Commit 51029812 authored by Stephan Mueller's avatar Stephan Mueller Committed by Herbert Xu
Browse files

crypto: drbg - prevent invalid SG mappings 



When using SGs, only heap memory (memory that is valid as per
virt_addr_valid) is allowed to be referenced. The CTR DRBG used to
reference the caller-provided memory directly in an SG. In case the
caller provided stack memory pointers, the SG mapping is not considered
to be valid. In some cases, this would even cause a paging fault.

The change adds a new scratch buffer that is used unconditionally to
catch the cases where the caller-provided buffer is not suitable for
use in an SG. The crypto operation of the CTR DRBG produces its output
with that scratch buffer and finally copies the content of the
scratch buffer to the caller's buffer.

The scratch buffer is allocated during allocation time of the CTR DRBG
as its access is protected with the DRBG mutex.

Signed-off-by: default avatarStephan Mueller <smueller@chronox.de>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent c8467f7a

crypto/drbg.c

+24 −5
Original line number Diff line number Diff line
@@ -262,6 +262,7 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, 
			      u8 *inbuf, u32 inbuflen,

			      u8 *outbuf, u32 outlen);

#define DRBG_CTR_NULL_LEN 128

#define DRBG_OUTSCRATCHLEN DRBG_CTR_NULL_LEN



/* BCC function for CTR DRBG as defined in 10.4.3 */

static int drbg_ctr_bcc(struct drbg_state *drbg,
@@ -1644,6 +1645,9 @@ static int drbg_fini_sym_kernel(struct drbg_state *drbg) 
	kfree(drbg->ctr_null_value_buf);

	drbg->ctr_null_value = NULL;



	kfree(drbg->outscratchpadbuf);

	drbg->outscratchpadbuf = NULL;



	return 0;

}
@@ -1708,6 +1712,15 @@ static int drbg_init_sym_kernel(struct drbg_state *drbg) 
	drbg->ctr_null_value = (u8 *)PTR_ALIGN(drbg->ctr_null_value_buf,

					       alignmask + 1);



	drbg->outscratchpadbuf = kmalloc(DRBG_OUTSCRATCHLEN + alignmask,

					 GFP_KERNEL);

	if (!drbg->outscratchpadbuf) {

		drbg_fini_sym_kernel(drbg);

		return -ENOMEM;

	}

	drbg->outscratchpad = (u8 *)PTR_ALIGN(drbg->outscratchpadbuf,

					      alignmask + 1);



	return alignmask;

}
@@ -1737,15 +1750,16 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, 
			      u8 *outbuf, u32 outlen)

{

	struct scatterlist sg_in;

	int ret;



	sg_init_one(&sg_in, inbuf, inlen);



	while (outlen) {

		u32 cryptlen = min_t(u32, inlen, outlen);

		u32 cryptlen = min3(inlen, outlen, (u32)DRBG_OUTSCRATCHLEN);

		struct scatterlist sg_out;

		int ret;



		sg_init_one(&sg_out, outbuf, cryptlen);

		/* Output buffer may not be valid for SGL, use scratchpad */

		sg_init_one(&sg_out, drbg->outscratchpad, cryptlen);

		skcipher_request_set_crypt(drbg->ctr_req, &sg_in, &sg_out,

					   cryptlen, drbg->V);

		ret = crypto_skcipher_encrypt(drbg->ctr_req);
@@ -1761,14 +1775,19 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg, 
				break;

			}

		default:

			return ret;

			goto out;

		}

		init_completion(&drbg->ctr_completion);



		memcpy(outbuf, drbg->outscratchpad, cryptlen);



		outlen -= cryptlen;

	}

	ret = 0;



	return 0;

out:

	memzero_explicit(drbg->outscratchpad, DRBG_OUTSCRATCHLEN);

	return ret;

}

#endif /* CONFIG_CRYPTO_DRBG_CTR */

include/crypto/drbg.h

+2 −0
Original line number Diff line number Diff line
@@ -124,6 +124,8 @@ struct drbg_state { 
	struct skcipher_request *ctr_req;	/* CTR mode request handle */

	__u8 *ctr_null_value_buf;		/* CTR mode unaligned buffer */

	__u8 *ctr_null_value;			/* CTR mode aligned zero buf */

	__u8 *outscratchpadbuf;			/* CTR mode output scratchpad */

        __u8 *outscratchpad;			/* CTR mode aligned outbuf */

	struct completion ctr_completion;	/* CTR mode async handler */

	int ctr_async_err;			/* CTR mode async error */

CRA Git | Maintained and supported by SUSTech CRA and CCSE