summaryrefslogtreecommitdiff
path: root/crypto
diff options
context:
space:
mode:
authorRomain Izard <romain.izard.pro@gmail.com>2017-10-31 17:42:35 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-11-15 17:53:18 +0300
commit58ed8a47e450310a673c20a10153d0c5cddfaa08 (patch)
tree7feb759e84d3621de1e040102cfc9e3fef21d9a6 /crypto
parent46f15501c5b7debd6aa952de754f13de17fadb8b (diff)
downloadlinux-58ed8a47e450310a673c20a10153d0c5cddfaa08.tar.xz
crypto: ccm - preserve the IV buffer
commit 441f99c90497e15aa3ad1dbabd56187e29614348 upstream. The IV buffer used during CCM operations is used twice, during both the hashing step and the ciphering step. When using a hardware accelerator that updates the contents of the IV buffer at the end of ciphering operations, the value will be modified. In the decryption case, the subsequent setup of the hashing algorithm will interpret the updated IV instead of the original value, which can lead to out-of-bounds writes. Reuse the idata buffer, only used in the hashing step, to preserve the IV's value during the ciphering step in the decryption case. Signed-off-by: Romain Izard <romain.izard.pro@gmail.com> Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'crypto')
-rw-r--r--crypto/ccm.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/crypto/ccm.c b/crypto/ccm.c
index 006d8575ef5c..b3ace633fae9 100644
--- a/crypto/ccm.c
+++ b/crypto/ccm.c
@@ -413,7 +413,7 @@ static int crypto_ccm_decrypt(struct aead_request *req)
unsigned int cryptlen = req->cryptlen;
u8 *authtag = pctx->auth_tag;
u8 *odata = pctx->odata;
- u8 *iv = req->iv;
+ u8 *iv = pctx->idata;
int err;
cryptlen -= authsize;
@@ -429,6 +429,8 @@ static int crypto_ccm_decrypt(struct aead_request *req)
if (req->src != req->dst)
dst = pctx->dst;
+ memcpy(iv, req->iv, 16);
+
skcipher_request_set_tfm(skreq, ctx->ctr);
skcipher_request_set_callback(skreq, pctx->flags,
crypto_ccm_decrypt_done, req);