releases/4.19.31/crypto-aead-set-crypto_tfm_need_key-if-setkey-fails.patch

   1 From 6ebc97006b196aafa9df0497fdfa866cf26f259b Mon Sep 17 00:00:00 2001
   2 From: Eric Biggers <ebiggers@google.com>
   3 Date: Sun, 6 Jan 2019 18:47:44 -0800
   4 Subject: crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
   5
   6 From: Eric Biggers <ebiggers@google.com>
   7
   8 commit 6ebc97006b196aafa9df0497fdfa866cf26f259b upstream.
   9
  10 Some algorithms have a ->setkey() method that is not atomic, in the
  11 sense that setting a key can fail after changes were already made to the
  12 tfm context.  In this case, if a key was already set the tfm can end up
  13 in a state that corresponds to neither the old key nor the new key.
  14
  15 For example, in gcm.c, if the kzalloc() fails due to lack of memory,
  16 then the CTR part of GCM will have the new key but GHASH will not.
  17
  18 It's not feasible to make all ->setkey() methods atomic, especially ones
  19 that have to key multiple sub-tfms.  Therefore, make the crypto API set
  20 CRYPTO_TFM_NEED_KEY if ->setkey() fails, to prevent the tfm from being
  21 used until a new key is set.
  22
  23 [Cc stable mainly because when introducing the NEED_KEY flag I changed
  24  AF_ALG to rely on it; and unlike in-kernel crypto API users, AF_ALG
  25  previously didn't have this problem.  So these "incompletely keyed"
  26  states became theoretically accessible via AF_ALG -- though, the
  27  opportunities for causing real mischief seem pretty limited.]
  28
  29 Fixes: dc26c17f743a ("crypto: aead - prevent using AEADs without setting key")
  30 Cc: <stable@vger.kernel.org> # v4.16+
  31 Signed-off-by: Eric Biggers <ebiggers@google.com>
  32 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  33 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  34
  35 ---
  36  crypto/aead.c |    4 +++-
  37  1 file changed, 3 insertions(+), 1 deletion(-)
  38
  39 --- a/crypto/aead.c
  40 +++ b/crypto/aead.c
  41 @@ -61,8 +61,10 @@ int crypto_aead_setkey(struct crypto_aea
  42         else
  43                 err = crypto_aead_alg(tfm)->setkey(tfm, key, keylen);
  44
  45 -       if (err)
  46 +       if (unlikely(err)) {
  47 +               crypto_aead_set_flags(tfm, CRYPTO_TFM_NEED_KEY);
  48                 return err;
  49 +       }
  50
  51         crypto_aead_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
  52         return 0;