From: Greg Kroah-Hartman Date: Fri, 16 Oct 2020 08:19:45 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v5.9.1~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=684fc1e37359625b047425d57bc4008f45c0fd51;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: crypto-qat-check-cipher-length-for-aead-aes-cbc-hmac-sha.patch --- diff --git a/queue-4.9/crypto-qat-check-cipher-length-for-aead-aes-cbc-hmac-sha.patch b/queue-4.9/crypto-qat-check-cipher-length-for-aead-aes-cbc-hmac-sha.patch new file mode 100644 index 00000000000..4dad67cf0e5 --- /dev/null +++ b/queue-4.9/crypto-qat-check-cipher-length-for-aead-aes-cbc-hmac-sha.patch @@ -0,0 +1,59 @@ +From 45cb6653b0c355fc1445a8069ba78a4ce8720511 Mon Sep 17 00:00:00 2001 +From: Dominik Przychodni +Date: Mon, 31 Aug 2020 11:59:59 +0100 +Subject: crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA + +From: Dominik Przychodni + +commit 45cb6653b0c355fc1445a8069ba78a4ce8720511 upstream. + +Return -EINVAL for authenc(hmac(sha1),cbc(aes)), +authenc(hmac(sha256),cbc(aes)) and authenc(hmac(sha512),cbc(aes)) +if the cipher length is not multiple of the AES block. +This is to prevent an undefined device behaviour. + +Fixes: d370cec32194 ("crypto: qat - Intel(R) QAT crypto interface") +Cc: +Signed-off-by: Dominik Przychodni +[giovanni.cabiddu@intel.com: reworded commit message] +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/qat/qat_common/qat_algs.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/crypto/qat/qat_common/qat_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_algs.c +@@ -822,6 +822,11 @@ static int qat_alg_aead_dec(struct aead_ + struct icp_qat_fw_la_bulk_req *msg; + int digst_size = crypto_aead_authsize(aead_tfm); + int ret, ctr = 0; ++ u32 cipher_len; ++ ++ cipher_len = areq->cryptlen - digst_size; ++ if (cipher_len % AES_BLOCK_SIZE != 0) ++ return -EINVAL; + + ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); + if (unlikely(ret)) +@@ -836,7 +841,7 @@ static int qat_alg_aead_dec(struct aead_ + qat_req->req.comn_mid.src_data_addr = qat_req->buf.blp; + qat_req->req.comn_mid.dest_data_addr = qat_req->buf.bloutp; + cipher_param = (void *)&qat_req->req.serv_specif_rqpars; +- cipher_param->cipher_length = areq->cryptlen - digst_size; ++ cipher_param->cipher_length = cipher_len; + cipher_param->cipher_offset = areq->assoclen; + memcpy(cipher_param->u.cipher_IV_array, areq->iv, AES_BLOCK_SIZE); + auth_param = (void *)((uint8_t *)cipher_param + sizeof(*cipher_param)); +@@ -865,6 +870,9 @@ static int qat_alg_aead_enc(struct aead_ + uint8_t *iv = areq->iv; + int ret, ctr = 0; + ++ if (areq->cryptlen % AES_BLOCK_SIZE != 0) ++ return -EINVAL; ++ + ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); + if (unlikely(ret)) + return ret; diff --git a/queue-4.9/series b/queue-4.9/series index a93a3f64c83..7db545e8244 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -13,3 +13,4 @@ usb-serial-pl2303-add-device-id-for-hp-gc-device.patch usb-serial-ftdi_sio-add-support-for-freecalypso-jtag-uart-adapters.patch reiserfs-initialize-inode-keys-properly.patch reiserfs-fix-oops-during-mount.patch +crypto-qat-check-cipher-length-for-aead-aes-cbc-hmac-sha.patch