Commit 1edcf2e1 authored by Joy Latten's avatar Joy Latten Committed by Herbert Xu

[CRYPTO] xcbc: Fix crash when ipsec uses xcbc-mac with big data chunk

The kernel crashes when ipsec passes a udp packet of about 14XX bytes
of data to aes-xcbc-mac.

It seems the first xxxx bytes of the data are in first sg entry,
and remaining xx bytes are in next sg entry. But we don't 
check next sg entry to see if we need to go look the page up.

I noticed in hmac.c, we do a scatterwalk_sg_next(), to do this check
and possible lookup, thus xcbc.c needs to use this routine too.

A 15-hour run of an ipsec stress test sending streams of tcp and
udp packets of various sizes,  using this patch and 
aes-xcbc-mac completed successfully, so hopefully this fixes the
problem.
Signed-off-by: default avatarJoy Latten <latten@austin.ibm.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 0e81a8ae
...@@ -116,13 +116,11 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc, ...@@ -116,13 +116,11 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(parent); struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(parent);
struct crypto_cipher *tfm = ctx->child; struct crypto_cipher *tfm = ctx->child;
int bs = crypto_hash_blocksize(parent); int bs = crypto_hash_blocksize(parent);
unsigned int i = 0;
do { for (;;) {
struct page *pg = sg_page(sg);
struct page *pg = sg_page(&sg[i]); unsigned int offset = sg->offset;
unsigned int offset = sg[i].offset; unsigned int slen = sg->length;
unsigned int slen = sg[i].length;
if (unlikely(slen > nbytes)) if (unlikely(slen > nbytes))
slen = nbytes; slen = nbytes;
...@@ -182,8 +180,11 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc, ...@@ -182,8 +180,11 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
offset = 0; offset = 0;
pg++; pg++;
} }
i++;
} while (nbytes>0); if (!nbytes)
break;
sg = scatterwalk_sg_next(sg);
}
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment