Skip to content

L
linux
Commit 2731a944 authored by Herbert Xu's avatar Herbert Xu
Browse files
Options

f2fs: Use skcipher 

This patch replaces uses of ablkcipher with skcipher.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 3f32a5be
Hide whitespace changes
Inline Side-by-side
Showing with 45 additions and 53 deletions
fs/f2fs/crypto.c
View file @ 2731a944
...@@ -23,11 +23,9 @@ ...@@ -23,11 +23,9 @@
* The usage of AES-XTS should conform to recommendations in NIST * The usage of AES-XTS should conform to recommendations in NIST
* Special Publication 800-38E and IEEE P1619/D16. * Special Publication 800-38E and IEEE P1619/D16.
*/ */
#include <crypto/hash.h> #include <crypto/skcipher.h>
#include <crypto/sha.h>
#include <keys/user-type.h> #include <keys/user-type.h>
#include <keys/encrypted-type.h> #include <keys/encrypted-type.h>
#include <linux/crypto.h>
#include <linux/ecryptfs.h> #include <linux/ecryptfs.h>
#include <linux/gfp.h> #include <linux/gfp.h>
#include <linux/kernel.h> #include <linux/kernel.h>
...@@ -328,21 +326,21 @@ static int f2fs_page_crypto(struct f2fs_crypto_ctx *ctx, ...@@ -328,21 +326,21 @@ static int f2fs_page_crypto(struct f2fs_crypto_ctx *ctx,
struct page *dest_page) struct page *dest_page)
{ {
u8 xts_tweak[F2FS_XTS_TWEAK_SIZE]; u8 xts_tweak[F2FS_XTS_TWEAK_SIZE];
struct ablkcipher_request *req = NULL; struct skcipher_request *req = NULL;
DECLARE_F2FS_COMPLETION_RESULT(ecr); DECLARE_F2FS_COMPLETION_RESULT(ecr);
struct scatterlist dst, src; struct scatterlist dst, src;
struct f2fs_crypt_info *ci = F2FS_I(inode)->i_crypt_info; struct f2fs_crypt_info *ci = F2FS_I(inode)->i_crypt_info;
struct crypto_ablkcipher *tfm = ci->ci_ctfm; struct crypto_skcipher *tfm = ci->ci_ctfm;
int res = 0; int res = 0;
req = ablkcipher_request_alloc(tfm, GFP_NOFS); req = skcipher_request_alloc(tfm, GFP_NOFS);
if (!req) { if (!req) {
printk_ratelimited(KERN_ERR printk_ratelimited(KERN_ERR
"%s: crypto_request_alloc() failed\n", "%s: crypto_request_alloc() failed\n",
__func__); __func__);
return -ENOMEM; return -ENOMEM;
} }
ablkcipher_request_set_callback( skcipher_request_set_callback(
req, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, req, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
f2fs_crypt_complete, &ecr); f2fs_crypt_complete, &ecr);
...@@ -355,21 +353,21 @@ static int f2fs_page_crypto(struct f2fs_crypto_ctx *ctx, ...@@ -355,21 +353,21 @@ static int f2fs_page_crypto(struct f2fs_crypto_ctx *ctx,
sg_set_page(&dst, dest_page, PAGE_CACHE_SIZE, 0); sg_set_page(&dst, dest_page, PAGE_CACHE_SIZE, 0);
sg_init_table(&src, 1); sg_init_table(&src, 1);
sg_set_page(&src, src_page, PAGE_CACHE_SIZE, 0); sg_set_page(&src, src_page, PAGE_CACHE_SIZE, 0);
ablkcipher_request_set_crypt(req, &src, &dst, PAGE_CACHE_SIZE, skcipher_request_set_crypt(req, &src, &dst, PAGE_CACHE_SIZE,
xts_tweak); xts_tweak);
if (rw == F2FS_DECRYPT) if (rw == F2FS_DECRYPT)
res = crypto_ablkcipher_decrypt(req); res = crypto_skcipher_decrypt(req);
else else
res = crypto_ablkcipher_encrypt(req); res = crypto_skcipher_encrypt(req);
if (res == -EINPROGRESS || res == -EBUSY) { if (res == -EINPROGRESS || res == -EBUSY) {
BUG_ON(req->base.data != &ecr); BUG_ON(req->base.data != &ecr);
wait_for_completion(&ecr.completion); wait_for_completion(&ecr.completion);
res = ecr.res; res = ecr.res;
} }
ablkcipher_request_free(req); skcipher_request_free(req);
if (res) { if (res) {
printk_ratelimited(KERN_ERR printk_ratelimited(KERN_ERR
"%s: crypto_ablkcipher_encrypt() returned %d\n", "%s: crypto_skcipher_encrypt() returned %d\n",
__func__, res); __func__, res);
return res; return res;
} }
......
fs/f2fs/crypto_fname.c
View file @ 2731a944
...@@ -15,11 +15,9 @@ ...@@ -15,11 +15,9 @@
* *
* This has not yet undergone a rigorous security audit. * This has not yet undergone a rigorous security audit.
*/ */
#include <crypto/hash.h> #include <crypto/skcipher.h>
#include <crypto/sha.h>
#include <keys/encrypted-type.h> #include <keys/encrypted-type.h>
#include <keys/user-type.h> #include <keys/user-type.h>
#include <linux/crypto.h>
#include <linux/gfp.h> #include <linux/gfp.h>
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/key.h> #include <linux/key.h>
...@@ -70,10 +68,10 @@ static int f2fs_fname_encrypt(struct inode *inode, ...@@ -70,10 +68,10 @@ static int f2fs_fname_encrypt(struct inode *inode,
const struct qstr *iname, struct f2fs_str *oname) const struct qstr *iname, struct f2fs_str *oname)
{ {
u32 ciphertext_len; u32 ciphertext_len;
struct ablkcipher_request *req = NULL; struct skcipher_request *req = NULL;
DECLARE_F2FS_COMPLETION_RESULT(ecr); DECLARE_F2FS_COMPLETION_RESULT(ecr);
struct f2fs_crypt_info *ci = F2FS_I(inode)->i_crypt_info; struct f2fs_crypt_info *ci = F2FS_I(inode)->i_crypt_info;
struct crypto_ablkcipher *tfm = ci->ci_ctfm; struct crypto_skcipher *tfm = ci->ci_ctfm;
int res = 0; int res = 0;
char iv[F2FS_CRYPTO_BLOCK_SIZE]; char iv[F2FS_CRYPTO_BLOCK_SIZE];
struct scatterlist src_sg, dst_sg; struct scatterlist src_sg, dst_sg;
...@@ -99,14 +97,14 @@ static int f2fs_fname_encrypt(struct inode *inode, ...@@ -99,14 +97,14 @@ static int f2fs_fname_encrypt(struct inode *inode,
} }
/* Allocate request */ /* Allocate request */
req = ablkcipher_request_alloc(tfm, GFP_NOFS); req = skcipher_request_alloc(tfm, GFP_NOFS);
if (!req) { if (!req) {
printk_ratelimited(KERN_ERR printk_ratelimited(KERN_ERR
"%s: crypto_request_alloc() failed\n", __func__); "%s: crypto_request_alloc() failed\n", __func__);
kfree(alloc_buf); kfree(alloc_buf);
return -ENOMEM; return -ENOMEM;
} }
ablkcipher_request_set_callback(req, skcipher_request_set_callback(req,
CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
f2fs_dir_crypt_complete, &ecr); f2fs_dir_crypt_complete, &ecr);
...@@ -121,15 +119,15 @@ static int f2fs_fname_encrypt(struct inode *inode, ...@@ -121,15 +119,15 @@ static int f2fs_fname_encrypt(struct inode *inode,
/* Create encryption request */ /* Create encryption request */
sg_init_one(&src_sg, workbuf, ciphertext_len); sg_init_one(&src_sg, workbuf, ciphertext_len);
sg_init_one(&dst_sg, oname->name, ciphertext_len); sg_init_one(&dst_sg, oname->name, ciphertext_len);
ablkcipher_request_set_crypt(req, &src_sg, &dst_sg, ciphertext_len, iv); skcipher_request_set_crypt(req, &src_sg, &dst_sg, ciphertext_len, iv);
res = crypto_ablkcipher_encrypt(req); res = crypto_skcipher_encrypt(req);
if (res == -EINPROGRESS || res == -EBUSY) { if (res == -EINPROGRESS || res == -EBUSY) {
BUG_ON(req->base.data != &ecr); BUG_ON(req->base.data != &ecr);
wait_for_completion(&ecr.completion); wait_for_completion(&ecr.completion);
res = ecr.res; res = ecr.res;
} }
kfree(alloc_buf); kfree(alloc_buf);
ablkcipher_request_free(req); skcipher_request_free(req);
if (res < 0) { if (res < 0) {
printk_ratelimited(KERN_ERR printk_ratelimited(KERN_ERR
"%s: Error (error code %d)\n", __func__, res); "%s: Error (error code %d)\n", __func__, res);
...@@ -148,11 +146,11 @@ static int f2fs_fname_encrypt(struct inode *inode, ...@@ -148,11 +146,11 @@ static int f2fs_fname_encrypt(struct inode *inode,
static int f2fs_fname_decrypt(struct inode *inode, static int f2fs_fname_decrypt(struct inode *inode,
const struct f2fs_str *iname, struct f2fs_str *oname) const struct f2fs_str *iname, struct f2fs_str *oname)
{ {
struct ablkcipher_request *req = NULL; struct skcipher_request *req = NULL;
DECLARE_F2FS_COMPLETION_RESULT(ecr); DECLARE_F2FS_COMPLETION_RESULT(ecr);
struct scatterlist src_sg, dst_sg; struct scatterlist src_sg, dst_sg;
struct f2fs_crypt_info *ci = F2FS_I(inode)->i_crypt_info; struct f2fs_crypt_info *ci = F2FS_I(inode)->i_crypt_info;
struct crypto_ablkcipher *tfm = ci->ci_ctfm; struct crypto_skcipher *tfm = ci->ci_ctfm;
int res = 0; int res = 0;
char iv[F2FS_CRYPTO_BLOCK_SIZE]; char iv[F2FS_CRYPTO_BLOCK_SIZE];
unsigned lim = max_name_len(inode); unsigned lim = max_name_len(inode);
...@@ -161,13 +159,13 @@ static int f2fs_fname_decrypt(struct inode *inode, ...@@ -161,13 +159,13 @@ static int f2fs_fname_decrypt(struct inode *inode,
return -EIO; return -EIO;
/* Allocate request */ /* Allocate request */
req = ablkcipher_request_alloc(tfm, GFP_NOFS); req = skcipher_request_alloc(tfm, GFP_NOFS);
if (!req) { if (!req) {
printk_ratelimited(KERN_ERR printk_ratelimited(KERN_ERR
"%s: crypto_request_alloc() failed\n", __func__); "%s: crypto_request_alloc() failed\n", __func__);
return -ENOMEM; return -ENOMEM;
} }
ablkcipher_request_set_callback(req, skcipher_request_set_callback(req,
CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
f2fs_dir_crypt_complete, &ecr); f2fs_dir_crypt_complete, &ecr);
...@@ -177,14 +175,14 @@ static int f2fs_fname_decrypt(struct inode *inode, ...@@ -177,14 +175,14 @@ static int f2fs_fname_decrypt(struct inode *inode,
/* Create decryption request */ /* Create decryption request */
sg_init_one(&src_sg, iname->name, iname->len); sg_init_one(&src_sg, iname->name, iname->len);
sg_init_one(&dst_sg, oname->name, oname->len); sg_init_one(&dst_sg, oname->name, oname->len);
ablkcipher_request_set_crypt(req, &src_sg, &dst_sg, iname->len, iv); skcipher_request_set_crypt(req, &src_sg, &dst_sg, iname->len, iv);
res = crypto_ablkcipher_decrypt(req); res = crypto_skcipher_decrypt(req);
if (res == -EINPROGRESS || res == -EBUSY) { if (res == -EINPROGRESS || res == -EBUSY) {
BUG_ON(req->base.data != &ecr); BUG_ON(req->base.data != &ecr);
wait_for_completion(&ecr.completion); wait_for_completion(&ecr.completion);
res = ecr.res; res = ecr.res;
} }
ablkcipher_request_free(req); skcipher_request_free(req);
if (res < 0) { if (res < 0) {
printk_ratelimited(KERN_ERR printk_ratelimited(KERN_ERR
"%s: Error in f2fs_fname_decrypt (error code %d)\n", "%s: Error in f2fs_fname_decrypt (error code %d)\n",
......
fs/f2fs/crypto_key.c
View file @ 2731a944
...@@ -14,7 +14,7 @@ ...@@ -14,7 +14,7 @@
#include <linux/random.h> #include <linux/random.h>
#include <linux/scatterlist.h> #include <linux/scatterlist.h>
#include <uapi/linux/keyctl.h> #include <uapi/linux/keyctl.h>
#include <crypto/hash.h> #include <crypto/skcipher.h>
#include <linux/f2fs_fs.h> #include <linux/f2fs_fs.h>
#include "f2fs.h" #include "f2fs.h"
...@@ -44,46 +44,43 @@ static int f2fs_derive_key_aes(char deriving_key[F2FS_AES_128_ECB_KEY_SIZE], ...@@ -44,46 +44,43 @@ static int f2fs_derive_key_aes(char deriving_key[F2FS_AES_128_ECB_KEY_SIZE],
char derived_key[F2FS_AES_256_XTS_KEY_SIZE]) char derived_key[F2FS_AES_256_XTS_KEY_SIZE])
{ {
int res = 0; int res = 0;
struct ablkcipher_request *req = NULL; struct skcipher_request *req = NULL;
DECLARE_F2FS_COMPLETION_RESULT(ecr); DECLARE_F2FS_COMPLETION_RESULT(ecr);
struct scatterlist src_sg, dst_sg; struct scatterlist src_sg, dst_sg;
struct crypto_ablkcipher *tfm = crypto_alloc_ablkcipher("ecb(aes)", 0, struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0);
0);
if (IS_ERR(tfm)) { if (IS_ERR(tfm)) {
res = PTR_ERR(tfm); res = PTR_ERR(tfm);
tfm = NULL; tfm = NULL;
goto out; goto out;
} }
crypto_ablkcipher_set_flags(tfm, CRYPTO_TFM_REQ_WEAK_KEY); crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_WEAK_KEY);
req = ablkcipher_request_alloc(tfm, GFP_NOFS); req = skcipher_request_alloc(tfm, GFP_NOFS);
if (!req) { if (!req) {
res = -ENOMEM; res = -ENOMEM;
goto out; goto out;
} }
ablkcipher_request_set_callback(req, skcipher_request_set_callback(req,
CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
derive_crypt_complete, &ecr); derive_crypt_complete, &ecr);
res = crypto_ablkcipher_setkey(tfm, deriving_key, res = crypto_skcipher_setkey(tfm, deriving_key,
F2FS_AES_128_ECB_KEY_SIZE); F2FS_AES_128_ECB_KEY_SIZE);
if (res < 0) if (res < 0)
goto out; goto out;
sg_init_one(&src_sg, source_key, F2FS_AES_256_XTS_KEY_SIZE); sg_init_one(&src_sg, source_key, F2FS_AES_256_XTS_KEY_SIZE);
sg_init_one(&dst_sg, derived_key, F2FS_AES_256_XTS_KEY_SIZE); sg_init_one(&dst_sg, derived_key, F2FS_AES_256_XTS_KEY_SIZE);
ablkcipher_request_set_crypt(req, &src_sg, &dst_sg, skcipher_request_set_crypt(req, &src_sg, &dst_sg,
F2FS_AES_256_XTS_KEY_SIZE, NULL); F2FS_AES_256_XTS_KEY_SIZE, NULL);
res = crypto_ablkcipher_encrypt(req); res = crypto_skcipher_encrypt(req);
if (res == -EINPROGRESS || res == -EBUSY) { if (res == -EINPROGRESS || res == -EBUSY) {
BUG_ON(req->base.data != &ecr); BUG_ON(req->base.data != &ecr);
wait_for_completion(&ecr.completion); wait_for_completion(&ecr.completion);
res = ecr.res; res = ecr.res;
} }
out: out:
if (req) skcipher_request_free(req);
ablkcipher_request_free(req); crypto_free_skcipher(tfm);
if (tfm)
crypto_free_ablkcipher(tfm);
return res; return res;
} }
...@@ -93,7 +90,7 @@ static void f2fs_free_crypt_info(struct f2fs_crypt_info *ci) ...@@ -93,7 +90,7 @@ static void f2fs_free_crypt_info(struct f2fs_crypt_info *ci)
return; return;
key_put(ci->ci_keyring_key); key_put(ci->ci_keyring_key);
crypto_free_ablkcipher(ci->ci_ctfm); crypto_free_skcipher(ci->ci_ctfm);
kmem_cache_free(f2fs_crypt_info_cachep, ci); kmem_cache_free(f2fs_crypt_info_cachep, ci);
} }
...@@ -123,7 +120,7 @@ int _f2fs_get_encryption_info(struct inode *inode) ...@@ -123,7 +120,7 @@ int _f2fs_get_encryption_info(struct inode *inode)
struct f2fs_encryption_key *master_key; struct f2fs_encryption_key *master_key;
struct f2fs_encryption_context ctx; struct f2fs_encryption_context ctx;
const struct user_key_payload *ukp; const struct user_key_payload *ukp;
struct crypto_ablkcipher *ctfm; struct crypto_skcipher *ctfm;
const char *cipher_str; const char *cipher_str;
char raw_key[F2FS_MAX_KEY_SIZE]; char raw_key[F2FS_MAX_KEY_SIZE];
char mode; char mode;
...@@ -213,7 +210,7 @@ int _f2fs_get_encryption_info(struct inode *inode) ...@@ -213,7 +210,7 @@ int _f2fs_get_encryption_info(struct inode *inode)
if (res) if (res)
goto out; goto out;
ctfm = crypto_alloc_ablkcipher(cipher_str, 0, 0); ctfm = crypto_alloc_skcipher(cipher_str, 0, 0);
if (!ctfm || IS_ERR(ctfm)) { if (!ctfm || IS_ERR(ctfm)) {
res = ctfm ? PTR_ERR(ctfm) : -ENOMEM; res = ctfm ? PTR_ERR(ctfm) : -ENOMEM;
printk(KERN_DEBUG printk(KERN_DEBUG
...@@ -222,11 +219,10 @@ int _f2fs_get_encryption_info(struct inode *inode) ...@@ -222,11 +219,10 @@ int _f2fs_get_encryption_info(struct inode *inode)
goto out; goto out;
} }
crypt_info->ci_ctfm = ctfm; crypt_info->ci_ctfm = ctfm;
crypto_ablkcipher_clear_flags(ctfm, ~0); crypto_skcipher_clear_flags(ctfm, ~0);
crypto_tfm_set_flags(crypto_ablkcipher_tfm(ctfm), crypto_skcipher_set_flags(ctfm, CRYPTO_TFM_REQ_WEAK_KEY);
CRYPTO_TFM_REQ_WEAK_KEY); res = crypto_skcipher_setkey(ctfm, raw_key,
res = crypto_ablkcipher_setkey(ctfm, raw_key, f2fs_encryption_key_size(mode));
f2fs_encryption_key_size(mode));
if (res) if (res)
goto out; goto out;
......
fs/f2fs/f2fs_crypto.h
View file @ 2731a944
...@@ -78,7 +78,7 @@ struct f2fs_crypt_info { ...@@ -78,7 +78,7 @@ struct f2fs_crypt_info {
char ci_data_mode; char ci_data_mode;
char ci_filename_mode; char ci_filename_mode;
char ci_flags; char ci_flags;
struct crypto_ablkcipher *ci_ctfm; struct crypto_skcipher *ci_ctfm;
struct key *ci_keyring_key; struct key *ci_keyring_key;
char ci_master_key[F2FS_KEY_DESCRIPTOR_SIZE]; char ci_master_key[F2FS_KEY_DESCRIPTOR_SIZE];
}; };
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7