  {
> -	return crypto_alloc_skcipher(name, 0, AF_ALG_CRYPTOAPI_MASK);
> +	u32 mask = AF_ALG_CRYPTOAPI_MASK;
> +
> +	if (strcmp(name, "cbc(paes)") == 0)
> +		mask = 0;
> +
> +	return crypto_alloc_skcipher(name, 0, mask);
>  }

Reviewed-by: Eric Biggers <ebiggers@kernel.org>

I'll note that this overrides userspace's request if they call bind()
with salg_feat=0 && salg_mask=CRYPTO_ALG_KERN_DRIVER_ONLY, expressing an
intent to exclude algorithms that have CRYPTO_ALG_KERN_DRIVER_ONLY set.

However, it doesn't make sense to request that with "cbc(paes)".  Also,
salg_feat and salg_mask seem to be de facto unused anyway: the only
supported flag has ever been CRYPTO_ALG_KERN_DRIVER_ONLY; alg_bind()
returns -EINVAL on anything else.  And it isn't even declared in a UAPI
header.  I think every use of AF_ALG I've seen uses salg_feat=0 &&
salg_mask=0, usually by leaving those fields default-zero-initialized.

So we could go a bit further and integrate this correctly with the
salg_feat and salg_mask.  But I wouldn't consider it essential.

- Eric