From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Junaid Shahid <junaids@google.com>,
Herbert Xu <herbert@gondor.apana.org.au>
Subject: [PATCH 4.15 11/55] crypto: aesni - Fix out-of-bounds access of the AAD buffer in generic-gcm-aesni
Date: Fri, 2 Feb 2018 17:58:29 +0100 [thread overview]
Message-ID: <20180202140827.054720047@linuxfoundation.org> (raw)
In-Reply-To: <20180202140826.117602411@linuxfoundation.org>
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junaid Shahid <junaids@google.com>
commit 1ecdd37e308ca149dc378cce225068cbac54e3a6 upstream.
The aesni_gcm_enc/dec functions can access memory after the end of
the AAD buffer if the AAD length is not a multiple of 4 bytes.
It didn't matter with rfc4106-gcm-aesni as in that case the AAD was
always followed by the 8 byte IV, but that is no longer the case with
generic-gcm-aesni. This can potentially result in accessing a page that
is not mapped and thus causing the machine to crash. This patch fixes
that by reading the last <16 byte block of the AAD byte-by-byte and
optionally via an 8-byte load if the block was at least 8 bytes.
Fixes: 0487ccac ("crypto: aesni - make non-AVX AES-GCM work with any aadlen")
Signed-off-by: Junaid Shahid <junaids@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/crypto/aesni-intel_asm.S | 112 ++++----------------------------------
1 file changed, 12 insertions(+), 100 deletions(-)
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -90,30 +90,6 @@ SHIFT_MASK: .octa 0x0f0e0d0c0b0a09080706
ALL_F: .octa 0xffffffffffffffffffffffffffffffff
.octa 0x00000000000000000000000000000000
-.section .rodata
-.align 16
-.type aad_shift_arr, @object
-.size aad_shift_arr, 272
-aad_shift_arr:
- .octa 0xffffffffffffffffffffffffffffffff
- .octa 0xffffffffffffffffffffffffffffff0C
- .octa 0xffffffffffffffffffffffffffff0D0C
- .octa 0xffffffffffffffffffffffffff0E0D0C
- .octa 0xffffffffffffffffffffffff0F0E0D0C
- .octa 0xffffffffffffffffffffff0C0B0A0908
- .octa 0xffffffffffffffffffff0D0C0B0A0908
- .octa 0xffffffffffffffffff0E0D0C0B0A0908
- .octa 0xffffffffffffffff0F0E0D0C0B0A0908
- .octa 0xffffffffffffff0C0B0A090807060504
- .octa 0xffffffffffff0D0C0B0A090807060504
- .octa 0xffffffffff0E0D0C0B0A090807060504
- .octa 0xffffffff0F0E0D0C0B0A090807060504
- .octa 0xffffff0C0B0A09080706050403020100
- .octa 0xffff0D0C0B0A09080706050403020100
- .octa 0xff0E0D0C0B0A09080706050403020100
- .octa 0x0F0E0D0C0B0A09080706050403020100
-
-
.text
@@ -304,62 +280,30 @@ _done_read_partial_block_\@:
XMM2 XMM3 XMM4 XMMDst TMP6 TMP7 i i_seq operation
MOVADQ SHUF_MASK(%rip), %xmm14
mov arg7, %r10 # %r10 = AAD
- mov arg8, %r12 # %r12 = aadLen
- mov %r12, %r11
+ mov arg8, %r11 # %r11 = aadLen
pxor %xmm\i, %xmm\i
pxor \XMM2, \XMM2
cmp $16, %r11
- jl _get_AAD_rest8\num_initial_blocks\operation
+ jl _get_AAD_rest\num_initial_blocks\operation
_get_AAD_blocks\num_initial_blocks\operation:
movdqu (%r10), %xmm\i
PSHUFB_XMM %xmm14, %xmm\i # byte-reflect the AAD data
pxor %xmm\i, \XMM2
GHASH_MUL \XMM2, \TMP3, \TMP1, \TMP2, \TMP4, \TMP5, \XMM1
add $16, %r10
- sub $16, %r12
sub $16, %r11
cmp $16, %r11
jge _get_AAD_blocks\num_initial_blocks\operation
movdqu \XMM2, %xmm\i
+
+ /* read the last <16B of AAD */
+_get_AAD_rest\num_initial_blocks\operation:
cmp $0, %r11
je _get_AAD_done\num_initial_blocks\operation
- pxor %xmm\i,%xmm\i
-
- /* read the last <16B of AAD. since we have at least 4B of
- data right after the AAD (the ICV, and maybe some CT), we can
- read 4B/8B blocks safely, and then get rid of the extra stuff */
-_get_AAD_rest8\num_initial_blocks\operation:
- cmp $4, %r11
- jle _get_AAD_rest4\num_initial_blocks\operation
- movq (%r10), \TMP1
- add $8, %r10
- sub $8, %r11
- pslldq $8, \TMP1
- psrldq $8, %xmm\i
- pxor \TMP1, %xmm\i
- jmp _get_AAD_rest8\num_initial_blocks\operation
-_get_AAD_rest4\num_initial_blocks\operation:
- cmp $0, %r11
- jle _get_AAD_rest0\num_initial_blocks\operation
- mov (%r10), %eax
- movq %rax, \TMP1
- add $4, %r10
- sub $4, %r10
- pslldq $12, \TMP1
- psrldq $4, %xmm\i
- pxor \TMP1, %xmm\i
-_get_AAD_rest0\num_initial_blocks\operation:
- /* finalize: shift out the extra bytes we read, and align
- left. since pslldq can only shift by an immediate, we use
- vpshufb and an array of shuffle masks */
- movq %r12, %r11
- salq $4, %r11
- movdqu aad_shift_arr(%r11), \TMP1
- PSHUFB_XMM \TMP1, %xmm\i
-_get_AAD_rest_final\num_initial_blocks\operation:
+ READ_PARTIAL_BLOCK %r10, %r11, \TMP1, %xmm\i
PSHUFB_XMM %xmm14, %xmm\i # byte-reflect the AAD data
pxor \XMM2, %xmm\i
GHASH_MUL %xmm\i, \TMP3, \TMP1, \TMP2, \TMP4, \TMP5, \XMM1
@@ -563,62 +507,30 @@ _initial_blocks_done\num_initial_blocks\
XMM2 XMM3 XMM4 XMMDst TMP6 TMP7 i i_seq operation
MOVADQ SHUF_MASK(%rip), %xmm14
mov arg7, %r10 # %r10 = AAD
- mov arg8, %r12 # %r12 = aadLen
- mov %r12, %r11
+ mov arg8, %r11 # %r11 = aadLen
pxor %xmm\i, %xmm\i
pxor \XMM2, \XMM2
cmp $16, %r11
- jl _get_AAD_rest8\num_initial_blocks\operation
+ jl _get_AAD_rest\num_initial_blocks\operation
_get_AAD_blocks\num_initial_blocks\operation:
movdqu (%r10), %xmm\i
PSHUFB_XMM %xmm14, %xmm\i # byte-reflect the AAD data
pxor %xmm\i, \XMM2
GHASH_MUL \XMM2, \TMP3, \TMP1, \TMP2, \TMP4, \TMP5, \XMM1
add $16, %r10
- sub $16, %r12
sub $16, %r11
cmp $16, %r11
jge _get_AAD_blocks\num_initial_blocks\operation
movdqu \XMM2, %xmm\i
+
+ /* read the last <16B of AAD */
+_get_AAD_rest\num_initial_blocks\operation:
cmp $0, %r11
je _get_AAD_done\num_initial_blocks\operation
- pxor %xmm\i,%xmm\i
-
- /* read the last <16B of AAD. since we have at least 4B of
- data right after the AAD (the ICV, and maybe some PT), we can
- read 4B/8B blocks safely, and then get rid of the extra stuff */
-_get_AAD_rest8\num_initial_blocks\operation:
- cmp $4, %r11
- jle _get_AAD_rest4\num_initial_blocks\operation
- movq (%r10), \TMP1
- add $8, %r10
- sub $8, %r11
- pslldq $8, \TMP1
- psrldq $8, %xmm\i
- pxor \TMP1, %xmm\i
- jmp _get_AAD_rest8\num_initial_blocks\operation
-_get_AAD_rest4\num_initial_blocks\operation:
- cmp $0, %r11
- jle _get_AAD_rest0\num_initial_blocks\operation
- mov (%r10), %eax
- movq %rax, \TMP1
- add $4, %r10
- sub $4, %r10
- pslldq $12, \TMP1
- psrldq $4, %xmm\i
- pxor \TMP1, %xmm\i
-_get_AAD_rest0\num_initial_blocks\operation:
- /* finalize: shift out the extra bytes we read, and align
- left. since pslldq can only shift by an immediate, we use
- vpshufb and an array of shuffle masks */
- movq %r12, %r11
- salq $4, %r11
- movdqu aad_shift_arr(%r11), \TMP1
- PSHUFB_XMM \TMP1, %xmm\i
-_get_AAD_rest_final\num_initial_blocks\operation:
+ READ_PARTIAL_BLOCK %r10, %r11, \TMP1, %xmm\i
PSHUFB_XMM %xmm14, %xmm\i # byte-reflect the AAD data
pxor \XMM2, %xmm\i
GHASH_MUL %xmm\i, \TMP3, \TMP1, \TMP2, \TMP4, \TMP5, \XMM1
next prev parent reply other threads:[~2018-02-02 17:14 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-02 16:58 [PATCH 4.15 00/55] 4.15.1-stable review Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 03/55] gpio: stmpe: i2c transfer are forbiden in atomic context Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 04/55] gpio: Fix kernel stack leak to userspace Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 05/55] ALSA: hda - Reduce the suspend time consumption for ALC256 Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 06/55] crypto: ecdh - fix typo in KPP dependency of CRYPTO_ECDH Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 07/55] crypto: aesni - handle zero length dst buffer Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 08/55] crypto: aesni - fix typo in generic_gcmaes_decrypt Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 09/55] crypto: aesni - add wrapper for generic gcm(aes) Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 10/55] crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-aesni Greg Kroah-Hartman
2018-02-02 16:58 ` Greg Kroah-Hartman [this message]
2018-02-02 16:58 ` [PATCH 4.15 12/55] crypto: inside-secure - fix hash when length is a multiple of a block Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 13/55] crypto: inside-secure - avoid unmapping DMA memory that was not mapped Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 14/55] crypto: sha3-generic - fixes for alignment and big endian operation Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 15/55] crypto: af_alg - whitelist mask and type Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 16/55] HID: wacom: EKR: ensure devres groups at higher indexes are released Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 17/55] HID: wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 18/55] power: reset: zx-reboot: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 19/55] gpio: iop: " Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 20/55] gpio: ath79: add missing MODULE_DESCRIPTION/LICENSE Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 21/55] mtd: nand: denali_pci: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 22/55] igb: Free IRQs when device is hotplugged Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 23/55] ima/policy: fix parsing of fsuuid Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 24/55] scsi: aacraid: Fix udev inquiry race condition Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 25/55] scsi: aacraid: Fix hang in kdump Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 26/55] scsi: storvsc: missing error code in storvsc_probe() Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 27/55] staging: lustre: separate a connection destroy from free struct kib_conn Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 28/55] staging: ccree: NULLify backup_info when unused Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 29/55] staging: ccree: fix fips event irq handling build Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 30/55] tty: fix data race between tty_init_dev and flush of buf Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 31/55] usb: option: Add support for FS040U modem Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 33/55] USB: cdc-acm: Do not log urb submission errors on disconnect Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 34/55] CDC-ACM: apply quirk for card reader Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 35/55] USB: serial: io_edgeport: fix possible sleep-in-atomic Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 36/55] usbip: prevent bind loops on devices attached to vhci_hcd Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 37/55] usbip: list: dont list " Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 38/55] USB: serial: simple: add Motorola Tetra driver Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 39/55] usb: f_fs: Prevent gadget unbind if it is already unbound Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 40/55] usb: uas: unconditionally bring back host after reset Greg Kroah-Hartman
2018-02-02 16:58 ` [PATCH 4.15 41/55] usb/gadget: Fix "high bandwidth" check in usb_gadget_ep_match_desc() Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 42/55] ANDROID: binder: remove waitqueue when thread exits Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 43/55] android: binder: use VM_ALLOC to get vm area Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 44/55] mei: me: allow runtime pm for platform with D0i3 Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 45/55] serial: 8250_of: fix return code when probe function fails to get reset Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 46/55] serial: 8250_uniphier: fix error return code in uniphier_uart_probe() Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 47/55] serial: 8250_dw: Revert "Improve clock rate setting" Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 48/55] serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 49/55] spi: imx: do not access registers while clocks disabled Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 50/55] iio: adc: stm32: fix scan of multiple channels with DMA Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 51/55] iio: chemical: ccs811: Fix output of IIO_CONCENTRATION channels Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 52/55] test_firmware: fix missing unlock on error in config_num_requests_store() Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 53/55] Input: synaptics-rmi4 - unmask F03 interrupts when port is opened Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 54/55] Input: synaptics-rmi4 - do not delete interrupt memory too early Greg Kroah-Hartman
2018-02-02 16:59 ` [PATCH 4.15 55/55] x86/efi: Clarify that reset attack mitigation needs appropriate userspace Greg Kroah-Hartman
2018-02-02 22:17 ` [PATCH 4.15 00/55] 4.15.1-stable review Shuah Khan
2018-02-03 5:16 ` Greg Kroah-Hartman
2018-02-03 4:35 ` Dan Rue
2018-02-03 5:18 ` Greg Kroah-Hartman
2018-02-05 15:50 ` Milosz Wasilewski
2018-02-03 15:34 ` Guenter Roeck
2018-02-03 15:44 ` Greg Kroah-Hartman
2018-02-03 16:46 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180202140827.054720047@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=junaids@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).