Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 55f058e7 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 

Pull crypto fixes from Herbert Xu:
 "This fixes the following issues:

   - Incorrect output buffer size calculation in rsa-pkcs1pad

   - Uninitialised padding bytes on exported state in ccp driver

   - Potentially freed pointer used on completion callback in sha1-mb"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: ccp - Prevent information leakage on export
  crypto: sha1-mb - use corrcet pointer while completing jobs
  crypto: rsa-pkcs1pad - fix dst len
parents 9a0e3eea f709b45e

arch/x86/crypto/sha-mb/sha1_mb.c

+2 −2
Original line number Diff line number Diff line
@@ -453,10 +453,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx, 


			req = cast_mcryptd_ctx_to_req(req_ctx);

			if (irqs_disabled())

				rctx->complete(&req->base, ret);

				req_ctx->complete(&req->base, ret);

			else {

				local_bh_disable();

				rctx->complete(&req->base, ret);

				req_ctx->complete(&req->base, ret);

				local_bh_enable();

			}

		}

crypto/rsa-pkcs1pad.c

+6 −6
Original line number Diff line number Diff line
@@ -387,16 +387,16 @@ static int pkcs1pad_decrypt(struct akcipher_request *req) 
	req_ctx->child_req.src = req->src;

	req_ctx->child_req.src_len = req->src_len;

	req_ctx->child_req.dst = req_ctx->out_sg;

	req_ctx->child_req.dst_len = ctx->key_size - 1;

	req_ctx->child_req.dst_len = ctx->key_size ;



	req_ctx->out_buf = kmalloc(ctx->key_size - 1,

	req_ctx->out_buf = kmalloc(ctx->key_size,

			(req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ?

			GFP_KERNEL : GFP_ATOMIC);

	if (!req_ctx->out_buf)

		return -ENOMEM;



	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,

			ctx->key_size - 1, NULL);

			    ctx->key_size, NULL);



	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);

	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
@@ -595,16 +595,16 @@ static int pkcs1pad_verify(struct akcipher_request *req) 
	req_ctx->child_req.src = req->src;

	req_ctx->child_req.src_len = req->src_len;

	req_ctx->child_req.dst = req_ctx->out_sg;

	req_ctx->child_req.dst_len = ctx->key_size - 1;

	req_ctx->child_req.dst_len = ctx->key_size;



	req_ctx->out_buf = kmalloc(ctx->key_size - 1,

	req_ctx->out_buf = kmalloc(ctx->key_size,

			(req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ?

			GFP_KERNEL : GFP_ATOMIC);

	if (!req_ctx->out_buf)

		return -ENOMEM;



	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,

			ctx->key_size - 1, NULL);

			    ctx->key_size, NULL);



	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);

	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,

drivers/crypto/ccp/ccp-crypto-aes-cmac.c

+3 −0
Original line number Diff line number Diff line
@@ -225,6 +225,9 @@ static int ccp_aes_cmac_export(struct ahash_request *req, void *out) 
	struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req);

	struct ccp_aes_cmac_exp_ctx state;



	/* Don't let anything leak to 'out' */

	memset(&state, 0, sizeof(state));



	state.null_msg = rctx->null_msg;

	memcpy(state.iv, rctx->iv, sizeof(state.iv));

	state.buf_count = rctx->buf_count;

drivers/crypto/ccp/ccp-crypto-sha.c

+3 −0
Original line number Diff line number Diff line
@@ -212,6 +212,9 @@ static int ccp_sha_export(struct ahash_request *req, void *out) 
	struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req);

	struct ccp_sha_exp_ctx state;



	/* Don't let anything leak to 'out' */

	memset(&state, 0, sizeof(state));



	state.type = rctx->type;

	state.msg_bits = rctx->msg_bits;

	state.first = rctx->first;