aboutsummaryrefslogtreecommitdiffstats
path: root/crypto
Commit message (Collapse)AuthorAge
* crypto: authenc - Avoid using clobbered request pointerHerbert Xu2008-08-22
| | | | | | | | | | | | | | | | | | Authenc works in two stages for encryption, it first encrypts and then computes an ICV. The context memory of the request is used by both operations. The problem is that when an asynchronous encryption completes, we will compute the ICV and then reread the context memory of the encryption to get the original request. It just happens that we have a buffer of 16 bytes in front of the request pointer, so ICVs of 16 bytes (such as SHA1) do not trigger the bug. However, any attempt to uses a larger ICV instantly kills the machine when the first asynchronous encryption is completed. This patch fixes this by saving the request pointer before we start the ICV computation. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* crypto: hash - Fix digest size check for digest typeHerbert Xu2008-08-13
| | | | | | | | | | | The changeset ca786dc738f4f583b57b1bba7a335b5e8233f4b0 crypto: hash - Fixed digest size check missed one spot for the digest type. This patch corrects that error. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* crypto: tcrypt - Fix AEAD chunk testingHerbert Xu2008-08-13
| | | | | | | | | | | | | | | | My changeset 4b22f0ddb6564210c9ded7ba25b2a1007733e784 crypto: tcrpyt - Remove unnecessary kmap/kunmap calls introduced a typo that broke AEAD chunk testing. In particular, axbuf should really be xbuf. There is also an issue with testing the last segment when encrypting. The additional part produced by AEAD wasn't tested. Similarly, on decryption the additional part of the AEAD input is mistaken for corruption. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* async_tx: fix missing braces in async_xor_zero_sumDan Williams2008-08-05
| | | | | Found-by: Yuri Tikhonov <yur@emcraft.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
* Merge branch 'for-linus' of ↵Linus Torvalds2008-07-23
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx: (24 commits) I/OAT: I/OAT version 3.0 support I/OAT: tcp_dma_copybreak default value dependent on I/OAT version I/OAT: Add watchdog/reset functionality to ioatdma iop_adma: cleanup iop_chan_xor_slot_count iop_adma: document how to calculate the minimum descriptor pool size iop_adma: directly reclaim descriptors on allocation failure async_tx: make async_tx_test_ack a boolean routine async_tx: remove depend_tx from async_tx_sync_epilog async_tx: export async_tx_quiesce async_tx: fix handling of the "out of descriptor" condition in async_xor async_tx: ensure the xor destination buffer remains dma-mapped async_tx: list_for_each_entry_rcu() cleanup dmaengine: Driver for the Synopsys DesignWare DMA controller dmaengine: Add slave DMA interface dmaengine: add DMA_COMPL_SKIP_{SRC,DEST}_UNMAP flags to control dma unmap dmaengine: Add dma_client parameter to device_alloc_chan_resources dmatest: Simple DMA memcpy test client dmaengine: DMA engine driver for Marvell XOR engine iop-adma: fix platform driver hotplug/coldplug dmaengine: track the number of clients using a channel ... Fixed up conflict in drivers/dca/dca-sysfs.c manually
| * async_tx: remove depend_tx from async_tx_sync_epilogDan Williams2008-07-17
| | | | | | | | | | | | | | | | All callers of async_tx_sync_epilog have called async_tx_quiesce on the depend_tx, so async_tx_sync_epilog need only call the callback to complete the operation. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
| * async_tx: export async_tx_quiesceDan Williams2008-07-17
| | | | | | | | | | | | Replace open coded "wait and acknowledge" instances with async_tx_quiesce. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
| * async_tx: fix handling of the "out of descriptor" condition in async_xorDan Williams2008-07-17
| | | | | | | | | | | | | | | | | | | | | | | | | | Ensure forward progress is made when a dmaengine driver is unable to allocate an xor descriptor by breaking the dependency chain with async_tx_quisce() and issue any pending descriptors. Tested with iop-adma by setting device->max_xor = 2 to force multiple calls to device_prep_dma_xor for each call to async_xor and limiting the descriptor slot pool to 5. Discovered that the minimum descriptor pool size for iop-adma is 2 * iop_chan_xor_slot_cnt(device->max_xor) + 1. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
| * async_tx: ensure the xor destination buffer remains dma-mappedDan Williams2008-07-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When the number of source buffers for an xor operation exceeds the hardware channel maximum async_xor creates a chain of dependent operations. The result of one operation is reused as an input to the next to continue the xor calculation. The destination buffer should remain mapped for the duration of the entire chain. To provide this guarantee the code must no longer be allowed to fallback to the synchronous path as this will preclude the buffer from being unmapped, i.e. the dma-driver will potentially miss the descriptor with !DMA_COMPL_SKIP_DEST_UNMAP. Cc: Neil Brown <neilb@suse.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
| * async_tx: list_for_each_entry_rcu() cleanupLi Zefan2008-07-17
| | | | | | | | | | | | | | In the rcu update side, don't use list_for_each_entry_rcu(). Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
| * async_tx: fix async_memset compile errorDan Williams2008-07-08
| | | | | | | | | | | | | | | | commit 636bdeaa 'dmaengine: ack to flags: make use of the unused bits in the 'ack' field' missed an ->ack conversion in crypto/async_tx/async_memset.c Signed-off-by: Dan Williams <dan.j.williams@intel.com>
* | Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds2008-07-15
|\ \ | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: Revert crypto: prng - Deterministic CPRNG
| * | Revert crypto: prng - Deterministic CPRNGHerbert Xu2008-07-15
| | | | | | | | | | | | | | | | | | This patch is clearly not ready yet for prime time. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | Merge branch 'core/rcu' into core/rcu-for-linusIngo Molnar2008-07-15
|\ \ \ | |/ / |/| |
| * | Merge branch 'linus' into core/rcuIngo Molnar2008-07-11
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: include/linux/rculist.h kernel/rcupreempt.c Signed-off-by: Ingo Molnar <mingo@elte.hu>
| * \ \ Merge branch 'linus' into core/rcuIngo Molnar2008-06-16
| |\ \ \
| * | | | rcu: split list.h and move rcu-protected lists into rculist.hFranck Bui-Huu2008-05-19
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move rcu-protected lists from list.h into a new header file rculist.h. This is done because list are a very used primitive structure all over the kernel and it's currently impossible to include other header files in this list.h without creating some circular dependencies. For example, list.h implements rcu-protected list and uses rcu_dereference() without including rcupdate.h. It actually compiles because users of rcu_dereference() are macros. Others RCU functions could be used too but aren't probably because of this. Therefore this patch creates rculist.h which includes rcupdates without to many changes/troubles. Signed-off-by: Franck Bui-Huu <fbuihuu@gmail.com> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Acked-by: Josh Triplett <josh@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Ingo Molnar <mingo@elte.hu>
* | | | crypto: hash - Move ahash functions into crypto/hash.hHerbert Xu2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All new crypto interfaces should go into individual files as much as possible in order to ensure that crypto.h does not collapse under its own weight. This patch moves the ahash code into crypto/hash.h and crypto/internal/hash.h respectively. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | crypto: crc32c - Add ahash implementationHerbert Xu2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch reimplements crc32c using the ahash interface. This allows one tfm to be used by an unlimited number of users provided that they all use the same key (which all current crc32c users do). Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | crypto: hash - Added scatter list walking helperHerbert Xu2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the walking helpers for hash algorithms akin to those of block ciphers. This is a necessary step before we can reimplement existing hash algorithms using the new ahash interface. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | crypto: prng - Deterministic CPRNGNeil Horman2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a cryptographic pseudo-random number generator based on CTR(AES-128). It is meant to be used in cases where a deterministic CPRNG is required. One of the first applications will be as an input in the IPsec IV generation process. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | crypto: hash - Removed vestigial ahash fieldsHerbert Xu2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The base field in ahash_tfm appears to have been cut-n-pasted from ablkcipher. It isn't needed here at all. Similarly, the info field in ahash_request also appears to have originated from its cipher counter-part and is vestigial. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | crypto: hash - Fixed digest size checkHerbert Xu2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The digest size check on hash algorithms is incorrect. It's perfectly valid for hash algorithms to have a digest length longer than their block size. For example crc32c has a block size of 1 and a digest size of 4. Rather than having it lie about its block size, this patch fixes the checks to do what they really should which is to bound the digest size so that code placing the digest on the stack continue to work. HMAC however still needs to check this as it's only defined for such algorithms. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | crypto: rmd - sparse annotationsHarvey Harrison2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similar to the rmd128.c annotations, significantly cuts down on the noise. Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | crypto: rmd128 - sparse annotationsHarvey Harrison2008-07-10
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | crypto: camellia - Use kernel-provided bitops, unaligned access helpersHarvey Harrison2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the private implementation of 32-bit rotation and unaligned access with byteswapping. As a bonus, fixes sparse warnings: crypto/camellia.c:602:2: warning: cast to restricted __be32 crypto/camellia.c:603:2: warning: cast to restricted __be32 crypto/camellia.c:604:2: warning: cast to restricted __be32 crypto/camellia.c:605:2: warning: cast to restricted __be32 crypto/camellia.c:710:2: warning: cast to restricted __be32 crypto/camellia.c:711:2: warning: cast to restricted __be32 crypto/camellia.c:712:2: warning: cast to restricted __be32 crypto/camellia.c:713:2: warning: cast to restricted __be32 crypto/camellia.c:714:2: warning: cast to restricted __be32 crypto/camellia.c:715:2: warning: cast to restricted __be32 crypto/camellia.c:716:2: warning: cast to restricted __be32 crypto/camellia.c:717:2: warning: cast to restricted __be32 Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | crypto: tcrpyt - Remove unnecessary kmap/kunmap callsHerbert Xu2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Noticed by Neil Horman: we are doing unnecessary kmap/kunmap calls on kmalloced memory. This patch removes them. For the purposes of testing SG construction, the underlying crypto code already does plenty of kmap/kunmap calls anyway. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] tcrypt: Add self test for des3_ebe cipher operating in cbc modeNeil Horman2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch to add checking of DES3 test vectors using CBC mode. FIPS-140-2 compliance mandates that any supported mode of operation must include a self test. This satisfies that requirement for cbc(des3_ede). The included test vector was generated by me using openssl. Key/IV was generated with the following command: openssl enc -des_ede_cbc -P input and output values were generated by repeating the string "Too many secrets" a few times over, truncating it to 128 bytes, and encrypting it with openssl using the aformentioned key. Tested successfully by myself Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] rmd: Use pointer form of endian swapping operationsHerbert Xu2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch converts the relevant code in the rmd implementations to use the pointer form of the endian swapping operations. This allows certain architectures to generate more optimised code. For example, on sparc64 this more than halves the CPU cycles on a typical hashing operation. Based on a patch by David Miller. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] rmd320: Fix endian issuesAdrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes endian issues making rmd320 work properly on big-endian machines. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Acked-by: Sebastian Siewior <sebastian@breakpoint.cc> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] rmd256: Fix endian issuesAdrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes endian issues making rmd256 work properly on big-endian machines. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Acked-by: Sebastian Siewior <sebastian@breakpoint.cc> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] rmd160: Fix endian issuesAdrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes endian issues making rmd160 work properly on big-endian machines. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Acked-by: Sebastian Siewior <sebastian@breakpoint.cc> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] rmd128: Fix endian problemsAdrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is based on Sebastian Siewior's patch and fixes endian issues making rmd128 work properly on big-endian machines. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Acked-by: Sebastian Siewior <sebastian@breakpoint.cc> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] tcrypt: Use asynchronous hash interfaceLoc Ho2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch changes tcrypt to use the new asynchronous hash interface for testing hash algorithm correctness. The speed tests will continue to use the existing interface for now. Signed-off-by: Loc Ho <lho@amcc.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] cryptd: Add asynchronous hash supportLoc Ho2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds asynchronous hash support to crypto daemon. Signed-off-by: Loc Ho <lho@amcc.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] hash: Add asynchronous hash supportLoc Ho2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds asynchronous hash and digest support. Signed-off-by: Loc Ho <lho@amcc.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] ripemd: Add Kconfig entries for extended RIPEMD hash algorithmsAdrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds Kconfig entries for RIPEMD-256 and RIPEMD-320. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] tcrypt: Add test vectors for RIPEMD-256 and RIPEMD-320Adrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds test vectors for RIPEMD-256 and RIPEMD-320 hash algorithms. The test vectors are taken from <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html> Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] ripemd: Add support for RIPEMD-256 and RIPEMD-320Adrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for the extended RIPEMD hash algorithms RIPEMD-256 and RIPEMD-320. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] ripemd: Put all common RIPEMD values in header fileAdrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch puts all common RIPEMD values in the appropriate header file. Initial values and constants are the same for all variants of RIPEMD. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] tcrypt: Catch cipher destination memory corruptionPatrick McHardy2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check whether the destination buffer is written to beyond the last byte contained in the scatterlist. Also change IDX1 of the cross-page access offsets to a multiple of 4. This triggers a corruption in the HIFN driver and doesn't seem to negatively impact other testcases. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] tcrpyt: Get rid of change log in sourceHerbert Xu2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change logs should be kept in source control systems, not the source. This patch removes the change log from tcrpyt to stop people from extending it any more. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] ripemd: Add Kconfig entries for RIPEMD hash algorithmsAdrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds Kconfig entries for RIPEMD-128 and RIPEMD-160. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] tcrypt: Add test vectors for RIPEMD-128 and RIPEMD-160Adrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds test vectors for RIPEMD-128 and RIPEMD-160 hash algorithms and digests (HMAC). The test vectors are taken from ISO:IEC 10118-3 (2004) and RFC2286. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] ripemd: Add support for RIPEMD hash algorithmsAdrian-Ken Rueegsegger2008-07-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for RIPEMD-128 and RIPEMD-160 hash algorithms. Signed-off-by: Adrian-Ken Rueegsegger <rueegsegger@swiss-it.ch> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | | [CRYPTO] cryptd: Fix EINPROGRESS notification contextHerbert Xu2008-07-10
| |_|/ |/| | | | | | | | | | | | | | | | | | | | The EINPROGRESS notifications should be done just like the final call-backs, i.e., with BH off. This patch fixes the call in cryptd since previously it was called with BH on. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | crypto: chainiv - Invoke completion functionHerbert Xu2008-07-10
| | | | | | | | | | | | | | | | | | | | | When chainiv postpones requests it never calls their completion functions. This causes symptoms such as memory leaks when IPsec is in use. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | | crypto: tcrypt - Fix memory leak in test_cipherDarren Jenkins2008-07-08
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity CID: 2306 & 2307 RESOURCE_LEAK In the second for loop in test_cipher(), data is allocated space with kzalloc() and is only ever freed in an error case. Looking at this loop, data is written to this memory but nothing seems to read from it. So here is a patch removing the allocation, I think this is the right fix. Only compile tested. Signed-off-by: Darren Jenkins <darrenrjenkins@gmailcom> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | [CRYPTO] cts: Init SG tablesAlexey Dobriyan2008-06-02
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Steps to reproduce: modprobe tcrypt # with CONFIG_DEBUG_SG=y testing cts(cbc(aes)) encryption test 1 (128 bit key): ------------[ cut here ]------------ kernel BUG at include/linux/scatterlist.h:65! invalid opcode: 0000 [1] PREEMPT SMP DEBUG_PAGEALLOC CPU 0 Modules linked in: tea xts twofish twofish_common tcrypt(+) [maaaany] Pid: 16151, comm: modprobe Not tainted 2.6.26-rc4-fat #7 RIP: 0010:[<ffffffffa0bf032e>] [<ffffffffa0bf032e>] :cts:cts_cbc_encrypt+0x151/0x355 RSP: 0018:ffff81016f497a88 EFLAGS: 00010286 RAX: ffffe20009535d58 RBX: ffff81016f497af0 RCX: 0000000087654321 RDX: ffff8100010d4f28 RSI: ffff81016f497ee8 RDI: ffff81016f497ac0 RBP: ffff81016f497c38 R08: 0000000000000000 R09: 0000000000000011 R10: ffffffff00000008 R11: ffff8100010d4f28 R12: ffff81016f497ac0 R13: ffff81016f497b30 R14: 0000000000000010 R15: 0000000000000010 FS: 00007fac6fa276f0(0000) GS:ffffffff8060e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00007f12ca7cc000 CR3: 000000016f441000 CR4: 00000000000026e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400 Process modprobe (pid: 16151, threadinfo ffff81016f496000, task ffff8101755b4ae0) Stack: 0000000000000001 ffff81016f496000 ffffffff80719f78 0000000000000001 0000000000000001 ffffffff8020c87c ffff81016f99c918 20646c756f772049 65687420656b696c 0000000000000020 0000000000000000 0000000033341102 Call Trace: [<ffffffff8020c87c>] ? restore_args+0x0/0x30 [<ffffffffa04aa311>] ? :aes_generic:crypto_aes_expand_key+0x311/0x369 [<ffffffff802ab453>] ? check_object+0x15a/0x213 [<ffffffff802aad22>] ? init_object+0x6e/0x76 [<ffffffff802ac3ae>] ? __slab_free+0xfc/0x371 [<ffffffffa0bf05ed>] :cts:crypto_cts_encrypt+0xbb/0xca [<ffffffffa07108de>] ? :crypto_blkcipher:setkey+0xc7/0xec [<ffffffffa07110b8>] :crypto_blkcipher:async_encrypt+0x38/0x3a [<ffffffffa2ce9341>] :tcrypt:test_cipher+0x261/0x7c6 [<ffffffffa2cfd9df>] :tcrypt:tcrypt_mod_init+0x9df/0x1b30 [<ffffffff80261e35>] sys_init_module+0x9e/0x1b2 [<ffffffff8020c15a>] system_call_after_swapgs+0x8a/0x8f Code: 45 c0 e8 aa 24 63 df 48 c1 e8 0c 48 b9 00 00 00 00 00 e2 ff ff 48 8b 55 88 48 6b c0 68 48 01 c8 b9 21 43 65 87 48 39 4d 80 74 04 <0f> 0b eb fe f6 c2 01 74 04 0f 0b eb fe 83 e2 03 4c 89 ef 44 89 RIP [<ffffffffa0bf032e>] :cts:cts_cbc_encrypt+0x151/0x355 RSP <ffff81016f497a88> ---[ end trace e8bahiarjand37fd ]--- Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* [CRYPTO] hmac: Avoid calling virt_to_page on keyHerbert Xu2008-05-07
| | | | | | | | | | | | | | When HMAC gets a key longer than the block size of the hash, it needs to feed it as input to the hash to reduce it to a fixed length. As it is HMAC converts the key to a scatter and gather list. However, this doesn't work on certain platforms if the key is not allocated via kmalloc. For example, the keys from tcrypt are stored in the rodata section and this causes it to fail with HMAC on x86-64. This patch fixes this by copying the key to memory obtained via kmalloc before hashing it. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
generated by cgit v1.2.2 (git 2.25.0) at 2024-12-18 12:29:16 -0500