From patchwork Tue Jan 12 03:05:42 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thara Gopinath X-Patchwork-Id: 361142 Delivered-To: patch@linaro.org Received: by 2002:a02:85a7:0:0:0:0:0 with SMTP id d36csp3400195jai; Mon, 11 Jan 2021 19:07:29 -0800 (PST) X-Google-Smtp-Source: ABdhPJygB5OTiTfRA/aMzKwIE8rYRAj6RCNDnpTuDrqknw7cuiESQhXOcox/J6r1FlBUdaOn67A6 X-Received: by 2002:a17:906:2b1a:: with SMTP id a26mr1635466ejg.23.1610420849443; Mon, 11 Jan 2021 19:07:29 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1610420849; cv=none; d=google.com; s=arc-20160816; b=A2lVNhCsplnkHkp3JUQaFeOvSFe0u9i36clhMsXhgeUZJjKI1KyMeOiO9DqgUqcWzj MatvroZyqqbJ6ppkHcINeKkja7/Hojv0ZE5BWjzC83xFFAf6PqpzaC+Dtm906aVpZ+cT MeSv2MuwKZ2uX17/5T1ymxKIwGh81tDu7lQgPDtHOAZnzJf7XydK/XHV4C1whQ3c0HfI kgQG8Dqj5aP7SAOYdRJFupna+UYVva0TauFQFRgeuDwSimtQabMfjSfAYB+ko1816zhU STrdyIP/Q3FRB9FxP5JTh1Ceyne6eGvGdLwb+etW/1CMvB1CWi8y//1OCzdi7rFZ4QiR HFsQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=bZGjT91YJf1hHkSmJvXhKwaeMO0DjPBWpAMf7imhySA=; b=JQttmvzSemINBzK82RQLSkLPfGb9ysPM4DeF5/qLKUErbHZLiUM1+plRxiyE9Gj9og OQ6qxV7Phr+iqXMy1YglP+21tpiV8ge4x2TneOnaNwLhEigxYZK1zIIk146C3KrOUdGu wY2K5qJGCdlUjzbcwr0t2S726JrOVEUPgGdXFqX/xhMhyQCP6vC+yfyM+9Hk9s6w+j/I SZHXycnnAgXT0wOhIXd0dtzlFy8rIyDr4c7Aqx0zdI8gLgCvM0i2HAMckoAPr8bj4H4u wwMu1JwSIPWxqXe7Cfa9XNqPNPg0JPLS5d7k+9PplwUcwiZO40MxKza42FcPXlLtXVNA BIzw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=cPwO6Vqi; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id g3si542697ejf.612.2021.01.11.19.07.29; Mon, 11 Jan 2021 19:07:29 -0800 (PST) Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=cPwO6Vqi; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387531AbhALDHI (ORCPT + 2 others); Mon, 11 Jan 2021 22:07:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59564 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733089AbhALDHI (ORCPT ); Mon, 11 Jan 2021 22:07:08 -0500 Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 989B4C0617A3 for ; Mon, 11 Jan 2021 19:05:50 -0800 (PST) Received: by mail-qt1-x82e.google.com with SMTP id y15so744910qtv.5 for ; Mon, 11 Jan 2021 19:05:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=bZGjT91YJf1hHkSmJvXhKwaeMO0DjPBWpAMf7imhySA=; b=cPwO6Vqi8bJ6ngi3tQNcS7FR/RoeqKI0ckxNhL6vozsRBSr05BYbxgzRECpFY+Q7Ha H0uTRrE6fKzoowoOYaxkpzIeq9SljyaNIupkV1UD52Pi1nkDsMcfHMki8MU+j3kv1iFj RbMpplbw8kpWFtsHEjzb7xDPOK52OTJed5gIa8GkaQdmGj0h+Q8enu0SY6u3f+mHR8Fc ygSN4Ahl3Fssor7OkLo8NoAVWyY/eeRz5UOBHBHoI4bBOwAkwC7oP0eTA/z9xiFuK6lT ZXVF2zXyBkP99gqFOS37J2Ub8qcJXAHAYdLajHxbsisMcwUaCU7ruoAwlun2J1J352SW TiBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=bZGjT91YJf1hHkSmJvXhKwaeMO0DjPBWpAMf7imhySA=; b=A76HUutj9Fuf0lC4IxDV5619/GbWUy05N/Iba+Oull32bpRB00ECjgCBC+7ofZKSAT XzEanazPO0lV0YFYYJuMahbJ8QaIU9n9RELOTyasjGnRAzCV9jbSQ0/BhvhIEHIGCY0/ isGsPsr6laC4mjIZ2TmKRqusKZc3/1NRcf2uKpniTKBIWKy2q+vQLeG/jZIHXzNQ38o3 zigTDn0rpZ2AJm87Xkc0gu0ySg+BhSDyCYCw3nqbpPHTXEY6f2iLAE9wBGZ9rLYZu6g4 EEp24WPAv9l+B4C3ZlomHx2OZWI0fw+OaAv9UQcfj6zbROFdNU/k42NHyjKpvGFN0REM b41g== X-Gm-Message-State: AOAM530Yvn1cKA6IgKVeM9X4OSzcWsZ1fQlsitIzYCfz45+PT7K1ujKN Q6b4FDXyjMIKlvjJbKsItsN4Kg== X-Received: by 2002:ac8:6bc6:: with SMTP id b6mr2626921qtt.232.1610420749843; Mon, 11 Jan 2021 19:05:49 -0800 (PST) Received: from pop-os.fios-router.home (pool-71-163-245-5.washdc.fios.verizon.net. [71.163.245.5]) by smtp.googlemail.com with ESMTPSA id c7sm814235qkm.99.2021.01.11.19.05.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 Jan 2021 19:05:49 -0800 (PST) From: Thara Gopinath To: herbert@gondor.apana.org.au, davem@davemloft.net, bjorn.andersson@linaro.org Cc: ebiggers@google.com, ardb@kernel.org, sivaprak@codeaurora.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 3/6] drivers: crypto: qce: skcipher: Fix regressions found during fuzz testing Date: Mon, 11 Jan 2021 22:05:42 -0500 Message-Id: <20210112030545.669480-4-thara.gopinath@linaro.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210112030545.669480-1-thara.gopinath@linaro.org> References: <20210112030545.669480-1-thara.gopinath@linaro.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org This patch contains the following fixes for the supported encryption algorithms in the Qualcomm crypto engine(CE) 1. Return unsupported if key1 = key2 for AES XTS algorithm since CE does not support this and the operation causes the engine to hang. 2. Return unsupprted if any three keys are same for DES3 algorithms since CE does not support this and the operation causes the engine to hang. 3. Return unsupported for 0 length plain texts since crypto engine BAM dma does not support 0 length data. 4. ECB messages do not have an IV and hence set the ivsize to 0. 5. Ensure that the data passed for ECB/CBC encryption/decryption is blocksize aligned. Otherwise the CE hangs on the operation. 6. Allow messages of length less that 512 bytes for all other encryption algorithms other than AES XTS. The recommendation is only for AES XTS to have data size greater than 512 bytes. Signed-off-by: Thara Gopinath --- drivers/crypto/qce/skcipher.c | 68 ++++++++++++++++++++++++++++++----- 1 file changed, 60 insertions(+), 8 deletions(-) -- 2.25.1 diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c index a2d3da0ad95f..936bfb7c769b 100644 --- a/drivers/crypto/qce/skcipher.c +++ b/drivers/crypto/qce/skcipher.c @@ -167,16 +167,32 @@ static int qce_skcipher_setkey(struct crypto_skcipher *ablk, const u8 *key, struct crypto_tfm *tfm = crypto_skcipher_tfm(ablk); struct qce_cipher_ctx *ctx = crypto_tfm_ctx(tfm); unsigned long flags = to_cipher_tmpl(ablk)->alg_flags; + unsigned int __keylen; int ret; if (!key || !keylen) return -EINVAL; - switch (IS_XTS(flags) ? keylen >> 1 : keylen) { + /* + * AES XTS key1 = key2 not supported by crypto engine. + * Revisit to request a fallback cipher in this case. + */ + if (IS_XTS(flags)) { + __keylen = keylen >> 1; + if (!memcmp(key, key + __keylen, __keylen)) + return -EINVAL; + } else { + __keylen = keylen; + } + switch (__keylen) { case AES_KEYSIZE_128: case AES_KEYSIZE_256: memcpy(ctx->enc_key, key, keylen); break; + case AES_KEYSIZE_192: + break; + default: + return -EINVAL; } ret = crypto_skcipher_setkey(ctx->fallback, key, keylen); @@ -204,12 +220,27 @@ static int qce_des3_setkey(struct crypto_skcipher *ablk, const u8 *key, unsigned int keylen) { struct qce_cipher_ctx *ctx = crypto_skcipher_ctx(ablk); + u32 _key[6]; int err; err = verify_skcipher_des3_key(ablk, key); if (err) return err; + /* + * The crypto engine does not support any two keys + * being the same for triple des algorithms. The + * verify_skcipher_des3_key does not check for all the + * below conditions. Return -ENOKEY in case any two keys + * are the same. Revisit to see if a fallback cipher + * is needed to handle this condition. + */ + memcpy(_key, key, DES3_EDE_KEY_SIZE); + if (!((_key[0] ^ _key[2]) | (_key[1] ^ _key[3])) || + !((_key[2] ^ _key[4]) | (_key[3] ^ _key[5])) || + !((_key[0] ^ _key[4]) | (_key[1] ^ _key[5]))) + return -ENOKEY; + ctx->enc_keylen = keylen; memcpy(ctx->enc_key, key, keylen); return 0; @@ -221,6 +252,7 @@ static int qce_skcipher_crypt(struct skcipher_request *req, int encrypt) struct qce_cipher_ctx *ctx = crypto_skcipher_ctx(tfm); struct qce_cipher_reqctx *rctx = skcipher_request_ctx(req); struct qce_alg_template *tmpl = to_cipher_tmpl(tfm); + unsigned int blocksize = crypto_skcipher_blocksize(tfm); int keylen; int ret; @@ -228,14 +260,34 @@ static int qce_skcipher_crypt(struct skcipher_request *req, int encrypt) rctx->flags |= encrypt ? QCE_ENCRYPT : QCE_DECRYPT; keylen = IS_XTS(rctx->flags) ? ctx->enc_keylen >> 1 : ctx->enc_keylen; - /* qce is hanging when AES-XTS request len > QCE_SECTOR_SIZE and - * is not a multiple of it; pass such requests to the fallback + /* CE does not handle 0 length messages */ + if (!req->cryptlen) + return -EINVAL; + + /* + * ECB and CBC algorithms require message lengths to be + * multiples of block size. + * TODO: The spec says AES CBC mode for certain versions + * of crypto engine can handle partial blocks as well. + * Test and enable such messages. + */ + if (IS_ECB(rctx->flags) || IS_CBC(rctx->flags)) + if (!IS_ALIGNED(req->cryptlen, blocksize)) + return -EINVAL; + + /* + * Conditions for requesting a fallback cipher + * AES-192 (not supported by crypto engine (CE)) + * AES-XTS request with len <= 512 byte (not recommended to use CE) + * AES-XTS request with len > QCE_SECTOR_SIZE and + * is not a multiple of it.(Revisit this condition to check if it is + * needed in all versions of CE) */ if (IS_AES(rctx->flags) && - (((keylen != AES_KEYSIZE_128 && keylen != AES_KEYSIZE_256) || - req->cryptlen <= aes_sw_max_len) || - (IS_XTS(rctx->flags) && req->cryptlen > QCE_SECTOR_SIZE && - req->cryptlen % QCE_SECTOR_SIZE))) { + ((keylen != AES_KEYSIZE_128 && keylen != AES_KEYSIZE_256) || + (IS_XTS(rctx->flags) && ((req->cryptlen <= aes_sw_max_len) || + (req->cryptlen > QCE_SECTOR_SIZE && + req->cryptlen % QCE_SECTOR_SIZE))))) { skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); skcipher_request_set_callback(&rctx->fallback_req, req->base.flags, @@ -307,7 +359,7 @@ static const struct qce_skcipher_def skcipher_def[] = { .name = "ecb(aes)", .drv_name = "ecb-aes-qce", .blocksize = AES_BLOCK_SIZE, - .ivsize = AES_BLOCK_SIZE, + .ivsize = 0, .min_keysize = AES_MIN_KEY_SIZE, .max_keysize = AES_MAX_KEY_SIZE, },