[PATCH] crypto: morus640 - Fix out-of-bounds access

[Ondrej Mosnacek]

We must load the block from the temporary variable here, not directly
from the input.

Also add forgotten zeroing-out of the uninitialized part of the
temporary block (as is done correctly in morus1280.c).

Fixes: 396be41f16fd ("crypto: morus - Add generic MORUS AEAD implementations")
Reported-by: syzbot+1fafa9c4cf42df33f...@syzkaller.appspotmail.com
Reported-by: syzbot+d82643ba80bf6937c...@syzkaller.appspotmail.com
Signed-off-by: Ondrej Mosnacek 
---
 crypto/morus640.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crypto/morus640.c b/crypto/morus640.c
index 9fbcde307daf..5eede3749e64 100644
--- a/crypto/morus640.c
+++ b/crypto/morus640.c
@@ -274,8 +274,9 @@ static void crypto_morus640_decrypt_chunk(struct 
morus640_state *state, u8 *dst,
union morus640_block_in tail;
 
memcpy(tail.bytes, src, size);
+   memset(tail.bytes + size, 0, MORUS640_BLOCK_SIZE - size);
 
-   crypto_morus640_load_a(&m, src);
+   crypto_morus640_load_a(&m, tail.bytes);
crypto_morus640_core(state, &m);
crypto_morus640_store_a(tail.bytes, &m);
memset(tail.bytes + size, 0, MORUS640_BLOCK_SIZE - size);
-- 
2.17.1

Re: [PATCH V3 1/2] evm: Don't deadlock if a crypto algorithm is unavailable

[Mimi Zohar]

On Wed, 2018-06-13 at 14:33 +0800, Herbert Xu wrote:
> On Fri, Jun 08, 2018 at 02:57:42PM -0700, Matthew Garrett wrote:
> > When EVM attempts to appraise a file signed with a crypto algorithm the
> > kernel doesn't have support for, it will cause the kernel to trigger a
> > module load. If the EVM policy includes appraisal of kernel modules this
> > will in turn call back into EVM - since EVM is holding a lock until the
> > crypto initialisation is complete, this triggers a deadlock. Add a
> > CRYPTO_NOLOAD flag and skip module loading if it's set, and add that flag
> > in the EVM case in order to fail gracefully with an error message
> > instead of deadlocking.
> > 
> > Signed-off-by: Matthew Garrett 
> 
> Acked-by: Herbert Xu 

Thanks!  This patch and "evm: Allow non-SHA1 digital signatures" are
now queued in the next-integrity-queued branch.

Mimi

[PATCH] crypto: atmel-ecc - fix to allow multi segment scatterlists

[Tudor Ambarus]

Remove the limitation of single element scatterlists. ECDH with
multi-element scatterlists is needed by TPM.

Similar to 'commit 95ec01ba1ef0 ("crypto: ecdh - fix to allow multi
segment scatterlists")'.

Signed-off-by: Tudor Ambarus 
---
 drivers/crypto/atmel-ecc.c | 31 ++-
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/drivers/crypto/atmel-ecc.c b/drivers/crypto/atmel-ecc.c
index e66f18a0..a25772e 100644
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -186,7 +186,10 @@ static int atmel_ecc_init_ecdh_cmd(struct atmel_ecc_cmd 
*cmd,
 * always be the same. Use a macro for the key size to avoid unnecessary
 * computations.
 */
-   copied = sg_copy_to_buffer(pubkey, 1, cmd->data, ATMEL_ECC_PUBKEY_SIZE);
+   copied = sg_copy_to_buffer(pubkey,
+  sg_nents_for_len(pubkey,
+   ATMEL_ECC_PUBKEY_SIZE),
+  cmd->data, ATMEL_ECC_PUBKEY_SIZE);
if (copied != ATMEL_ECC_PUBKEY_SIZE)
return -EINVAL;
 
@@ -268,15 +271,17 @@ static void atmel_ecdh_done(struct atmel_ecc_work_data 
*work_data, void *areq,
struct kpp_request *req = areq;
struct atmel_ecdh_ctx *ctx = work_data->ctx;
struct atmel_ecc_cmd *cmd = &work_data->cmd;
-   size_t copied;
-   size_t n_sz = ctx->n_sz;
+   size_t copied, n_sz;
 
if (status)
goto free_work_data;
 
+   /* might want less than we've got */
+   n_sz = min_t(size_t, ctx->n_sz, req->dst_len);
+
/* copy the shared secret */
-   copied = sg_copy_from_buffer(req->dst, 1, &cmd->data[RSP_DATA_IDX],
-n_sz);
+   copied = sg_copy_from_buffer(req->dst, sg_nents_for_len(req->dst, n_sz),
+&cmd->data[RSP_DATA_IDX], n_sz);
if (copied != n_sz)
status = -EINVAL;
 
@@ -440,7 +445,7 @@ static int atmel_ecdh_generate_public_key(struct 
kpp_request *req)
 {
struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
struct atmel_ecdh_ctx *ctx = kpp_tfm_ctx(tfm);
-   size_t copied;
+   size_t copied, nbytes;
int ret = 0;
 
if (ctx->do_fallback) {
@@ -448,10 +453,14 @@ static int atmel_ecdh_generate_public_key(struct 
kpp_request *req)
return crypto_kpp_generate_public_key(req);
}
 
+   /* might want less than we've got */
+   nbytes = min_t(size_t, ATMEL_ECC_PUBKEY_SIZE, req->dst_len);
+
/* public key was saved at private key generation */
-   copied = sg_copy_from_buffer(req->dst, 1, ctx->public_key,
-ATMEL_ECC_PUBKEY_SIZE);
-   if (copied != ATMEL_ECC_PUBKEY_SIZE)
+   copied = sg_copy_from_buffer(req->dst,
+sg_nents_for_len(req->dst, nbytes),
+ctx->public_key, nbytes);
+   if (copied != nbytes)
ret = -EINVAL;
 
return ret;
@@ -470,6 +479,10 @@ static int atmel_ecdh_compute_shared_secret(struct 
kpp_request *req)
return crypto_kpp_compute_shared_secret(req);
}
 
+   /* must have exactly two points to be on the curve */
+   if (req->src_len != ATMEL_ECC_PUBKEY_SIZE)
+   return -EINVAL;
+
gfp = (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ? GFP_KERNEL :
 GFP_ATOMIC;
 
-- 
2.9.4

[PATCH] crypto: atmel-ecc - remove overly verbose dev_info

[Tudor Ambarus]

Remove it because when using a slow console, it can affect
the speed of crypto operations.

Similar to 'commit 730f23b66095 ("crypto: vmx - Remove overly
verbose printk from AES XTS init")'.

Signed-off-by: Tudor Ambarus 
---
 drivers/crypto/atmel-ecc.c | 4 
 1 file changed, 4 deletions(-)

diff --git a/drivers/crypto/atmel-ecc.c b/drivers/crypto/atmel-ecc.c
index a25772e..74f083f 100644
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -567,10 +567,6 @@ static int atmel_ecdh_init_tfm(struct crypto_kpp *tfm)
}
 
crypto_kpp_set_flags(fallback, crypto_kpp_get_flags(tfm));
-
-   dev_info(&ctx->client->dev, "Using '%s' as fallback implementation.\n",
-crypto_tfm_alg_driver_name(crypto_kpp_tfm(fallback)));
-
ctx->fallback = fallback;
 
return 0;
-- 
2.9.4