From ac433dd00ed720169c43c2f7c70ab8cb04abe374 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 23 Feb 2018 17:53:40 +0100 Subject: [PATCH] 4.4-stable patches added patches: crypto-s5p-sss-fix-kernel-oops-in-aes-ecb-mode.patch --- ...-sss-fix-kernel-oops-in-aes-ecb-mode.patch | 60 +++++++++++++++++++ queue-4.4/series | 1 + 2 files changed, 61 insertions(+) create mode 100644 queue-4.4/crypto-s5p-sss-fix-kernel-oops-in-aes-ecb-mode.patch diff --git a/queue-4.4/crypto-s5p-sss-fix-kernel-oops-in-aes-ecb-mode.patch b/queue-4.4/crypto-s5p-sss-fix-kernel-oops-in-aes-ecb-mode.patch new file mode 100644 index 00000000000..ea126ed2c8b --- /dev/null +++ b/queue-4.4/crypto-s5p-sss-fix-kernel-oops-in-aes-ecb-mode.patch @@ -0,0 +1,60 @@ +From c927b080c67e3e97193c81fc1d27f4251bf4e036 Mon Sep 17 00:00:00 2001 +From: Kamil Konieczny +Date: Wed, 7 Feb 2018 16:52:09 +0100 +Subject: crypto: s5p-sss - Fix kernel Oops in AES-ECB mode + +From: Kamil Konieczny + +commit c927b080c67e3e97193c81fc1d27f4251bf4e036 upstream. + +In AES-ECB mode crypt is done with key only, so any use of IV +can cause kernel Oops. Use IV only in AES-CBC and AES-CTR. + +Signed-off-by: Kamil Konieczny +Reported-by: Anand Moon +Reviewed-by: Krzysztof Kozlowski +Tested-by: Anand Moon +Cc: stable@vger.kernel.org # can be applied after commit 8f9702aad138 +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/s5p-sss.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/crypto/s5p-sss.c ++++ b/drivers/crypto/s5p-sss.c +@@ -401,16 +401,21 @@ static void s5p_aes_crypt_start(struct s + uint32_t aes_control; + int err; + unsigned long flags; ++ u8 *iv; + + aes_control = SSS_AES_KEY_CHANGE_MODE; + if (mode & FLAGS_AES_DECRYPT) + aes_control |= SSS_AES_MODE_DECRYPT; + +- if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) ++ if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) { + aes_control |= SSS_AES_CHAIN_MODE_CBC; +- else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) ++ iv = req->info; ++ } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) { + aes_control |= SSS_AES_CHAIN_MODE_CTR; +- ++ iv = req->info; ++ } else { ++ iv = NULL; /* AES_ECB */ ++ } + if (dev->ctx->keylen == AES_KEYSIZE_192) + aes_control |= SSS_AES_KEY_SIZE_192; + else if (dev->ctx->keylen == AES_KEYSIZE_256) +@@ -440,7 +445,7 @@ static void s5p_aes_crypt_start(struct s + goto outdata_error; + + SSS_AES_WRITE(dev, AES_CONTROL, aes_control); +- s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen); ++ s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen); + + s5p_set_dma_indata(dev, req->src); + s5p_set_dma_outdata(dev, req->dst); diff --git a/queue-4.4/series b/queue-4.4/series index ef3319134a9..4cd715b327f 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -190,3 +190,4 @@ kvm-nvmx-vmx_complete_nested_posted_interrupt-can-t-fail.patch kvm-nvmx-fix-kernel-panics-induced-by-illegal-invept-invvpid-types.patch kvm-vmx-clean-up-declaration-of-vpid-ept-invalidation-types.patch kvm-nvmx-invvpid-handling-improvements.patch +crypto-s5p-sss-fix-kernel-oops-in-aes-ecb-mode.patch -- 2.47.3