crypto: s390 - Fix aes-xts parameter corruption

commit 9dda2769af4f3f3093434648c409bb351120d9e8 upstream.

Some s390 crypto algorithms incorrectly use the crypto_tfm structure to
store private data. As the tfm can be shared among multiple threads, this
can result in data corruption.

This patch fixes aes-xts by moving the xts and pcc parameter blocks from
the tfm onto the stack (48 + 96 bytes).

Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 17 insertions, 14 deletions

diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
index 2e4b5be31a1b..94e20dd2729f 100644
--- a/arch/s390/crypto/aes_s390.c
+++ b/arch/s390/crypto/aes_s390.c
@@ -55,8 +55,7 @@ struct pcc_param {
 
 struct s390_xts_ctx {
         u8 key[32];
-        u8 xts_param[16];
-        struct pcc_param pcc;
+        u8 pcc_key[32];
         long enc;
         long dec;
         int key_len;
@@ -591,7 +590,7 @@ static int xts_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
                 xts_ctx->enc = KM_XTS_128_ENCRYPT;
                 xts_ctx->dec = KM_XTS_128_DECRYPT;
                 memcpy(xts_ctx->key + 16, in_key, 16);
-                memcpy(xts_ctx->pcc.key + 16, in_key + 16, 16);
+                memcpy(xts_ctx->pcc_key + 16, in_key + 16, 16);
                 break;
         case 48:
                 xts_ctx->enc = 0;
@@ -602,7 +601,7 @@ static int xts_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
                 xts_ctx->enc = KM_XTS_256_ENCRYPT;
                 xts_ctx->dec = KM_XTS_256_DECRYPT;
                 memcpy(xts_ctx->key, in_key, 32);
-                memcpy(xts_ctx->pcc.key, in_key + 32, 32);
+                memcpy(xts_ctx->pcc_key, in_key + 32, 32);
                 break;
         default:
                 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
@@ -621,29 +620,33 @@ static int xts_aes_crypt(struct blkcipher_desc *desc, long func,
         unsigned int nbytes = walk->nbytes;
         unsigned int n;
         u8 *in, *out;
-        void *param;
+        struct pcc_param pcc_param;
+        struct {
+                u8 key[32];
+                u8 init[16];
+        } xts_param;
 
         if (!nbytes)
                 goto out;
 
-        memset(xts_ctx->pcc.block, 0, sizeof(xts_ctx->pcc.block));
-        memset(xts_ctx->pcc.bit, 0, sizeof(xts_ctx->pcc.bit));
-        memset(xts_ctx->pcc.xts, 0, sizeof(xts_ctx->pcc.xts));
-        memcpy(xts_ctx->pcc.tweak, walk->iv, sizeof(xts_ctx->pcc.tweak));
-        param = xts_ctx->pcc.key + offset;
-        ret = crypt_s390_pcc(func, param);
+        memset(pcc_param.block, 0, sizeof(pcc_param.block));
+        memset(pcc_param.bit, 0, sizeof(pcc_param.bit));
+        memset(pcc_param.xts, 0, sizeof(pcc_param.xts));
+        memcpy(pcc_param.tweak, walk->iv, sizeof(pcc_param.tweak));
+        memcpy(pcc_param.key, xts_ctx->pcc_key, 32);
+        ret = crypt_s390_pcc(func, &pcc_param.key[offset]);
         if (ret < 0)
                 return -EIO;
 
-        memcpy(xts_ctx->xts_param, xts_ctx->pcc.xts, 16);
-        param = xts_ctx->key + offset;
+        memcpy(xts_param.key, xts_ctx->key, 32);
+        memcpy(xts_param.init, pcc_param.xts, 16);
         do {
                 /* only use complete blocks */
                 n = nbytes & ~(AES_BLOCK_SIZE - 1);
                 out = walk->dst.virt.addr;
                 in = walk->src.virt.addr;
 
-                ret = crypt_s390_km(func, param, out, in, n);
+                ret = crypt_s390_km(func, &xts_param.key[offset], out, in, n);
                 if (ret < 0 || ret != n)
                         return -EIO;