Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:
 "This fixes a number of concurrency issues on s390 where multiple users
  of the same crypto transform may clobber each other's results"

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: s390 - fix des and des3_ede ctr concurrency issue
  crypto: s390 - fix des and des3_ede cbc concurrency issue
  crypto: s390 - fix concurrency issue in aes-ctr mode

2 files changed, 108 insertions, 52 deletions

diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
index b3feabd39f31..cf3c0089bef2 100644
--- a/arch/s390/crypto/aes_s390.c
+++ b/arch/s390/crypto/aes_s390.c
@@ -25,6 +25,7 @@
 #include <linux/err.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/spinlock.h>
 #include "crypt_s390.h"
 
 #define AES_KEYLEN_128          1
@@ -32,6 +33,7 @@
 #define AES_KEYLEN_256          4
 
 static u8 *ctrblk;
+static DEFINE_SPINLOCK(ctrblk_lock);
 static char keylen_flag;
 
 struct s390_aes_ctx {
@@ -758,43 +760,67 @@ static int ctr_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
         return aes_set_key(tfm, in_key, key_len);
 }
 
+static unsigned int __ctrblk_init(u8 *ctrptr, unsigned int nbytes)
+{
+        unsigned int i, n;
+
+        /* only use complete blocks, max. PAGE_SIZE */
+        n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : nbytes & ~(AES_BLOCK_SIZE - 1);
+        for (i = AES_BLOCK_SIZE; i < n; i += AES_BLOCK_SIZE) {
+                memcpy(ctrptr + i, ctrptr + i - AES_BLOCK_SIZE,
+                       AES_BLOCK_SIZE);
+                crypto_inc(ctrptr + i, AES_BLOCK_SIZE);
+        }
+        return n;
+}
+
 static int ctr_aes_crypt(struct blkcipher_desc *desc, long func,
                          struct s390_aes_ctx *sctx, struct blkcipher_walk *walk)
 {
         int ret = blkcipher_walk_virt_block(desc, walk, AES_BLOCK_SIZE);
-        unsigned int i, n, nbytes;
-        u8 buf[AES_BLOCK_SIZE];
-        u8 *out, *in;
+        unsigned int n, nbytes;
+        u8 buf[AES_BLOCK_SIZE], ctrbuf[AES_BLOCK_SIZE];
+        u8 *out, *in, *ctrptr = ctrbuf;
 
         if (!walk->nbytes)
                 return ret;
 
-        memcpy(ctrblk, walk->iv, AES_BLOCK_SIZE);
+        if (spin_trylock(&ctrblk_lock))
+                ctrptr = ctrblk;
+
+        memcpy(ctrptr, walk->iv, AES_BLOCK_SIZE);
         while ((nbytes = walk->nbytes) >= AES_BLOCK_SIZE) {
                 out = walk->dst.virt.addr;
                 in = walk->src.virt.addr;
                 while (nbytes >= AES_BLOCK_SIZE) {
-                        /* only use complete blocks, max. PAGE_SIZE */
-                        n = (nbytes > PAGE_SIZE) ? PAGE_SIZE :
-                                                 nbytes & ~(AES_BLOCK_SIZE - 1);
-                        for (i = AES_BLOCK_SIZE; i < n; i += AES_BLOCK_SIZE) {
-                                memcpy(ctrblk + i, ctrblk + i - AES_BLOCK_SIZE,
-                                       AES_BLOCK_SIZE);
-                                crypto_inc(ctrblk + i, AES_BLOCK_SIZE);
-                        }
-                        ret = crypt_s390_kmctr(func, sctx->key, out, in, n, ctrblk);
-                        if (ret < 0 || ret != n)
+                        if (ctrptr == ctrblk)
+                                n = __ctrblk_init(ctrptr, nbytes);
+                        else
+                                n = AES_BLOCK_SIZE;
+                        ret = crypt_s390_kmctr(func, sctx->key, out, in,
+                                               n, ctrptr);
+                        if (ret < 0 || ret != n) {
+                                if (ctrptr == ctrblk)
+                                        spin_unlock(&ctrblk_lock);
                                 return -EIO;
+                        }
                         if (n > AES_BLOCK_SIZE)
-                                memcpy(ctrblk, ctrblk + n - AES_BLOCK_SIZE,
+                                memcpy(ctrptr, ctrptr + n - AES_BLOCK_SIZE,
                                        AES_BLOCK_SIZE);
-                        crypto_inc(ctrblk, AES_BLOCK_SIZE);
+                        crypto_inc(ctrptr, AES_BLOCK_SIZE);
                         out += n;
                         in += n;
                         nbytes -= n;
                 }
                 ret = blkcipher_walk_done(desc, walk, nbytes);
         }
+        if (ctrptr == ctrblk) {
+                if (nbytes)
+                        memcpy(ctrbuf, ctrptr, AES_BLOCK_SIZE);
+                else
+                        memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
+                spin_unlock(&ctrblk_lock);
+        }
         /*
          * final block may be < AES_BLOCK_SIZE, copy only nbytes
          */
@@ -802,14 +828,15 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func,
                 out = walk->dst.virt.addr;
                 in = walk->src.virt.addr;
                 ret = crypt_s390_kmctr(func, sctx->key, buf, in,
-                                       AES_BLOCK_SIZE, ctrblk);
+                                       AES_BLOCK_SIZE, ctrbuf);
                 if (ret < 0 || ret != AES_BLOCK_SIZE)
                         return -EIO;
                 memcpy(out, buf, nbytes);
-                crypto_inc(ctrblk, AES_BLOCK_SIZE);
+                crypto_inc(ctrbuf, AES_BLOCK_SIZE);
                 ret = blkcipher_walk_done(desc, walk, 0);
+                memcpy(walk->iv, ctrbuf, AES_BLOCK_SIZE);
         }
-        memcpy(walk->iv, ctrblk, AES_BLOCK_SIZE);
+
         return ret;
 }
 
diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c
index 200f2a1b599d..0a5aac8a9412 100644
--- a/arch/s390/crypto/des_s390.c
+++ b/arch/s390/crypto/des_s390.c
@@ -25,6 +25,7 @@
 #define DES3_KEY_SIZE   (3 * DES_KEY_SIZE)
 
 static u8 *ctrblk;
+static DEFINE_SPINLOCK(ctrblk_lock);
 
 struct s390_des_ctx {
         u8 iv[DES_BLOCK_SIZE];
@@ -105,29 +106,35 @@ static int ecb_desall_crypt(struct blkcipher_desc *desc, long func,
 }
 
 static int cbc_desall_crypt(struct blkcipher_desc *desc, long func,
-                            u8 *iv, struct blkcipher_walk *walk)
+                            struct blkcipher_walk *walk)
 {
+        struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
         int ret = blkcipher_walk_virt(desc, walk);
         unsigned int nbytes = walk->nbytes;
+        struct {
+                u8 iv[DES_BLOCK_SIZE];
+                u8 key[DES3_KEY_SIZE];
+        } param;
 
         if (!nbytes)
                 goto out;
 
-        memcpy(iv, walk->iv, DES_BLOCK_SIZE);
+        memcpy(param.iv, walk->iv, DES_BLOCK_SIZE);
+        memcpy(param.key, ctx->key, DES3_KEY_SIZE);
         do {
                 /* only use complete blocks */
                 unsigned int n = nbytes & ~(DES_BLOCK_SIZE - 1);
                 u8 *out = walk->dst.virt.addr;
                 u8 *in = walk->src.virt.addr;
 
-                ret = crypt_s390_kmc(func, iv, out, in, n);
+                ret = crypt_s390_kmc(func, &param, out, in, n);
                 if (ret < 0 || ret != n)
                         return -EIO;
 
                 nbytes &= DES_BLOCK_SIZE - 1;
                 ret = blkcipher_walk_done(desc, walk, nbytes);
         } while ((nbytes = walk->nbytes));
-        memcpy(walk->iv, iv, DES_BLOCK_SIZE);
+        memcpy(walk->iv, param.iv, DES_BLOCK_SIZE);
 
 out:
         return ret;
@@ -179,22 +186,20 @@ static int cbc_des_encrypt(struct blkcipher_desc *desc,
                            struct scatterlist *dst, struct scatterlist *src,
                            unsigned int nbytes)
 {
-        struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
         struct blkcipher_walk walk;
 
         blkcipher_walk_init(&walk, dst, src, nbytes);
-        return cbc_desall_crypt(desc, KMC_DEA_ENCRYPT, ctx->iv, &walk);
+        return cbc_desall_crypt(desc, KMC_DEA_ENCRYPT, &walk);
 }
 
 static int cbc_des_decrypt(struct blkcipher_desc *desc,
                            struct scatterlist *dst, struct scatterlist *src,
                            unsigned int nbytes)
 {
-        struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
         struct blkcipher_walk walk;
 
         blkcipher_walk_init(&walk, dst, src, nbytes);
-        return cbc_desall_crypt(desc, KMC_DEA_DECRYPT, ctx->iv, &walk);
+        return cbc_desall_crypt(desc, KMC_DEA_DECRYPT, &walk);
 }
 
 static struct crypto_alg cbc_des_alg = {
@@ -327,22 +332,20 @@ static int cbc_des3_encrypt(struct blkcipher_desc *desc,
                             struct scatterlist *dst, struct scatterlist *src,
                             unsigned int nbytes)
 {
-        struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
         struct blkcipher_walk walk;
 
         blkcipher_walk_init(&walk, dst, src, nbytes);
-        return cbc_desall_crypt(desc, KMC_TDEA_192_ENCRYPT, ctx->iv, &walk);
+        return cbc_desall_crypt(desc, KMC_TDEA_192_ENCRYPT, &walk);
 }
 
 static int cbc_des3_decrypt(struct blkcipher_desc *desc,
                             struct scatterlist *dst, struct scatterlist *src,
                             unsigned int nbytes)
 {
-        struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
         struct blkcipher_walk walk;
 
         blkcipher_walk_init(&walk, dst, src, nbytes);
-        return cbc_desall_crypt(desc, KMC_TDEA_192_DECRYPT, ctx->iv, &walk);
+        return cbc_desall_crypt(desc, KMC_TDEA_192_DECRYPT, &walk);
 }
 
 static struct crypto_alg cbc_des3_alg = {
@@ -366,54 +369,80 @@ static struct crypto_alg cbc_des3_alg = {
         }
 };
 
+static unsigned int __ctrblk_init(u8 *ctrptr, unsigned int nbytes)
+{
+        unsigned int i, n;
+
+        /* align to block size, max. PAGE_SIZE */
+        n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : nbytes & ~(DES_BLOCK_SIZE - 1);
+        for (i = DES_BLOCK_SIZE; i < n; i += DES_BLOCK_SIZE) {
+                memcpy(ctrptr + i, ctrptr + i - DES_BLOCK_SIZE, DES_BLOCK_SIZE);
+                crypto_inc(ctrptr + i, DES_BLOCK_SIZE);
+        }
+        return n;
+}
+
 static int ctr_desall_crypt(struct blkcipher_desc *desc, long func,
-                            struct s390_des_ctx *ctx, struct blkcipher_walk *walk)
+                            struct s390_des_ctx *ctx,
+                            struct blkcipher_walk *walk)
 {
         int ret = blkcipher_walk_virt_block(desc, walk, DES_BLOCK_SIZE);
-        unsigned int i, n, nbytes;
-        u8 buf[DES_BLOCK_SIZE];
-        u8 *out, *in;
+        unsigned int n, nbytes;
+        u8 buf[DES_BLOCK_SIZE], ctrbuf[DES_BLOCK_SIZE];
+        u8 *out, *in, *ctrptr = ctrbuf;
+
+        if (!walk->nbytes)
+                return ret;
 
-        memcpy(ctrblk, walk->iv, DES_BLOCK_SIZE);
+        if (spin_trylock(&ctrblk_lock))
+                ctrptr = ctrblk;
+
+        memcpy(ctrptr, walk->iv, DES_BLOCK_SIZE);
         while ((nbytes = walk->nbytes) >= DES_BLOCK_SIZE) {
                 out = walk->dst.virt.addr;
                 in = walk->src.virt.addr;
                 while (nbytes >= DES_BLOCK_SIZE) {
-                        /* align to block size, max. PAGE_SIZE */
-                        n = (nbytes > PAGE_SIZE) ? PAGE_SIZE :
-                                nbytes & ~(DES_BLOCK_SIZE - 1);
-                        for (i = DES_BLOCK_SIZE; i < n; i += DES_BLOCK_SIZE) {
-                                memcpy(ctrblk + i, ctrblk + i - DES_BLOCK_SIZE,
-                                       DES_BLOCK_SIZE);
-                                crypto_inc(ctrblk + i, DES_BLOCK_SIZE);
-                        }
-                        ret = crypt_s390_kmctr(func, ctx->key, out, in, n, ctrblk);
-                        if (ret < 0 || ret != n)
+                        if (ctrptr == ctrblk)
+                                n = __ctrblk_init(ctrptr, nbytes);
+                        else
+                                n = DES_BLOCK_SIZE;
+                        ret = crypt_s390_kmctr(func, ctx->key, out, in,
+                                               n, ctrptr);
+                        if (ret < 0 || ret != n) {
+                                if (ctrptr == ctrblk)
+                                        spin_unlock(&ctrblk_lock);
                                 return -EIO;
+                        }
                         if (n > DES_BLOCK_SIZE)
-                                memcpy(ctrblk, ctrblk + n - DES_BLOCK_SIZE,
+                                memcpy(ctrptr, ctrptr + n - DES_BLOCK_SIZE,
                                        DES_BLOCK_SIZE);
-                        crypto_inc(ctrblk, DES_BLOCK_SIZE);
+                        crypto_inc(ctrptr, DES_BLOCK_SIZE);
                         out += n;
                         in += n;
                         nbytes -= n;
                 }
                 ret = blkcipher_walk_done(desc, walk, nbytes);
         }
-
+        if (ctrptr == ctrblk) {
+                if (nbytes)
+                        memcpy(ctrbuf, ctrptr, DES_BLOCK_SIZE);
+                else
+                        memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
+                spin_unlock(&ctrblk_lock);
+        }
         /* final block may be < DES_BLOCK_SIZE, copy only nbytes */
         if (nbytes) {
                 out = walk->dst.virt.addr;
                 in = walk->src.virt.addr;
                 ret = crypt_s390_kmctr(func, ctx->key, buf, in,
-                                       DES_BLOCK_SIZE, ctrblk);
+                                       DES_BLOCK_SIZE, ctrbuf);
                 if (ret < 0 || ret != DES_BLOCK_SIZE)
                         return -EIO;
                 memcpy(out, buf, nbytes);
-                crypto_inc(ctrblk, DES_BLOCK_SIZE);
+                crypto_inc(ctrbuf, DES_BLOCK_SIZE);
                 ret = blkcipher_walk_done(desc, walk, 0);
+                memcpy(walk->iv, ctrbuf, DES_BLOCK_SIZE);
         }
-        memcpy(walk->iv, ctrblk, DES_BLOCK_SIZE);
         return ret;
 }