1 From b1f6b4bf416b49f00f3abc49c639371cdecaaad1 Mon Sep 17 00:00:00 2001
2 From: Eric Biggers <ebiggers@google.com>
3 Date: Sun, 6 Jan 2019 18:47:43 -0800
4 Subject: crypto: skcipher - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
6 From: Eric Biggers <ebiggers@google.com>
8 commit b1f6b4bf416b49f00f3abc49c639371cdecaaad1 upstream.
10 Some algorithms have a ->setkey() method that is not atomic, in the
11 sense that setting a key can fail after changes were already made to the
12 tfm context. In this case, if a key was already set the tfm can end up
13 in a state that corresponds to neither the old key nor the new key.
15 For example, in lrw.c, if gf128mul_init_64k_bbe() fails due to lack of
16 memory, then priv::table will be left NULL. After that, encryption with
17 that tfm will cause a NULL pointer dereference.
19 It's not feasible to make all ->setkey() methods atomic, especially ones
20 that have to key multiple sub-tfms. Therefore, make the crypto API set
21 CRYPTO_TFM_NEED_KEY if ->setkey() fails and the algorithm requires a
22 key, to prevent the tfm from being used until a new key is set.
24 [Cc stable mainly because when introducing the NEED_KEY flag I changed
25 AF_ALG to rely on it; and unlike in-kernel crypto API users, AF_ALG
26 previously didn't have this problem. So these "incompletely keyed"
27 states became theoretically accessible via AF_ALG -- though, the
28 opportunities for causing real mischief seem pretty limited.]
30 Fixes: f8d33fac8480 ("crypto: skcipher - prevent using skciphers without setting key")
31 Cc: <stable@vger.kernel.org> # v4.16+
32 Signed-off-by: Eric Biggers <ebiggers@google.com>
33 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
34 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
37 crypto/skcipher.c | 27 ++++++++++++++++++---------
38 1 file changed, 18 insertions(+), 9 deletions(-)
40 --- a/crypto/skcipher.c
41 +++ b/crypto/skcipher.c
42 @@ -585,6 +585,12 @@ static unsigned int crypto_skcipher_exts
43 return crypto_alg_extsize(alg);
46 +static void skcipher_set_needkey(struct crypto_skcipher *tfm)
49 + crypto_skcipher_set_flags(tfm, CRYPTO_TFM_NEED_KEY);
52 static int skcipher_setkey_blkcipher(struct crypto_skcipher *tfm,
53 const u8 *key, unsigned int keylen)
55 @@ -598,8 +604,10 @@ static int skcipher_setkey_blkcipher(str
56 err = crypto_blkcipher_setkey(blkcipher, key, keylen);
57 crypto_skcipher_set_flags(tfm, crypto_blkcipher_get_flags(blkcipher) &
60 + if (unlikely(err)) {
61 + skcipher_set_needkey(tfm);
65 crypto_skcipher_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
67 @@ -677,8 +685,7 @@ static int crypto_init_skcipher_ops_blkc
68 skcipher->ivsize = crypto_blkcipher_ivsize(blkcipher);
69 skcipher->keysize = calg->cra_blkcipher.max_keysize;
71 - if (skcipher->keysize)
72 - crypto_skcipher_set_flags(skcipher, CRYPTO_TFM_NEED_KEY);
73 + skcipher_set_needkey(skcipher);
77 @@ -698,8 +705,10 @@ static int skcipher_setkey_ablkcipher(st
78 crypto_skcipher_set_flags(tfm,
79 crypto_ablkcipher_get_flags(ablkcipher) &
82 + if (unlikely(err)) {
83 + skcipher_set_needkey(tfm);
87 crypto_skcipher_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
89 @@ -776,8 +785,7 @@ static int crypto_init_skcipher_ops_ablk
90 sizeof(struct ablkcipher_request);
91 skcipher->keysize = calg->cra_ablkcipher.max_keysize;
93 - if (skcipher->keysize)
94 - crypto_skcipher_set_flags(skcipher, CRYPTO_TFM_NEED_KEY);
95 + skcipher_set_needkey(skcipher);
99 @@ -820,8 +828,10 @@ static int skcipher_setkey(struct crypto
101 err = cipher->setkey(tfm, key, keylen);
104 + if (unlikely(err)) {
105 + skcipher_set_needkey(tfm);
109 crypto_skcipher_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
111 @@ -852,8 +862,7 @@ static int crypto_skcipher_init_tfm(stru
112 skcipher->ivsize = alg->ivsize;
113 skcipher->keysize = alg->max_keysize;
115 - if (skcipher->keysize)
116 - crypto_skcipher_set_flags(skcipher, CRYPTO_TFM_NEED_KEY);
117 + skcipher_set_needkey(skcipher);
120 skcipher->base.exit = crypto_skcipher_exit_tfm;