Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2ace4cc authored by Brahmaji K's avatar Brahmaji K
Browse files

crypto: msm: Fix several race condition issues in crypto drivers 



Check areq before referencing, replace xchg to automic_xchg and
verify return values of set key during SHA operations.

Change-Id: Ife01372ba4990bfefe52b82db4ab33ef76190944
Signed-off-by: default avatarBrahmaji K <bkomma@codeaurora.org>
parent f60cb016

drivers/crypto/msm/qce50.c

+13 −7
Original line number Diff line number Diff line
@@ -2168,6 +2168,10 @@ static int _sha_complete(struct qce_device *pce_dev, int req_info) 
	pce_sps_data = &preq_info->ce_sps;

	qce_callback = preq_info->qce_cb;

	areq = (struct ahash_request *) preq_info->areq;

	if (!areq) {

		pr_err("sha operation error. areq is NULL\n");

		return -ENXIO;

	}

	qce_dma_unmap_sg(pce_dev->pdev, areq->src, preq_info->src_nents,

				DMA_TO_DEVICE);

	memcpy(digest, (char *)(&pce_sps_data->result->auth_iv[0]),
@@ -2915,7 +2919,7 @@ static inline int qce_alloc_req_info(struct qce_device *pce_dev) 
		request_index++;

		if (request_index >= MAX_QCE_BAM_REQ)

			request_index = 0;

		if (xchg(&pce_dev->ce_request_info[request_index].

		if (atomic_xchg(&pce_dev->ce_request_info[request_index].

						in_use, true) == false) {

			pce_dev->ce_request_index = request_index;

			return request_index;
@@ -2931,7 +2935,8 @@ static inline void qce_free_req_info(struct qce_device *pce_dev, int req_info, 
		bool is_complete)

{

	pce_dev->ce_request_info[req_info].xfer_type = QCE_XFER_TYPE_LAST;

	if (xchg(&pce_dev->ce_request_info[req_info].in_use, false) == true) {

	if (atomic_xchg(&pce_dev->ce_request_info[req_info].in_use,

						false) == true) {

		if (req_info < MAX_QCE_BAM_REQ && is_complete)

			atomic_dec(&pce_dev->no_of_queued_req);

	} else
@@ -4555,7 +4560,7 @@ static int qce_dummy_req(struct qce_device *pce_dev) 
{

	int ret = 0;



	if (!(xchg(&pce_dev->ce_request_info[DUMMY_REQ_INDEX].

	if (!(atomic_xchg(&pce_dev->ce_request_info[DUMMY_REQ_INDEX].

				in_use, true) == false))

		return -EBUSY;

	ret = qce_process_sha_req(pce_dev, NULL);
@@ -5973,7 +5978,7 @@ void *qce_open(struct platform_device *pdev, int *rc) 
	}



	for (i = 0; i < MAX_QCE_ALLOC_BAM_REQ; i++)

		pce_dev->ce_request_info[i].in_use = false;

		atomic_set(&pce_dev->ce_request_info[i].in_use, false);

	pce_dev->ce_request_index = 0;



	pce_dev->memsize = 10 * PAGE_SIZE * MAX_QCE_ALLOC_BAM_REQ;
@@ -6137,12 +6142,13 @@ EXPORT_SYMBOL(qce_hw_support); 
void qce_dump_req(void *handle)

{

	int i;

	bool req_in_use;

	struct qce_device *pce_dev = (struct qce_device *)handle;



	for (i = 0; i < MAX_QCE_BAM_REQ; i++) {

		pr_info("qce_dump_req %d %d\n", i,

					pce_dev->ce_request_info[i].in_use);

		if (pce_dev->ce_request_info[i].in_use == true)

		req_in_use = atomic_read(&pce_dev->ce_request_info[i].in_use);

		pr_info("qce_dump_req %d %d\n", i, req_in_use);

		if (req_in_use == true)

			_qce_dump_descr_fifos(pce_dev, i);

	}

}

drivers/crypto/msm/qce50.h

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -214,7 +214,7 @@ struct ce_sps_data { 
};



struct ce_request_info {

	bool in_use;

	atomic_t in_use;

	bool in_prog;

	enum qce_xfer_type_enum	xfer_type;

	struct ce_sps_data ce_sps;

drivers/crypto/msm/qcrypto.c

+10 −4
Original line number Diff line number Diff line
@@ -4240,6 +4240,7 @@ static int _sha1_hmac_setkey(struct crypto_ahash *tfm, const u8 *key, 
							unsigned int len)

{

	struct qcrypto_sha_ctx *sha_ctx = crypto_tfm_ctx(&tfm->base);

	int ret = 0;

	memset(&sha_ctx->authkey[0], 0, SHA1_BLOCK_SIZE);

	if (len <= SHA1_BLOCK_SIZE) {

		memcpy(&sha_ctx->authkey[0], key, len);
@@ -4247,16 +4248,19 @@ static int _sha1_hmac_setkey(struct crypto_ahash *tfm, const u8 *key, 
	} else {

		sha_ctx->alg = QCE_HASH_SHA1;

		sha_ctx->diglen = SHA1_DIGEST_SIZE;

		_sha_hmac_setkey(tfm, key, len);

		ret = _sha_hmac_setkey(tfm, key, len);

		if (ret)

			pr_err("SHA1 hmac setkey failed\n");

		sha_ctx->authkey_in_len = SHA1_BLOCK_SIZE;

	}

	return 0;

	return ret;

}



static int _sha256_hmac_setkey(struct crypto_ahash *tfm, const u8 *key,

							unsigned int len)

{

	struct qcrypto_sha_ctx *sha_ctx = crypto_tfm_ctx(&tfm->base);

	int ret = 0;



	memset(&sha_ctx->authkey[0], 0, SHA256_BLOCK_SIZE);

	if (len <= SHA256_BLOCK_SIZE) {
@@ -4265,11 +4269,13 @@ static int _sha256_hmac_setkey(struct crypto_ahash *tfm, const u8 *key, 
	} else {

		sha_ctx->alg = QCE_HASH_SHA256;

		sha_ctx->diglen = SHA256_DIGEST_SIZE;

		_sha_hmac_setkey(tfm, key, len);

		ret = _sha_hmac_setkey(tfm, key, len);

		if (ret)

			pr_err("SHA256 hmac setkey failed\n");

		sha_ctx->authkey_in_len = SHA256_BLOCK_SIZE;

	}



	return 0;

	return ret;

}



static int _sha_hmac_init_ihash(struct ahash_request *req,