Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:

 - avoid potential bogus alignment for some AEAD operations

 - fix crash in algif_aead

 - avoid sleeping in softirq context with async af_alg

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: skcipher - Fix skcipher_walk_aead_common
  crypto: af_alg - remove locking in async callback
  crypto: algif_aead - skip SGL entries with NULL page

5 files changed, 66 insertions, 38 deletions

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 85cea9de324a..358749c38894 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -1021,6 +1021,18 @@ unlock:
 EXPORT_SYMBOL_GPL(af_alg_sendpage);
 
 /**
+ * af_alg_free_resources - release resources required for crypto request
+ */
+void af_alg_free_resources(struct af_alg_async_req *areq)
+{
+        struct sock *sk = areq->sk;
+
+        af_alg_free_areq_sgls(areq);
+        sock_kfree_s(sk, areq, areq->areqlen);
+}
+EXPORT_SYMBOL_GPL(af_alg_free_resources);
+
+/**
  * af_alg_async_cb - AIO callback handler
  *
  * This handler cleans up the struct af_alg_async_req upon completion of the
@@ -1036,18 +1048,13 @@ void af_alg_async_cb(struct crypto_async_request *_req, int err)
         struct kiocb *iocb = areq->iocb;
         unsigned int resultlen;
 
-        lock_sock(sk);
-
         /* Buffer size written by crypto operation. */
         resultlen = areq->outlen;
 
-        af_alg_free_areq_sgls(areq);
-        sock_kfree_s(sk, areq, areq->areqlen);
-        __sock_put(sk);
+        af_alg_free_resources(areq);
+        sock_put(sk);
 
         iocb->ki_complete(iocb, err ? err : resultlen, 0);
-
-        release_sock(sk);
 }
 EXPORT_SYMBOL_GPL(af_alg_async_cb);
 
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index aacae0837aff..805f485ddf1b 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -101,10 +101,10 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
         struct aead_tfm *aeadc = pask->private;
         struct crypto_aead *tfm = aeadc->aead;
         struct crypto_skcipher *null_tfm = aeadc->null_tfm;
-        unsigned int as = crypto_aead_authsize(tfm);
+        unsigned int i, as = crypto_aead_authsize(tfm);
         struct af_alg_async_req *areq;
-        struct af_alg_tsgl *tsgl;
-        struct scatterlist *src;
+        struct af_alg_tsgl *tsgl, *tmp;
+        struct scatterlist *rsgl_src, *tsgl_src = NULL;
         int err = 0;
         size_t used = 0;                /* [in]  TX bufs to be en/decrypted */
         size_t outlen = 0;              /* [out] RX bufs produced by kernel */
@@ -178,7 +178,22 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
         }
 
         processed = used + ctx->aead_assoclen;
-        tsgl = list_first_entry(&ctx->tsgl_list, struct af_alg_tsgl, list);
+        list_for_each_entry_safe(tsgl, tmp, &ctx->tsgl_list, list) {
+                for (i = 0; i < tsgl->cur; i++) {
+                        struct scatterlist *process_sg = tsgl->sg + i;
+
+                        if (!(process_sg->length) || !sg_page(process_sg))
+                                continue;
+                        tsgl_src = process_sg;
+                        break;
+                }
+                if (tsgl_src)
+                        break;
+        }
+        if (processed && !tsgl_src) {
+                err = -EFAULT;
+                goto free;
+        }
 
         /*
          * Copy of AAD from source to destination
@@ -194,7 +209,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
          */
 
         /* Use the RX SGL as source (and destination) for crypto op. */
-        src = areq->first_rsgl.sgl.sg;
+        rsgl_src = areq->first_rsgl.sgl.sg;
 
         if (ctx->enc) {
                 /*
@@ -207,7 +222,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
                  *          v      v
                  * RX SGL: AAD || PT || Tag
                  */
-                err = crypto_aead_copy_sgl(null_tfm, tsgl->sg,
+                err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
                                            areq->first_rsgl.sgl.sg, processed);
                 if (err)
                         goto free;
@@ -225,7 +240,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
                  */
 
                  /* Copy AAD || CT to RX SGL buffer for in-place operation. */
-                err = crypto_aead_copy_sgl(null_tfm, tsgl->sg,
+                err = crypto_aead_copy_sgl(null_tfm, tsgl_src,
                                            areq->first_rsgl.sgl.sg, outlen);
                 if (err)
                         goto free;
@@ -257,23 +272,34 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
                                  areq->tsgl);
                 } else
                         /* no RX SGL present (e.g. authentication only) */
-                        src = areq->tsgl;
+                        rsgl_src = areq->tsgl;
         }
 
         /* Initialize the crypto operation */
-        aead_request_set_crypt(&areq->cra_u.aead_req, src,
+        aead_request_set_crypt(&areq->cra_u.aead_req, rsgl_src,
                                areq->first_rsgl.sgl.sg, used, ctx->iv);
         aead_request_set_ad(&areq->cra_u.aead_req, ctx->aead_assoclen);
         aead_request_set_tfm(&areq->cra_u.aead_req, tfm);
 
         if (msg->msg_iocb && !is_sync_kiocb(msg->msg_iocb)) {
                 /* AIO operation */
+                sock_hold(sk);
                 areq->iocb = msg->msg_iocb;
                 aead_request_set_callback(&areq->cra_u.aead_req,
                                           CRYPTO_TFM_REQ_MAY_BACKLOG,
                                           af_alg_async_cb, areq);
                 err = ctx->enc ? crypto_aead_encrypt(&areq->cra_u.aead_req) :
                                  crypto_aead_decrypt(&areq->cra_u.aead_req);
+
+                /* AIO operation in progress */
+                if (err == -EINPROGRESS || err == -EBUSY) {
+                        /* Remember output size that will be generated. */
+                        areq->outlen = outlen;
+
+                        return -EIOCBQUEUED;
+                }
+
+                sock_put(sk);
         } else {
                 /* Synchronous operation */
                 aead_request_set_callback(&areq->cra_u.aead_req,
@@ -285,19 +311,9 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
                                 &ctx->wait);
         }
 
-        /* AIO operation in progress */
-        if (err == -EINPROGRESS) {
-                sock_hold(sk);
-
-                /* Remember output size that will be generated. */
-                areq->outlen = outlen;
-
-                return -EIOCBQUEUED;
-        }
 
 free:
-        af_alg_free_areq_sgls(areq);
-        sock_kfree_s(sk, areq, areq->areqlen);
+        af_alg_free_resources(areq);
 
         return err ? err : outlen;
 }
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 9954b078f0b9..30cff827dd8f 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -117,6 +117,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
 
         if (msg->msg_iocb && !is_sync_kiocb(msg->msg_iocb)) {
                 /* AIO operation */
+                sock_hold(sk);
                 areq->iocb = msg->msg_iocb;
                 skcipher_request_set_callback(&areq->cra_u.skcipher_req,
                                               CRYPTO_TFM_REQ_MAY_SLEEP,
@@ -124,6 +125,16 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
                 err = ctx->enc ?
                         crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) :
                         crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
+
+                /* AIO operation in progress */
+                if (err == -EINPROGRESS || err == -EBUSY) {
+                        /* Remember output size that will be generated. */
+                        areq->outlen = len;
+
+                        return -EIOCBQUEUED;
+                }
+
+                sock_put(sk);
         } else {
                 /* Synchronous operation */
                 skcipher_request_set_callback(&areq->cra_u.skcipher_req,
@@ -136,19 +147,9 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
                                                  &ctx->wait);
         }
 
-        /* AIO operation in progress */
-        if (err == -EINPROGRESS) {
-                sock_hold(sk);
-
-                /* Remember output size that will be generated. */
-                areq->outlen = len;
-
-                return -EIOCBQUEUED;
-        }
 
 free:
-        af_alg_free_areq_sgls(areq);
-        sock_kfree_s(sk, areq, areq->areqlen);
+        af_alg_free_resources(areq);
 
         return err ? err : len;
 }
diff --git a/crypto/skcipher.c b/crypto/skcipher.c
index d5692e35fab1..778e0ff42bfa 100644
--- a/crypto/skcipher.c
+++ b/crypto/skcipher.c
@@ -522,6 +522,9 @@ static int skcipher_walk_aead_common(struct skcipher_walk *walk,
         scatterwalk_copychunks(NULL, &walk->in, req->assoclen, 2);
         scatterwalk_copychunks(NULL, &walk->out, req->assoclen, 2);
 
+        scatterwalk_done(&walk->in, 0, walk->total);
+        scatterwalk_done(&walk->out, 0, walk->total);
+
         walk->iv = req->iv;
         walk->oiv = req->iv;
 
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index 6abf0a3604dc..38d9c5861ed8 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -242,6 +242,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
                    unsigned int ivsize);
 ssize_t af_alg_sendpage(struct socket *sock, struct page *page,
                         int offset, size_t size, int flags);
+void af_alg_free_resources(struct af_alg_async_req *areq);
 void af_alg_async_cb(struct crypto_async_request *_req, int err);
 unsigned int af_alg_poll(struct file *file, struct socket *sock,
                          poll_table *wait);