Skip to content

Commit ecaaab5

Browse files
ebiggersherbertx
authored andcommitted
crypto: salsa20 - fix blkcipher_walk API usage
When asked to encrypt or decrypt 0 bytes, both the generic and x86 implementations of Salsa20 crash in blkcipher_walk_done(), either when doing 'kfree(walk->buffer)' or 'free_page((unsigned long)walk->page)', because walk->buffer and walk->page have not been initialized. The bug is that Salsa20 is calling blkcipher_walk_done() even when nothing is in 'walk.nbytes'. But blkcipher_walk_done() is only meant to be called when a nonzero number of bytes have been provided. The broken code is part of an optimization that tries to make only one call to salsa20_encrypt_bytes() to process inputs that are not evenly divisible by 64 bytes. To fix the bug, just remove this "optimization" and use the blkcipher_walk API the same way all the other users do. Reproducer: #include <linux/if_alg.h> #include <sys/socket.h> #include <unistd.h> int main() { int algfd, reqfd; struct sockaddr_alg addr = { .salg_type = "skcipher", .salg_name = "salsa20", }; char key[16] = { 0 }; algfd = socket(AF_ALG, SOCK_SEQPACKET, 0); bind(algfd, (void *)&addr, sizeof(addr)); reqfd = accept(algfd, 0, 0); setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key)); read(reqfd, key, sizeof(key)); } Reported-by: syzbot <syzkaller@googlegroups.com> Fixes: eb6f13e ("[CRYPTO] salsa20_generic: Fix multi-page processing") Cc: <stable@vger.kernel.org> # v2.6.25+ Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
1 parent af3ff80 commit ecaaab5

File tree

2 files changed

+0
-14
lines changed

2 files changed

+0
-14
lines changed

Diff for: arch/x86/crypto/salsa20_glue.c

-7
Original file line numberDiff line numberDiff line change
@@ -59,13 +59,6 @@ static int encrypt(struct blkcipher_desc *desc,
5959

6060
salsa20_ivsetup(ctx, walk.iv);
6161

62-
if (likely(walk.nbytes == nbytes))
63-
{
64-
salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
65-
walk.dst.virt.addr, nbytes);
66-
return blkcipher_walk_done(desc, &walk, 0);
67-
}
68-
6962
while (walk.nbytes >= 64) {
7063
salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
7164
walk.dst.virt.addr,

Diff for: crypto/salsa20_generic.c

-7
Original file line numberDiff line numberDiff line change
@@ -188,13 +188,6 @@ static int encrypt(struct blkcipher_desc *desc,
188188

189189
salsa20_ivsetup(ctx, walk.iv);
190190

191-
if (likely(walk.nbytes == nbytes))
192-
{
193-
salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
194-
walk.src.virt.addr, nbytes);
195-
return blkcipher_walk_done(desc, &walk, 0);
196-
}
197-
198191
while (walk.nbytes >= 64) {
199192
salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
200193
walk.src.virt.addr,

0 commit comments

Comments
 (0)