From patchwork Wed Jul 24 19:19:52 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 169643 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp10668927ilk; Wed, 24 Jul 2019 12:54:50 -0700 (PDT) X-Google-Smtp-Source: APXvYqzVgwj0RDx8fwG3slPgW4P6NQ19HbIf4XYHr33BmfoGuWIh7eWWsscviV11AA7T0sj0UVUT X-Received: by 2002:a17:902:5ac4:: with SMTP id g4mr89405800plm.80.1563998090017; Wed, 24 Jul 2019 12:54:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563998090; cv=none; d=google.com; s=arc-20160816; b=d2tDxWBSiGhqyrI1A+r/piZIMRHL+7XDMYgpm7w/an7QKXHx1T/lc/8ko8nC7aPvfD eBWgge60OFuFuzasqZx9CGc2hG5JVDu6qRCHbfzogQdHjKFHu3+wKfZI9AweKq5jpMh0 X3HGedUSB2SIF525tLA1PvXAjhrZkub8n3ZA53dav1ugV3QotdQOYUWX3sEOskaiuvzC sNUeXfv7ecriaiIkf0+jW2WDa2R7X46UNFyB8KSBYYsiDJSdZPMWL7GBqzxpAmE92BFB 32ojQm9gVw4+mrZoU9veLTZckHB2i0OlcFVWBa6xqAUwkhy7ZtWKDlGYUDzmYfdrYRVd isZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=d4IleqVCMpD24qc4AjeXmpiov2Xz5NbR6H+dsC0FKIY=; b=wlI7teyC2rzHZx/6tQbmxgqL4JMmuqcOhFdkzUoeVKtUAU8KdrzDpfvGclmcnbpCKg Q8/hfMAj7BVVk2VwYFilUN6Kx2dQT0HCECqvK2Z94zhWADjt1roXgsbYafw4GEftK6mH c7DaOCyHqlSIZiTbvAI6ks3M2GuvUH4k+DvIDY/zPx1pX3DorzCxW76XrBZdek5LZh9+ v26WtyrJ4rFwLmrIBFT0jEyHp0RaSIjvsiqk7W5rAPf7dkOSEj5EECyefo7wUZBfymdW b7N0Kz0QhBBW7zeCRawnxuhxuCM9CYLYmyVx8hxxaRC4qGs99aQiP93+HPcdGLN4s7he KQTQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=1h5fMK45; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 65si9214942pgj.19.2019.07.24.12.54.49; Wed, 24 Jul 2019 12:54:50 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=1h5fMK45; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2404442AbfGXTys (ORCPT + 29 others); Wed, 24 Jul 2019 15:54:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:37972 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2404020AbfGXTyq (ORCPT ); Wed, 24 Jul 2019 15:54:46 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E204322BEB; Wed, 24 Jul 2019 19:54:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1563998085; bh=PHgtucqGihDJ5d34ZJmWIWSwxfyLfx7UyvkpviJT8xk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1h5fMK45epHgk0AsWpR1DeC6US1W85DRparrCM7+RiUjWAN/VK+5sXdJbzD2H8ALd TL5qclCfQNmLpCzVVWWUIjq0jPPJho/Xisq7scGId5/LP4ygJM/wlKPOowjWfDWgRZ UaZGd++lhQDACvVBYqCkMr+A4ntj4a2vZNdoaSF0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Horia Geanta , Iuliana Prodan , Sascha Hauer , Ard Biesheuvel , Herbert Xu Subject: [PATCH 5.1 240/371] crypto: caam - limit output IV to CBC to work around CTR mode DMA issue Date: Wed, 24 Jul 2019 21:19:52 +0200 Message-Id: <20190724191742.711810766@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190724191724.382593077@linuxfoundation.org> References: <20190724191724.382593077@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ard Biesheuvel commit ed527b13d800dd515a9e6c582f0a73eca65b2e1b upstream. The CAAM driver currently violates an undocumented and slightly controversial requirement imposed by the crypto stack that a buffer referred to by the request structure via its virtual address may not be modified while any scatterlists passed via the same request structure are mapped for inbound DMA. This may result in errors like alg: aead: decryption failed on test 1 for gcm_base(ctr-aes-caam,ghash-generic): ret=74 alg: aead: Failed to load transform for gcm(aes): -2 on non-cache coherent systems, due to the fact that the GCM driver passes an IV buffer by virtual address which shares a cacheline with the auth_tag buffer passed via a scatterlist, resulting in corruption of the auth_tag when the IV is updated while the DMA mapping is live. Since the IV that is returned to the caller is only valid for CBC mode, and given that the in-kernel users of CBC (such as CTS) don't trigger the same issue as the GCM driver, let's just disable the output IV generation for all modes except CBC for the time being. Fixes: 854b06f76879 ("crypto: caam - properly set IV after {en,de}crypt") Cc: Horia Geanta Cc: Iuliana Prodan Reported-by: Sascha Hauer Cc: Signed-off-by: Ard Biesheuvel Reviewed-by: Horia Geanta Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/caam/caamalg.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/drivers/crypto/caam/caamalg.c +++ b/drivers/crypto/caam/caamalg.c @@ -965,6 +965,7 @@ static void skcipher_encrypt_done(struct struct skcipher_request *req = context; struct skcipher_edesc *edesc; struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); + struct caam_ctx *ctx = crypto_skcipher_ctx(skcipher); int ivsize = crypto_skcipher_ivsize(skcipher); #ifdef DEBUG @@ -989,9 +990,9 @@ static void skcipher_encrypt_done(struct /* * The crypto API expects us to set the IV (req->iv) to the last - * ciphertext block. This is used e.g. by the CTS mode. + * ciphertext block when running in CBC mode. */ - if (ivsize) + if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC) scatterwalk_map_and_copy(req->iv, req->dst, req->cryptlen - ivsize, ivsize, 0); @@ -1809,9 +1810,9 @@ static int skcipher_decrypt(struct skcip /* * The crypto API expects us to set the IV (req->iv) to the last - * ciphertext block. + * ciphertext block when running in CBC mode. */ - if (ivsize) + if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC) scatterwalk_map_and_copy(req->iv, req->src, req->cryptlen - ivsize, ivsize, 0);