Commit 2b4c87db authored by Jason A. Donenfeld's avatar Jason A. Donenfeld Committed by Luis Henriques

crypto: skcipher - Copy iv from desc even for 0-len walks

commit 70d906bc upstream.

Some ciphers actually support encrypting zero length plaintexts. For
example, many AEAD modes support this. The resulting ciphertext for
those winds up being only the authentication tag, which is a result of
the key, the iv, the additional data, and the fact that the plaintext
had zero length. The blkcipher constructors won't copy the IV to the
right place, however, when using a zero length input, resulting in
some significant problems when ciphers call their initialization
routines, only to find that the ->iv parameter is uninitialized. One
such example of this would be using chacha20poly1305 with a zero length
input, which then calls chacha20, which calls the key setup routine,
which eventually OOPSes due to the uninitialized ->iv member.
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent be55f7df
...@@ -276,12 +276,12 @@ static int ablkcipher_walk_first(struct ablkcipher_request *req, ...@@ -276,12 +276,12 @@ static int ablkcipher_walk_first(struct ablkcipher_request *req,
if (WARN_ON_ONCE(in_irq())) if (WARN_ON_ONCE(in_irq()))
return -EDEADLK; return -EDEADLK;
walk->iv = req->info;
walk->nbytes = walk->total; walk->nbytes = walk->total;
if (unlikely(!walk->total)) if (unlikely(!walk->total))
return 0; return 0;
walk->iv_buffer = NULL; walk->iv_buffer = NULL;
walk->iv = req->info;
if (unlikely(((unsigned long)walk->iv & alignmask))) { if (unlikely(((unsigned long)walk->iv & alignmask))) {
int err = ablkcipher_copy_iv(walk, tfm, alignmask); int err = ablkcipher_copy_iv(walk, tfm, alignmask);
if (err) if (err)
......
...@@ -325,12 +325,12 @@ static int blkcipher_walk_first(struct blkcipher_desc *desc, ...@@ -325,12 +325,12 @@ static int blkcipher_walk_first(struct blkcipher_desc *desc,
if (WARN_ON_ONCE(in_irq())) if (WARN_ON_ONCE(in_irq()))
return -EDEADLK; return -EDEADLK;
walk->iv = desc->info;
walk->nbytes = walk->total; walk->nbytes = walk->total;
if (unlikely(!walk->total)) if (unlikely(!walk->total))
return 0; return 0;
walk->buffer = NULL; walk->buffer = NULL;
walk->iv = desc->info;
if (unlikely(((unsigned long)walk->iv & walk->alignmask))) { if (unlikely(((unsigned long)walk->iv & walk->alignmask))) {
int err = blkcipher_copy_iv(walk); int err = blkcipher_copy_iv(walk);
if (err) if (err)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment