[mirror_ubuntu-bionic-kernel.git] / crypto / rsa-pkcs1pad.c

/*
 * RSA padding templates.
 *
 * Copyright (c) 2015  Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the Free
 * Software Foundation; either version 2 of the License, or (at your option)
 * any later version.
 */

#include <crypto/algapi.h>
#include <crypto/akcipher.h>
#include <crypto/internal/akcipher.h>
#include <linux/err.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/random.h>

/*
 * Hash algorithm OIDs plus ASN.1 DER wrappings [RFC4880 sec 5.2.2].
 */
static const u8 rsa_digest_info_md5[] = {
	0x30, 0x20, 0x30, 0x0c, 0x06, 0x08,
	0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, /* OID */
	0x05, 0x00, 0x04, 0x10
};

static const u8 rsa_digest_info_sha1[] = {
	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
	0x2b, 0x0e, 0x03, 0x02, 0x1a,
	0x05, 0x00, 0x04, 0x14
};

static const u8 rsa_digest_info_rmd160[] = {
	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
	0x2b, 0x24, 0x03, 0x02, 0x01,
	0x05, 0x00, 0x04, 0x14
};

static const u8 rsa_digest_info_sha224[] = {
	0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
	0x05, 0x00, 0x04, 0x1c
};

static const u8 rsa_digest_info_sha256[] = {
	0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
	0x05, 0x00, 0x04, 0x20
};

static const u8 rsa_digest_info_sha384[] = {
	0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
	0x05, 0x00, 0x04, 0x30
};

static const u8 rsa_digest_info_sha512[] = {
	0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
	0x05, 0x00, 0x04, 0x40
};

static const struct rsa_asn1_template {
	const char	*name;
	const u8	*data;
	size_t		size;
} rsa_asn1_templates[] = {
#define _(X) { #X, rsa_digest_info_##X, sizeof(rsa_digest_info_##X) }
	_(md5),
	_(sha1),
	_(rmd160),
	_(sha256),
	_(sha384),
	_(sha512),
	_(sha224),
	{ NULL }
#undef _
};

static const struct rsa_asn1_template *rsa_lookup_asn1(const char *name)
{
	const struct rsa_asn1_template *p;

	for (p = rsa_asn1_templates; p->name; p++)
		if (strcmp(name, p->name) == 0)
			return p;
	return NULL;
}

struct pkcs1pad_ctx {
	struct crypto_akcipher *child;
	unsigned int key_size;
};

struct pkcs1pad_inst_ctx {
	struct crypto_akcipher_spawn spawn;
	const struct rsa_asn1_template *digest_info;
};

struct pkcs1pad_request {
	struct scatterlist in_sg[2], out_sg[1];
	uint8_t *in_buf, *out_buf;
	struct akcipher_request child_req;
};

static int pkcs1pad_set_pub_key(struct crypto_akcipher *tfm, const void *key,
		unsigned int keylen)
{
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	int err;

	ctx->key_size = 0;

	err = crypto_akcipher_set_pub_key(ctx->child, key, keylen);
	if (err)
		return err;

	/* Find out new modulus size from rsa implementation */
	err = crypto_akcipher_maxsize(ctx->child);
	if (err > PAGE_SIZE)
		return -ENOTSUPP;

	ctx->key_size = err;
	return 0;
}

static int pkcs1pad_set_priv_key(struct crypto_akcipher *tfm, const void *key,
		unsigned int keylen)
{
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	int err;

	ctx->key_size = 0;

	err = crypto_akcipher_set_priv_key(ctx->child, key, keylen);
	if (err)
		return err;

	/* Find out new modulus size from rsa implementation */
	err = crypto_akcipher_maxsize(ctx->child);
	if (err > PAGE_SIZE)
		return -ENOTSUPP;

	ctx->key_size = err;
	return 0;
}

static unsigned int pkcs1pad_get_max_size(struct crypto_akcipher *tfm)
{
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);

	/*
	 * The maximum destination buffer size for the encrypt/sign operations
	 * will be the same as for RSA, even though it's smaller for
	 * decrypt/verify.
	 */

	return ctx->key_size;
}

static void pkcs1pad_sg_set_buf(struct scatterlist *sg, void *buf, size_t len,
		struct scatterlist *next)
{
	int nsegs = next ? 2 : 1;

	sg_init_table(sg, nsegs);
	sg_set_buf(sg, buf, len);

	if (next)
		sg_chain(sg, nsegs, next);
}

static int pkcs1pad_encrypt_sign_complete(struct akcipher_request *req, int err)
{
	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	unsigned int pad_len;
	unsigned int len;
	u8 *out_buf;

	if (err)
		goto out;

	len = req_ctx->child_req.dst_len;
	pad_len = ctx->key_size - len;

	/* Four billion to one */
	if (likely(!pad_len))
		goto out;

	out_buf = kzalloc(ctx->key_size, GFP_ATOMIC);
	err = -ENOMEM;
	if (!out_buf)
		goto out;

	sg_copy_to_buffer(req->dst, sg_nents_for_len(req->dst, len),
			  out_buf + pad_len, len);
	sg_copy_from_buffer(req->dst,
			    sg_nents_for_len(req->dst, ctx->key_size),
			    out_buf, ctx->key_size);
	kzfree(out_buf);

out:
	req->dst_len = ctx->key_size;

	kfree(req_ctx->in_buf);

	return err;
}

static void pkcs1pad_encrypt_sign_complete_cb(
		struct crypto_async_request *child_async_req, int err)
{
	struct akcipher_request *req = child_async_req->data;
	struct crypto_async_request async_req;

	if (err == -EINPROGRESS)
		return;

	async_req.data = req->base.data;
	async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
	async_req.flags = child_async_req->flags;
	req->base.complete(&async_req,
			pkcs1pad_encrypt_sign_complete(req, err));
}

static int pkcs1pad_encrypt(struct akcipher_request *req)
{
	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	int err;
	unsigned int i, ps_end;

	if (!ctx->key_size)
		return -EINVAL;

	if (req->src_len > ctx->key_size - 11)
		return -EOVERFLOW;

	if (req->dst_len < ctx->key_size) {
		req->dst_len = ctx->key_size;
		return -EOVERFLOW;
	}

	req_ctx->in_buf = kmalloc(ctx->key_size - 1 - req->src_len,
				  GFP_KERNEL);
	if (!req_ctx->in_buf)
		return -ENOMEM;

	ps_end = ctx->key_size - req->src_len - 2;
	req_ctx->in_buf[0] = 0x02;
	for (i = 1; i < ps_end; i++)
		req_ctx->in_buf[i] = 1 + prandom_u32_max(255);
	req_ctx->in_buf[ps_end] = 0x00;

	pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
			ctx->key_size - 1 - req->src_len, req->src);

	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
			pkcs1pad_encrypt_sign_complete_cb, req);

	/* Reuse output buffer */
	akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,
				   req->dst, ctx->key_size - 1, req->dst_len);

	err = crypto_akcipher_encrypt(&req_ctx->child_req);
	if (err != -EINPROGRESS && err != -EBUSY)
		return pkcs1pad_encrypt_sign_complete(req, err);

	return err;
}

static int pkcs1pad_decrypt_complete(struct akcipher_request *req, int err)
{
	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	unsigned int dst_len;
	unsigned int pos;
	u8 *out_buf;

	if (err)
		goto done;

	err = -EINVAL;
	dst_len = req_ctx->child_req.dst_len;
	if (dst_len < ctx->key_size - 1)
		goto done;

	out_buf = req_ctx->out_buf;
	if (dst_len == ctx->key_size) {
		if (out_buf[0] != 0x00)
			/* Decrypted value had no leading 0 byte */
			goto done;

		dst_len--;
		out_buf++;
	}

	if (out_buf[0] != 0x02)
		goto done;

	for (pos = 1; pos < dst_len; pos++)
		if (out_buf[pos] == 0x00)
			break;
	if (pos < 9 || pos == dst_len)
		goto done;
	pos++;

	err = 0;

	if (req->dst_len < dst_len - pos)
		err = -EOVERFLOW;
	req->dst_len = dst_len - pos;

	if (!err)
		sg_copy_from_buffer(req->dst,
				sg_nents_for_len(req->dst, req->dst_len),
				out_buf + pos, req->dst_len);

done:
	kzfree(req_ctx->out_buf);

	return err;
}

static void pkcs1pad_decrypt_complete_cb(
		struct crypto_async_request *child_async_req, int err)
{
	struct akcipher_request *req = child_async_req->data;
	struct crypto_async_request async_req;

	if (err == -EINPROGRESS)
		return;

	async_req.data = req->base.data;
	async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
	async_req.flags = child_async_req->flags;
	req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err));
}

static int pkcs1pad_decrypt(struct akcipher_request *req)
{
	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	int err;

	if (!ctx->key_size || req->src_len != ctx->key_size)
		return -EINVAL;

	req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL);
	if (!req_ctx->out_buf)
		return -ENOMEM;

	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
			    ctx->key_size, NULL);

	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
			pkcs1pad_decrypt_complete_cb, req);

	/* Reuse input buffer, output to a new buffer */
	akcipher_request_set_crypt(&req_ctx->child_req, req->src,
				   req_ctx->out_sg, req->src_len,
				   ctx->key_size);

	err = crypto_akcipher_decrypt(&req_ctx->child_req);
	if (err != -EINPROGRESS && err != -EBUSY)
		return pkcs1pad_decrypt_complete(req, err);

	return err;
}

static int pkcs1pad_sign(struct akcipher_request *req)
{
	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
	const struct rsa_asn1_template *digest_info = ictx->digest_info;
	int err;
	unsigned int ps_end, digest_size = 0;

	if (!ctx->key_size)
		return -EINVAL;

	digest_size = digest_info->size;

	if (req->src_len + digest_size > ctx->key_size - 11)
		return -EOVERFLOW;

	if (req->dst_len < ctx->key_size) {
		req->dst_len = ctx->key_size;
		return -EOVERFLOW;
	}

	req_ctx->in_buf = kmalloc(ctx->key_size - 1 - req->src_len,
				  GFP_KERNEL);
	if (!req_ctx->in_buf)
		return -ENOMEM;

	ps_end = ctx->key_size - digest_size - req->src_len - 2;
	req_ctx->in_buf[0] = 0x01;
	memset(req_ctx->in_buf + 1, 0xff, ps_end - 1);
	req_ctx->in_buf[ps_end] = 0x00;

	memcpy(req_ctx->in_buf + ps_end + 1, digest_info->data,
	       digest_info->size);

	pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
			ctx->key_size - 1 - req->src_len, req->src);

	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
			pkcs1pad_encrypt_sign_complete_cb, req);

	/* Reuse output buffer */
	akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,
				   req->dst, ctx->key_size - 1, req->dst_len);

	err = crypto_akcipher_sign(&req_ctx->child_req);
	if (err != -EINPROGRESS && err != -EBUSY)
		return pkcs1pad_encrypt_sign_complete(req, err);

	return err;
}

static int pkcs1pad_verify_complete(struct akcipher_request *req, int err)
{
	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
	const struct rsa_asn1_template *digest_info = ictx->digest_info;
	unsigned int dst_len;
	unsigned int pos;
	u8 *out_buf;

	if (err)
		goto done;

	err = -EINVAL;
	dst_len = req_ctx->child_req.dst_len;
	if (dst_len < ctx->key_size - 1)
		goto done;

	out_buf = req_ctx->out_buf;
	if (dst_len == ctx->key_size) {
		if (out_buf[0] != 0x00)
			/* Decrypted value had no leading 0 byte */
			goto done;

		dst_len--;
		out_buf++;
	}

	err = -EBADMSG;
	if (out_buf[0] != 0x01)
		goto done;

	for (pos = 1; pos < dst_len; pos++)
		if (out_buf[pos] != 0xff)
			break;

	if (pos < 9 || pos == dst_len || out_buf[pos] != 0x00)
		goto done;
	pos++;

	if (crypto_memneq(out_buf + pos, digest_info->data, digest_info->size))
		goto done;

	pos += digest_info->size;

	err = 0;

	if (req->dst_len < dst_len - pos)
		err = -EOVERFLOW;
	req->dst_len = dst_len - pos;

	if (!err)
		sg_copy_from_buffer(req->dst,
				sg_nents_for_len(req->dst, req->dst_len),
				out_buf + pos, req->dst_len);
done:
	kzfree(req_ctx->out_buf);

	return err;
}

static void pkcs1pad_verify_complete_cb(
		struct crypto_async_request *child_async_req, int err)
{
	struct akcipher_request *req = child_async_req->data;
	struct crypto_async_request async_req;

	if (err == -EINPROGRESS)
		return;

	async_req.data = req->base.data;
	async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
	async_req.flags = child_async_req->flags;
	req->base.complete(&async_req, pkcs1pad_verify_complete(req, err));
}

/*
 * The verify operation is here for completeness similar to the verification
 * defined in RFC2313 section 10.2 except that block type 0 is not accepted,
 * as in RFC2437.  RFC2437 section 9.2 doesn't define any operation to
 * retrieve the DigestInfo from a signature, instead the user is expected
 * to call the sign operation to generate the expected signature and compare
 * signatures instead of the message-digests.
 */
static int pkcs1pad_verify(struct akcipher_request *req)
{
	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	int err;

	if (!ctx->key_size || req->src_len < ctx->key_size)
		return -EINVAL;

	req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL);
	if (!req_ctx->out_buf)
		return -ENOMEM;

	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
			    ctx->key_size, NULL);

	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
			pkcs1pad_verify_complete_cb, req);

	/* Reuse input buffer, output to a new buffer */
	akcipher_request_set_crypt(&req_ctx->child_req, req->src,
				   req_ctx->out_sg, req->src_len,
				   ctx->key_size);

	err = crypto_akcipher_verify(&req_ctx->child_req);
	if (err != -EINPROGRESS && err != -EBUSY)
		return pkcs1pad_verify_complete(req, err);

	return err;
}

static int pkcs1pad_init_tfm(struct crypto_akcipher *tfm)
{
	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	struct crypto_akcipher *child_tfm;

	child_tfm = crypto_spawn_akcipher(&ictx->spawn);
	if (IS_ERR(child_tfm))
		return PTR_ERR(child_tfm);

	ctx->child = child_tfm;
	return 0;
}

static void pkcs1pad_exit_tfm(struct crypto_akcipher *tfm)
{
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);

	crypto_free_akcipher(ctx->child);
}

static void pkcs1pad_free(struct akcipher_instance *inst)
{
	struct pkcs1pad_inst_ctx *ctx = akcipher_instance_ctx(inst);
	struct crypto_akcipher_spawn *spawn = &ctx->spawn;

	crypto_drop_akcipher(spawn);
	kfree(inst);
}

static int pkcs1pad_create(struct crypto_template *tmpl, struct rtattr **tb)
{
	const struct rsa_asn1_template *digest_info;
	struct crypto_attr_type *algt;
	struct akcipher_instance *inst;
	struct pkcs1pad_inst_ctx *ctx;
	struct crypto_akcipher_spawn *spawn;
	struct akcipher_alg *rsa_alg;
	const char *rsa_alg_name;
	const char *hash_name;
	int err;

	algt = crypto_get_attr_type(tb);
	if (IS_ERR(algt))
		return PTR_ERR(algt);

	if ((algt->type ^ CRYPTO_ALG_TYPE_AKCIPHER) & algt->mask)
		return -EINVAL;

	rsa_alg_name = crypto_attr_alg_name(tb[1]);
	if (IS_ERR(rsa_alg_name))
		return PTR_ERR(rsa_alg_name);

	hash_name = crypto_attr_alg_name(tb[2]);
	if (IS_ERR(hash_name))
		return PTR_ERR(hash_name);

	digest_info = rsa_lookup_asn1(hash_name);
	if (!digest_info)
		return -EINVAL;

	inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
	if (!inst)
		return -ENOMEM;

	ctx = akcipher_instance_ctx(inst);
	spawn = &ctx->spawn;
	ctx->digest_info = digest_info;

	crypto_set_spawn(&spawn->base, akcipher_crypto_instance(inst));
	err = crypto_grab_akcipher(spawn, rsa_alg_name, 0,
			crypto_requires_sync(algt->type, algt->mask));
	if (err)
		goto out_free_inst;

	rsa_alg = crypto_spawn_akcipher_alg(spawn);

	err = -ENAMETOOLONG;

	if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
		     "pkcs1pad(%s,%s)", rsa_alg->base.cra_name, hash_name) >=
	    CRYPTO_MAX_ALG_NAME ||
	    snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
		     "pkcs1pad(%s,%s)",
		     rsa_alg->base.cra_driver_name, hash_name) >=
	    CRYPTO_MAX_ALG_NAME)
		goto out_drop_alg;

	inst->alg.base.cra_flags = rsa_alg->base.cra_flags & CRYPTO_ALG_ASYNC;
	inst->alg.base.cra_priority = rsa_alg->base.cra_priority;
	inst->alg.base.cra_ctxsize = sizeof(struct pkcs1pad_ctx);

	inst->alg.init = pkcs1pad_init_tfm;
	inst->alg.exit = pkcs1pad_exit_tfm;

	inst->alg.encrypt = pkcs1pad_encrypt;
	inst->alg.decrypt = pkcs1pad_decrypt;
	inst->alg.sign = pkcs1pad_sign;
	inst->alg.verify = pkcs1pad_verify;
	inst->alg.set_pub_key = pkcs1pad_set_pub_key;
	inst->alg.set_priv_key = pkcs1pad_set_priv_key;
	inst->alg.max_size = pkcs1pad_get_max_size;
	inst->alg.reqsize = sizeof(struct pkcs1pad_request) + rsa_alg->reqsize;

	inst->free = pkcs1pad_free;

	err = akcipher_register_instance(tmpl, inst);
	if (err)
		goto out_drop_alg;

	return 0;

out_drop_alg:
	crypto_drop_akcipher(spawn);
out_free_inst:
	kfree(inst);
	return err;
}

struct crypto_template rsa_pkcs1pad_tmpl = {
	.name = "pkcs1pad",
	.create = pkcs1pad_create,
	.module = THIS_MODULE,
};
Commit	Line	Data
3d5b1ecd AZ	1	/*
	2	* RSA padding templates.
	3	*
	4	* Copyright (c) 2015 Intel Corporation
	5	*
	6	* This program is free software; you can redistribute it and/or modify it
	7	* under the terms of the GNU General Public License as published by the Free
	8	* Software Foundation; either version 2 of the License, or (at your option)
	9	* any later version.
	10	*/
	11
	12	#include <crypto/algapi.h>
	13	#include <crypto/akcipher.h>
	14	#include <crypto/internal/akcipher.h>
	15	#include <linux/err.h>
	16	#include <linux/init.h>
	17	#include <linux/kernel.h>
	18	#include <linux/module.h>
	19	#include <linux/random.h>
	20
a49de377 TS	21	/*
	22	* Hash algorithm OIDs plus ASN.1 DER wrappings [RFC4880 sec 5.2.2].
	23	*/
	24	static const u8 rsa_digest_info_md5[] = {
	25	0x30, 0x20, 0x30, 0x0c, 0x06, 0x08,
	26	0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, /* OID */
	27	0x05, 0x00, 0x04, 0x10
	28	};
	29
	30	static const u8 rsa_digest_info_sha1[] = {
	31	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
	32	0x2b, 0x0e, 0x03, 0x02, 0x1a,
	33	0x05, 0x00, 0x04, 0x14
	34	};
	35
	36	static const u8 rsa_digest_info_rmd160[] = {
	37	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
	38	0x2b, 0x24, 0x03, 0x02, 0x01,
	39	0x05, 0x00, 0x04, 0x14
	40	};
	41
	42	static const u8 rsa_digest_info_sha224[] = {
	43	0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
	44	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
	45	0x05, 0x00, 0x04, 0x1c
	46	};
	47
	48	static const u8 rsa_digest_info_sha256[] = {
	49	0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
	50	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
	51	0x05, 0x00, 0x04, 0x20
	52	};
	53
	54	static const u8 rsa_digest_info_sha384[] = {
	55	0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
	56	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
	57	0x05, 0x00, 0x04, 0x30
	58	};
	59
	60	static const u8 rsa_digest_info_sha512[] = {
	61	0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
	62	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
	63	0x05, 0x00, 0x04, 0x40
	64	};
	65
	66	static const struct rsa_asn1_template {
	67	const char *name;
	68	const u8 *data;
	69	size_t size;
	70	} rsa_asn1_templates[] = {
	71	#define _(X) { #X, rsa_digest_info_##X, sizeof(rsa_digest_info_##X) }
	72	_(md5),
	73	_(sha1),
	74	_(rmd160),
	75	_(sha256),
	76	_(sha384),
	77	_(sha512),
	78	_(sha224),
	79	{ NULL }
	80	#undef _
	81	};
	82
	83	static const struct rsa_asn1_template rsa_lookup_asn1(const char name)
	84	{
85	const struct rsa_asn1_template *p;
86
87	for (p = rsa_asn1_templates; p->name; p++)
88	if (strcmp(name, p->name) == 0)
89	return p;
90	return NULL;
91	}
92
3d5b1ecd AZ	93	struct pkcs1pad_ctx {
3d5b1ecd AZ	94	struct crypto_akcipher *child;
3d5b1ecd AZ	95	unsigned int key_size;
	96	};
	97
a49de377 TS	98	struct pkcs1pad_inst_ctx {
a49de377 TS	99	struct crypto_akcipher_spawn spawn;
c0d20d22	100	const struct rsa_asn1_template *digest_info;
a49de377 TS	101	};
a49de377 TS	102
3d5b1ecd	103	struct pkcs1pad_request {
0f2c8319	104	struct scatterlist in_sg[2], out_sg[1];
3d5b1ecd	105	uint8_t in_buf, out_buf;
a6d7bfd0	106	struct akcipher_request child_req;
3d5b1ecd AZ	107	};
	108
	109	static int pkcs1pad_set_pub_key(struct crypto_akcipher tfm, const void key,
	110	unsigned int keylen)
	111	{
	112	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
73f79189 HX	113	int err;
	114
	115	ctx->key_size = 0;
3d5b1ecd AZ	116
3d5b1ecd AZ	117	err = crypto_akcipher_set_pub_key(ctx->child, key, keylen);
73f79189 HX	118	if (err)
73f79189 HX	119	return err;
3d5b1ecd	120
73f79189 HX	121	/* Find out new modulus size from rsa implementation */
73f79189 HX	122	err = crypto_akcipher_maxsize(ctx->child);
73f79189 HX	123	if (err > PAGE_SIZE)
73f79189 HX	124	return -ENOTSUPP;
3d5b1ecd	125
73f79189 HX	126	ctx->key_size = err;
73f79189 HX	127	return 0;
3d5b1ecd AZ	128	}
	129
	130	static int pkcs1pad_set_priv_key(struct crypto_akcipher tfm, const void key,
	131	unsigned int keylen)
	132	{
	133	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
73f79189 HX	134	int err;
	135
	136	ctx->key_size = 0;
3d5b1ecd AZ	137
3d5b1ecd AZ	138	err = crypto_akcipher_set_priv_key(ctx->child, key, keylen);
73f79189 HX	139	if (err)
73f79189 HX	140	return err;
3d5b1ecd	141
73f79189 HX	142	/* Find out new modulus size from rsa implementation */
73f79189 HX	143	err = crypto_akcipher_maxsize(ctx->child);
73f79189 HX	144	if (err > PAGE_SIZE)
73f79189 HX	145	return -ENOTSUPP;
3d5b1ecd	146
73f79189 HX	147	ctx->key_size = err;
73f79189 HX	148	return 0;
3d5b1ecd AZ	149	}
3d5b1ecd AZ	150
543de102	151	static unsigned int pkcs1pad_get_max_size(struct crypto_akcipher *tfm)
3d5b1ecd AZ	152	{
	153	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	154
	155	/*
	156	* The maximum destination buffer size for the encrypt/sign operations
	157	* will be the same as for RSA, even though it's smaller for
	158	* decrypt/verify.
	159	*/
	160
543de102	161	return ctx->key_size;
3d5b1ecd AZ	162	}
	163
	164	static void pkcs1pad_sg_set_buf(struct scatterlist sg, void buf, size_t len,
	165	struct scatterlist *next)
	166	{
0f2c8319 HX	167	int nsegs = next ? 2 : 1;
	168
	169	sg_init_table(sg, nsegs);
	170	sg_set_buf(sg, buf, len);
3d5b1ecd AZ	171
	172	if (next)
	173	sg_chain(sg, nsegs, next);
	174	}
	175
	176	static int pkcs1pad_encrypt_sign_complete(struct akcipher_request *req, int err)
	177	{
	178	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	179	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	180	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
d858b071 HX	181	unsigned int pad_len;
	182	unsigned int len;
	183	u8 *out_buf;
	184
	185	if (err)
	186	goto out;
	187
	188	len = req_ctx->child_req.dst_len;
	189	pad_len = ctx->key_size - len;
	190
	191	/* Four billion to one */
	192	if (likely(!pad_len))
	193	goto out;
	194
	195	out_buf = kzalloc(ctx->key_size, GFP_ATOMIC);
	196	err = -ENOMEM;
	197	if (!out_buf)
	198	goto out;
	199
	200	sg_copy_to_buffer(req->dst, sg_nents_for_len(req->dst, len),
	201	out_buf + pad_len, len);
	202	sg_copy_from_buffer(req->dst,
	203	sg_nents_for_len(req->dst, ctx->key_size),
	204	out_buf, ctx->key_size);
	205	kzfree(out_buf);
	206
	207	out:
3d5b1ecd AZ	208	req->dst_len = ctx->key_size;
	209
	210	kfree(req_ctx->in_buf);
3d5b1ecd AZ	211
	212	return err;
	213	}
	214
	215	static void pkcs1pad_encrypt_sign_complete_cb(
	216	struct crypto_async_request *child_async_req, int err)
	217	{
	218	struct akcipher_request *req = child_async_req->data;
	219	struct crypto_async_request async_req;
	220
	221	if (err == -EINPROGRESS)
	222	return;
	223
	224	async_req.data = req->base.data;
	225	async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
	226	async_req.flags = child_async_req->flags;
	227	req->base.complete(&async_req,
	228	pkcs1pad_encrypt_sign_complete(req, err));
	229	}
	230
	231	static int pkcs1pad_encrypt(struct akcipher_request *req)
	232	{
	233	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	234	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	235	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	236	int err;
	237	unsigned int i, ps_end;
	238
	239	if (!ctx->key_size)
	240	return -EINVAL;
	241
	242	if (req->src_len > ctx->key_size - 11)
	243	return -EOVERFLOW;
	244
	245	if (req->dst_len < ctx->key_size) {
	246	req->dst_len = ctx->key_size;
	247	return -EOVERFLOW;
	248	}
	249
3d5b1ecd	250	req_ctx->in_buf = kmalloc(ctx->key_size - 1 - req->src_len,
3a32ce50	251	GFP_KERNEL);
3d5b1ecd AZ	252	if (!req_ctx->in_buf)
	253	return -ENOMEM;
	254
	255	ps_end = ctx->key_size - req->src_len - 2;
	256	req_ctx->in_buf[0] = 0x02;
	257	for (i = 1; i < ps_end; i++)
	258	req_ctx->in_buf[i] = 1 + prandom_u32_max(255);
	259	req_ctx->in_buf[ps_end] = 0x00;
	260
	261	pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
	262	ctx->key_size - 1 - req->src_len, req->src);
	263
3d5b1ecd AZ	264	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
	265	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
	266	pkcs1pad_encrypt_sign_complete_cb, req);
	267
d858b071 HX	268	/* Reuse output buffer */
	269	akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,
	270	req->dst, ctx->key_size - 1, req->dst_len);
	271
3d5b1ecd	272	err = crypto_akcipher_encrypt(&req_ctx->child_req);
4e5b0ad5	273	if (err != -EINPROGRESS && err != -EBUSY)
3d5b1ecd AZ	274	return pkcs1pad_encrypt_sign_complete(req, err);
	275
	276	return err;
	277	}
	278
	279	static int pkcs1pad_decrypt_complete(struct akcipher_request *req, int err)
	280	{
	281	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	282	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	283	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
0cf43f50	284	unsigned int dst_len;
3d5b1ecd	285	unsigned int pos;
0cf43f50	286	u8 *out_buf;
3d5b1ecd AZ	287
	288	if (err)
	289	goto done;
	290
0cf43f50 HX	291	err = -EINVAL;
	292	dst_len = req_ctx->child_req.dst_len;
	293	if (dst_len < ctx->key_size - 1)
3d5b1ecd	294	goto done;
0cf43f50 HX	295
	296	out_buf = req_ctx->out_buf;
	297	if (dst_len == ctx->key_size) {
	298	if (out_buf[0] != 0x00)
	299	/* Decrypted value had no leading 0 byte */
	300	goto done;
	301
	302	dst_len--;
	303	out_buf++;
3d5b1ecd AZ	304	}
3d5b1ecd AZ	305
0cf43f50	306	if (out_buf[0] != 0x02)
3d5b1ecd	307	goto done;
0cf43f50 HX	308
	309	for (pos = 1; pos < dst_len; pos++)
	310	if (out_buf[pos] == 0x00)
3d5b1ecd	311	break;
0cf43f50	312	if (pos < 9 \|\| pos == dst_len)
3d5b1ecd	313	goto done;
3d5b1ecd AZ	314	pos++;
3d5b1ecd AZ	315
0cf43f50 HX	316	err = 0;
	317
	318	if (req->dst_len < dst_len - pos)
3d5b1ecd	319	err = -EOVERFLOW;
0cf43f50	320	req->dst_len = dst_len - pos;
3d5b1ecd AZ	321
	322	if (!err)
	323	sg_copy_from_buffer(req->dst,
	324	sg_nents_for_len(req->dst, req->dst_len),
0cf43f50	325	out_buf + pos, req->dst_len);
3d5b1ecd AZ	326
	327	done:
	328	kzfree(req_ctx->out_buf);
	329
	330	return err;
	331	}
	332
	333	static void pkcs1pad_decrypt_complete_cb(
	334	struct crypto_async_request *child_async_req, int err)
	335	{
	336	struct akcipher_request *req = child_async_req->data;
	337	struct crypto_async_request async_req;
	338
	339	if (err == -EINPROGRESS)
	340	return;
	341
	342	async_req.data = req->base.data;
	343	async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
	344	async_req.flags = child_async_req->flags;
	345	req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err));
	346	}
	347
	348	static int pkcs1pad_decrypt(struct akcipher_request *req)
	349	{
	350	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	351	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	352	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	353	int err;
	354
	355	if (!ctx->key_size \|\| req->src_len != ctx->key_size)
	356	return -EINVAL;
	357
3a32ce50	358	req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL);
3d5b1ecd AZ	359	if (!req_ctx->out_buf)
	360	return -ENOMEM;
	361
	362	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
6f0904ad	363	ctx->key_size, NULL);
3d5b1ecd AZ	364
	365	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
	366	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
	367	pkcs1pad_decrypt_complete_cb, req);
	368
d858b071 HX	369	/* Reuse input buffer, output to a new buffer */
	370	akcipher_request_set_crypt(&req_ctx->child_req, req->src,
	371	req_ctx->out_sg, req->src_len,
	372	ctx->key_size);
	373
3d5b1ecd	374	err = crypto_akcipher_decrypt(&req_ctx->child_req);
4e5b0ad5	375	if (err != -EINPROGRESS && err != -EBUSY)
3d5b1ecd AZ	376	return pkcs1pad_decrypt_complete(req, err);
	377
	378	return err;
	379	}
	380
	381	static int pkcs1pad_sign(struct akcipher_request *req)
	382	{
	383	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	384	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	385	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
c0d20d22 HX	386	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
	387	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
	388	const struct rsa_asn1_template *digest_info = ictx->digest_info;
3d5b1ecd	389	int err;
a49de377	390	unsigned int ps_end, digest_size = 0;
3d5b1ecd AZ	391
	392	if (!ctx->key_size)
	393	return -EINVAL;
	394
c0d20d22	395	digest_size = digest_info->size;
a49de377 TS	396
a49de377 TS	397	if (req->src_len + digest_size > ctx->key_size - 11)
3d5b1ecd AZ	398	return -EOVERFLOW;
	399
	400	if (req->dst_len < ctx->key_size) {
	401	req->dst_len = ctx->key_size;
	402	return -EOVERFLOW;
	403	}
	404
3d5b1ecd	405	req_ctx->in_buf = kmalloc(ctx->key_size - 1 - req->src_len,
3a32ce50	406	GFP_KERNEL);
3d5b1ecd AZ	407	if (!req_ctx->in_buf)
	408	return -ENOMEM;
	409
a49de377	410	ps_end = ctx->key_size - digest_size - req->src_len - 2;
3d5b1ecd AZ	411	req_ctx->in_buf[0] = 0x01;
	412	memset(req_ctx->in_buf + 1, 0xff, ps_end - 1);
	413	req_ctx->in_buf[ps_end] = 0x00;
	414
c0d20d22 HX	415	memcpy(req_ctx->in_buf + ps_end + 1, digest_info->data,
c0d20d22 HX	416	digest_info->size);
a49de377	417
3d5b1ecd AZ	418	pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
	419	ctx->key_size - 1 - req->src_len, req->src);
	420
3d5b1ecd AZ	421	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
	422	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
	423	pkcs1pad_encrypt_sign_complete_cb, req);
	424
d858b071 HX	425	/* Reuse output buffer */
	426	akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,
	427	req->dst, ctx->key_size - 1, req->dst_len);
	428
3d5b1ecd	429	err = crypto_akcipher_sign(&req_ctx->child_req);
4e5b0ad5	430	if (err != -EINPROGRESS && err != -EBUSY)
3d5b1ecd AZ	431	return pkcs1pad_encrypt_sign_complete(req, err);
	432
	433	return err;
	434	}
	435
	436	static int pkcs1pad_verify_complete(struct akcipher_request *req, int err)
	437	{
	438	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	439	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	440	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
c0d20d22 HX	441	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
	442	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
	443	const struct rsa_asn1_template *digest_info = ictx->digest_info;
27710b8e	444	unsigned int dst_len;
3d5b1ecd	445	unsigned int pos;
27710b8e	446	u8 *out_buf;
3d5b1ecd AZ	447
	448	if (err)
	449	goto done;
	450
27710b8e HX	451	err = -EINVAL;
	452	dst_len = req_ctx->child_req.dst_len;
	453	if (dst_len < ctx->key_size - 1)
3d5b1ecd	454	goto done;
27710b8e HX	455
	456	out_buf = req_ctx->out_buf;
	457	if (dst_len == ctx->key_size) {
	458	if (out_buf[0] != 0x00)
	459	/* Decrypted value had no leading 0 byte */
	460	goto done;
	461
	462	dst_len--;
	463	out_buf++;
3d5b1ecd AZ	464	}
3d5b1ecd AZ	465
a49de377	466	err = -EBADMSG;
27710b8e	467	if (out_buf[0] != 0x01)
3d5b1ecd	468	goto done;
a49de377	469
27710b8e HX	470	for (pos = 1; pos < dst_len; pos++)
27710b8e HX	471	if (out_buf[pos] != 0xff)
3d5b1ecd	472	break;
a49de377	473
27710b8e	474	if (pos < 9 \|\| pos == dst_len \|\| out_buf[pos] != 0x00)
3d5b1ecd	475	goto done;
3d5b1ecd AZ	476	pos++;
3d5b1ecd AZ	477
fec17cb2	478	if (crypto_memneq(out_buf + pos, digest_info->data, digest_info->size))
c0d20d22	479	goto done;
a49de377	480
c0d20d22	481	pos += digest_info->size;
a49de377 TS	482
	483	err = 0;
	484
27710b8e	485	if (req->dst_len < dst_len - pos)
3d5b1ecd	486	err = -EOVERFLOW;
27710b8e	487	req->dst_len = dst_len - pos;
3d5b1ecd AZ	488
	489	if (!err)
	490	sg_copy_from_buffer(req->dst,
	491	sg_nents_for_len(req->dst, req->dst_len),
27710b8e	492	out_buf + pos, req->dst_len);
3d5b1ecd AZ	493	done:
	494	kzfree(req_ctx->out_buf);
	495
	496	return err;
	497	}
	498
	499	static void pkcs1pad_verify_complete_cb(
	500	struct crypto_async_request *child_async_req, int err)
	501	{
	502	struct akcipher_request *req = child_async_req->data;
	503	struct crypto_async_request async_req;
	504
	505	if (err == -EINPROGRESS)
	506	return;
	507
	508	async_req.data = req->base.data;
	509	async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
	510	async_req.flags = child_async_req->flags;
	511	req->base.complete(&async_req, pkcs1pad_verify_complete(req, err));
	512	}
	513
	514	/*
	515	* The verify operation is here for completeness similar to the verification
	516	* defined in RFC2313 section 10.2 except that block type 0 is not accepted,
	517	* as in RFC2437. RFC2437 section 9.2 doesn't define any operation to
	518	* retrieve the DigestInfo from a signature, instead the user is expected
	519	* to call the sign operation to generate the expected signature and compare
	520	* signatures instead of the message-digests.
	521	*/
	522	static int pkcs1pad_verify(struct akcipher_request *req)
	523	{
	524	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
	525	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	526	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
	527	int err;
	528
a49de377	529	if (!ctx->key_size \|\| req->src_len < ctx->key_size)
3d5b1ecd AZ	530	return -EINVAL;
3d5b1ecd AZ	531
3a32ce50	532	req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL);
3d5b1ecd AZ	533	if (!req_ctx->out_buf)
	534	return -ENOMEM;
	535
	536	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
6f0904ad	537	ctx->key_size, NULL);
3d5b1ecd AZ	538
	539	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
	540	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
	541	pkcs1pad_verify_complete_cb, req);
	542
d858b071 HX	543	/* Reuse input buffer, output to a new buffer */
	544	akcipher_request_set_crypt(&req_ctx->child_req, req->src,
	545	req_ctx->out_sg, req->src_len,
	546	ctx->key_size);
	547
3d5b1ecd	548	err = crypto_akcipher_verify(&req_ctx->child_req);
4e5b0ad5	549	if (err != -EINPROGRESS && err != -EBUSY)
3d5b1ecd AZ	550	return pkcs1pad_verify_complete(req, err);
	551
	552	return err;
	553	}
	554
	555	static int pkcs1pad_init_tfm(struct crypto_akcipher *tfm)
	556	{
	557	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
a49de377	558	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
3d5b1ecd AZ	559	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	560	struct crypto_akcipher *child_tfm;
	561
c0d20d22	562	child_tfm = crypto_spawn_akcipher(&ictx->spawn);
3d5b1ecd AZ	563	if (IS_ERR(child_tfm))
	564	return PTR_ERR(child_tfm);
	565
	566	ctx->child = child_tfm;
3d5b1ecd AZ	567	return 0;
	568	}
	569
	570	static void pkcs1pad_exit_tfm(struct crypto_akcipher *tfm)
	571	{
	572	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
	573
	574	crypto_free_akcipher(ctx->child);
	575	}
	576
	577	static void pkcs1pad_free(struct akcipher_instance *inst)
	578	{
a49de377 TS	579	struct pkcs1pad_inst_ctx *ctx = akcipher_instance_ctx(inst);
a49de377 TS	580	struct crypto_akcipher_spawn *spawn = &ctx->spawn;
3d5b1ecd AZ	581
3d5b1ecd AZ	582	crypto_drop_akcipher(spawn);
3d5b1ecd AZ	583	kfree(inst);
	584	}
	585
	586	static int pkcs1pad_create(struct crypto_template tmpl, struct rtattr *tb)
	587	{
c0d20d22	588	const struct rsa_asn1_template *digest_info;
3d5b1ecd AZ	589	struct crypto_attr_type *algt;
3d5b1ecd AZ	590	struct akcipher_instance *inst;
a49de377	591	struct pkcs1pad_inst_ctx *ctx;
3d5b1ecd AZ	592	struct crypto_akcipher_spawn *spawn;
	593	struct akcipher_alg *rsa_alg;
	594	const char *rsa_alg_name;
a49de377	595	const char *hash_name;
3d5b1ecd AZ	596	int err;
	597
	598	algt = crypto_get_attr_type(tb);
	599	if (IS_ERR(algt))
	600	return PTR_ERR(algt);
	601
	602	if ((algt->type ^ CRYPTO_ALG_TYPE_AKCIPHER) & algt->mask)
	603	return -EINVAL;
	604
	605	rsa_alg_name = crypto_attr_alg_name(tb[1]);
	606	if (IS_ERR(rsa_alg_name))
	607	return PTR_ERR(rsa_alg_name);
	608
a49de377 TS	609	hash_name = crypto_attr_alg_name(tb[2]);
a49de377 TS	610	if (IS_ERR(hash_name))
c0d20d22 HX	611	return PTR_ERR(hash_name);
	612
	613	digest_info = rsa_lookup_asn1(hash_name);
	614	if (!digest_info)
	615	return -EINVAL;
a49de377 TS	616
a49de377 TS	617	inst = kzalloc(sizeof(inst) + sizeof(ctx), GFP_KERNEL);
3d5b1ecd AZ	618	if (!inst)
	619	return -ENOMEM;
	620
a49de377 TS	621	ctx = akcipher_instance_ctx(inst);
a49de377 TS	622	spawn = &ctx->spawn;
c0d20d22	623	ctx->digest_info = digest_info;
a49de377	624
3d5b1ecd AZ	625	crypto_set_spawn(&spawn->base, akcipher_crypto_instance(inst));
	626	err = crypto_grab_akcipher(spawn, rsa_alg_name, 0,
	627	crypto_requires_sync(algt->type, algt->mask));
	628	if (err)
	629	goto out_free_inst;
	630
	631	rsa_alg = crypto_spawn_akcipher_alg(spawn);
	632
	633	err = -ENAMETOOLONG;
a49de377	634
c0d20d22 HX	635	if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
	636	"pkcs1pad(%s,%s)", rsa_alg->base.cra_name, hash_name) >=
	637	CRYPTO_MAX_ALG_NAME \|\|
	638	snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
	639	"pkcs1pad(%s,%s)",
	640	rsa_alg->base.cra_driver_name, hash_name) >=
	641	CRYPTO_MAX_ALG_NAME)
3d5b1ecd AZ	642	goto out_drop_alg;
	643
	644	inst->alg.base.cra_flags = rsa_alg->base.cra_flags & CRYPTO_ALG_ASYNC;
	645	inst->alg.base.cra_priority = rsa_alg->base.cra_priority;
	646	inst->alg.base.cra_ctxsize = sizeof(struct pkcs1pad_ctx);
	647
	648	inst->alg.init = pkcs1pad_init_tfm;
	649	inst->alg.exit = pkcs1pad_exit_tfm;
	650
	651	inst->alg.encrypt = pkcs1pad_encrypt;
	652	inst->alg.decrypt = pkcs1pad_decrypt;
	653	inst->alg.sign = pkcs1pad_sign;
	654	inst->alg.verify = pkcs1pad_verify;
	655	inst->alg.set_pub_key = pkcs1pad_set_pub_key;
	656	inst->alg.set_priv_key = pkcs1pad_set_priv_key;
	657	inst->alg.max_size = pkcs1pad_get_max_size;
	658	inst->alg.reqsize = sizeof(struct pkcs1pad_request) + rsa_alg->reqsize;
	659
	660	inst->free = pkcs1pad_free;
	661
	662	err = akcipher_register_instance(tmpl, inst);
	663	if (err)
c0d20d22	664	goto out_drop_alg;
3d5b1ecd AZ	665
	666	return 0;
	667
	668	out_drop_alg:
	669	crypto_drop_akcipher(spawn);
	670	out_free_inst:
	671	kfree(inst);
	672	return err;
	673	}
	674
	675	struct crypto_template rsa_pkcs1pad_tmpl = {
	676	.name = "pkcs1pad",
	677	.create = pkcs1pad_create,
	678	.module = THIS_MODULE,
	679	};