From patchwork Tue Jul 23 13:20:16 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Horia Geanta X-Patchwork-Id: 169531 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp8869653ilk; Tue, 23 Jul 2019 06:20:26 -0700 (PDT) X-Google-Smtp-Source: APXvYqwQy0hn7682jaPgIHNTyCrlU3J2z2vLjW2z4VAxLgd7ck4iR8pjUBJMzR6WWbcWq7Zgt/a8 X-Received: by 2002:a62:b408:: with SMTP id h8mr5623636pfn.46.1563888026200; Tue, 23 Jul 2019 06:20:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563888026; cv=none; d=google.com; s=arc-20160816; b=lkgmHIUBXc7yCdXjnboXoPqazJXOp9kOcbX3jHJ/p9iW4N+9i7DDRxcnCQLDMwSoG3 PYiijzrYhpvhvH+CC+zs/NZE5tapjx3KZFLFESRzaAghACzEiQRt+cwFBdJzjkxvqqe5 tpouXOMSIA2xODUB5vhn7PMzCCS9E4kTlXZwQ6o1hkldykWvSwsJT5P6Elz8KIFnOidb WabfLKl49Jhay/QfIXG2zJln/yLOQXd2oud5CIixcf4+LEUv0hjjpbMhq5NznMwdf8vv OsND5fBJDd93V93sn7nvCqPJLW1LKri2J6U+DT65d5haI7/rhQRQCNzPo8al0Q/dHIET wgVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=sa9nnq7qoc4JRg1ExWcennHPA1cf0m+NX7DIoaKTdgM=; b=kf4YmGTwo6jhiRlR7PmcwIgAaXbiRmvyUUny6AWk63Y6WbNwqMK8toS+IM89R5iUeK IRgA1dqfTdJJJQ+ILLYcWFVlkUgRFmPwBVDfYFjmSCh8tQvKip+0+fy3UicmrIeZXTe4 sfBNP6fvhCTnf0eWF7dQ0W+R13Gqs3Zk2zuQoYSbUf/xLncs+C+bZsptaZvmSsNMrljo bpk1saPcwcTyFhSQsyJ0h2o10YQPKGNnY46duQOD/iKyDM4aL2Bl09vnr+2dg58txEYb fpfJ7loubwpo7HOB/aJEIKXhivo+ocan7b7xZvDyFEe/SarwCR3tK/5ykTUpAbHNB2a2 e6bg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=nxp.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id t9si12132350pjw.22.2019.07.23.06.20.25; Tue, 23 Jul 2019 06:20:26 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=nxp.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726357AbfGWNUZ (ORCPT + 14 others); Tue, 23 Jul 2019 09:20:25 -0400 Received: from inva021.nxp.com ([92.121.34.21]:49886 "EHLO inva021.nxp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725778AbfGWNUZ (ORCPT ); Tue, 23 Jul 2019 09:20:25 -0400 Received: from inva021.nxp.com (localhost [127.0.0.1]) by inva021.eu-rdc02.nxp.com (Postfix) with ESMTP id DA3632002A4; Tue, 23 Jul 2019 15:20:22 +0200 (CEST) Received: from inva024.eu-rdc02.nxp.com (inva024.eu-rdc02.nxp.com [134.27.226.22]) by inva021.eu-rdc02.nxp.com (Postfix) with ESMTP id CD1672002F2; Tue, 23 Jul 2019 15:20:22 +0200 (CEST) Received: from fsr-ub1864-014.ea.freescale.net (fsr-ub1864-014.ea.freescale.net [10.171.95.219]) by inva024.eu-rdc02.nxp.com (Postfix) with ESMTP id 80618205EE; Tue, 23 Jul 2019 15:20:22 +0200 (CEST) From: =?utf-8?q?Horia_Geant=C4=83?= To: stable@vger.kernel.org, Ard Biesheuvel , Herbert Xu , Iuliana Prodan , Sascha Hauer Cc: gregkh@linuxfoundation.org Subject: [PATCH 4.14, 4.19] crypto: caam - limit output IV to CBC to work around CTR mode DMA issue Date: Tue, 23 Jul 2019 16:20:16 +0300 Message-Id: <20190723132016.27993-1-horia.geanta@nxp.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ard Biesheuvel commit ed527b13d800dd515a9e6c582f0a73eca65b2e1b upstream. The CAAM driver currently violates an undocumented and slightly controversial requirement imposed by the crypto stack that a buffer referred to by the request structure via its virtual address may not be modified while any scatterlists passed via the same request structure are mapped for inbound DMA. This may result in errors like alg: aead: decryption failed on test 1 for gcm_base(ctr-aes-caam,ghash-generic): ret=74 alg: aead: Failed to load transform for gcm(aes): -2 on non-cache coherent systems, due to the fact that the GCM driver passes an IV buffer by virtual address which shares a cacheline with the auth_tag buffer passed via a scatterlist, resulting in corruption of the auth_tag when the IV is updated while the DMA mapping is live. Since the IV that is returned to the caller is only valid for CBC mode, and given that the in-kernel users of CBC (such as CTS) don't trigger the same issue as the GCM driver, let's just disable the output IV generation for all modes except CBC for the time being. Fixes: 854b06f76879 ("crypto: caam - properly set IV after {en,de}crypt") Cc: Horia Geanta Cc: Iuliana Prodan Reported-by: Sascha Hauer Cc: Signed-off-by: Ard Biesheuvel Reviewed-by: Horia Geanta Signed-off-by: Herbert Xu [ Horia: backported to 4.14, 4.19 ] Signed-off-by: Horia Geantă --- drivers/crypto/caam/caamalg.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) -- 2.17.1 diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c index 9bc54c3c2cb9..1907945f82b7 100644 --- a/drivers/crypto/caam/caamalg.c +++ b/drivers/crypto/caam/caamalg.c @@ -887,6 +887,7 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err, struct ablkcipher_request *req = context; struct ablkcipher_edesc *edesc; struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); + struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher); int ivsize = crypto_ablkcipher_ivsize(ablkcipher); #ifdef DEBUG @@ -911,10 +912,11 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err, /* * The crypto API expects us to set the IV (req->info) to the last - * ciphertext block. This is used e.g. by the CTS mode. + * ciphertext block when running in CBC mode. */ - scatterwalk_map_and_copy(req->info, req->dst, req->nbytes - ivsize, - ivsize, 0); + if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC) + scatterwalk_map_and_copy(req->info, req->dst, req->nbytes - + ivsize, ivsize, 0); /* In case initial IV was generated, copy it in GIVCIPHER request */ if (edesc->iv_dir == DMA_FROM_DEVICE) { @@ -1651,10 +1653,11 @@ static int ablkcipher_decrypt(struct ablkcipher_request *req) /* * The crypto API expects us to set the IV (req->info) to the last - * ciphertext block. + * ciphertext block when running in CBC mode. */ - scatterwalk_map_and_copy(req->info, req->src, req->nbytes - ivsize, - ivsize, 0); + if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC) + scatterwalk_map_and_copy(req->info, req->src, req->nbytes - + ivsize, ivsize, 0); /* Create and submit job descriptor*/ init_ablkcipher_job(ctx->sh_desc_dec, ctx->sh_desc_dec_dma, edesc, req);