Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2dd3f7c9 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 

Pull crypto fixes from Herbert Xu:

 - Fix use after free in chtls

 - Fix RBP breakage in sha3

 - Fix use after free in hwrng_unregister

 - Fix overread in morus640

 - Move sleep out of kernel_neon in arm64/aes-blk

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  hwrng: core - Always drop the RNG in hwrng_unregister()
  crypto: morus640 - Fix out-of-bounds access
  crypto: don't optimize keccakf()
  crypto: arm64/aes-blk - fix and move skcipher_walk_done out of kernel_neon_begin, _end
  crypto: chtls - use after free in chtls_pt_recvmsg()
parents b13fbe77 837bf7cc

arch/arm64/crypto/aes-glue.c

+1 −1
Original line number Diff line number Diff line
@@ -223,8 +223,8 @@ static int ctr_encrypt(struct skcipher_request *req) 
		kernel_neon_begin();

		aes_ctr_encrypt(walk.dst.virt.addr, walk.src.virt.addr,

				(u8 *)ctx->key_enc, rounds, blocks, walk.iv);

		err = skcipher_walk_done(&walk, walk.nbytes % AES_BLOCK_SIZE);

		kernel_neon_end();

		err = skcipher_walk_done(&walk, walk.nbytes % AES_BLOCK_SIZE);

	}

	if (walk.nbytes) {

		u8 __aligned(8) tail[AES_BLOCK_SIZE];

crypto/morus640.c

+2 −1
Original line number Diff line number Diff line
@@ -274,8 +274,9 @@ static void crypto_morus640_decrypt_chunk(struct morus640_state *state, u8 *dst, 
		union morus640_block_in tail;



		memcpy(tail.bytes, src, size);

		memset(tail.bytes + size, 0, MORUS640_BLOCK_SIZE - size);



		crypto_morus640_load_a(&m, src);

		crypto_morus640_load_a(&m, tail.bytes);

		crypto_morus640_core(state, &m);

		crypto_morus640_store_a(tail.bytes, &m);

		memset(tail.bytes + size, 0, MORUS640_BLOCK_SIZE - size);

crypto/sha3_generic.c

+1 −1
Original line number Diff line number Diff line
@@ -152,7 +152,7 @@ static SHA3_INLINE void keccakf_round(u64 st[25]) 
	st[24] ^= bc[ 4];

}



static void __optimize("O3") keccakf(u64 st[25])

static void keccakf(u64 st[25])

{

	int round;

drivers/char/hw_random/core.c

+9 −2
Original line number Diff line number Diff line
@@ -516,11 +516,18 @@ EXPORT_SYMBOL_GPL(hwrng_register); 


void hwrng_unregister(struct hwrng *rng)

{

	int err;



	mutex_lock(&rng_mutex);



	list_del(&rng->list);

	if (current_rng == rng)

		enable_best_rng();

	if (current_rng == rng) {

		err = enable_best_rng();

		if (err) {

			drop_current_rng();

			cur_rng_set_by_user = 0;

		}

	}



	if (list_empty(&rng_list)) {

		mutex_unlock(&rng_mutex);

drivers/crypto/chelsio/chtls/chtls_io.c

+2 −3
Original line number Diff line number Diff line
@@ -1548,15 +1548,14 @@ static int chtls_pt_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, 
			tp->urg_data = 0;



		if ((avail + offset) >= skb->len) {

			if (likely(skb))

				chtls_free_skb(sk, skb);

			buffers_freed++;

			if (ULP_SKB_CB(skb)->flags & ULPCB_FLAG_TLS_HDR) {

				tp->copied_seq += skb->len;

				hws->rcvpld = skb->hdr_len;

			} else {

				tp->copied_seq += hws->rcvpld;

			}

			chtls_free_skb(sk, skb);

			buffers_freed++;

			hws->copied_seq = 0;

			if (copied >= target &&

			    !skb_peek(&sk->sk_receive_queue))