crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails

BugLink: https://bugs.launchpad.net/bugs/1837952
commit ba7d7433a0e998c902132bd47330e355a1eaa894 upstream.

Some algorithms have a ->setkey() method that is not atomic, in the
sense that setting a key can fail after changes were already made to the
tfm context.  In this case, if a key was already set the tfm can end up
in a state that corresponds to neither the old key nor the new key.

It's not feasible to make all ->setkey() methods atomic, especially ones
that have to key multiple sub-tfms.  Therefore, make the crypto API set
CRYPTO_TFM_NEED_KEY if ->setkey() fails and the algorithm requires a
key, to prevent the tfm from being used until a new key is set.

Note: we can't set CRYPTO_TFM_NEED_KEY for OPTIONAL_KEY algorithms, so
->setkey() for those must nevertheless be atomic.  That's fine for now
since only the crc32 and crc32c algorithms set OPTIONAL_KEY, and it's
not intended that OPTIONAL_KEY be used much.

[Cc stable mainly because when introducing the NEED_KEY flag I changed
 AF_ALG to rely on it; and unlike in-kernel crypto API users, AF_ALG
 previously didn't have this problem.  So these "incompletely keyed"
 states became theoretically accessible via AF_ALG -- though, the
 opportunities for causing real mischief seem pretty limited.]

Fixes: 9fa68f620041 ("crypto: hash - prevent using keyed hashes without setting key")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/crypto/ahash.c b/crypto/ahash.c
index 5bf4ed08eecf6992e828e5096d891a11db47f3aa..8cc326594d6c5a5af90ea4df3309278c9752fc8d 100644 (file)
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -190,6 +190,21 @@ static int ahash_setkey_unaligned(struct crypto_ahash *tfm, const u8 *key,
        return ret;
 }
 
+static int ahash_nosetkey(struct crypto_ahash *tfm, const u8 *key,
+                         unsigned int keylen)
+{
+       return -ENOSYS;
+}
+
+static void ahash_set_needkey(struct crypto_ahash *tfm)
+{
+       const struct hash_alg_common *alg = crypto_hash_alg_common(tfm);
+
+       if (tfm->setkey != ahash_nosetkey &&
+           !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY))
+               crypto_ahash_set_flags(tfm, CRYPTO_TFM_NEED_KEY);
+}
+
 int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key,
                        unsigned int keylen)
 {
@@ -201,20 +216,16 @@ int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key,
        else
                err = tfm->setkey(tfm, key, keylen);
 
-       if (err)
+       if (unlikely(err)) {
+               ahash_set_needkey(tfm);
                return err;
+       }
 
        crypto_ahash_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
        return 0;
 }
 EXPORT_SYMBOL_GPL(crypto_ahash_setkey);
 
-static int ahash_nosetkey(struct crypto_ahash *tfm, const u8 *key,
-                         unsigned int keylen)
-{
-       return -ENOSYS;
-}
-
 static inline unsigned int ahash_align_buffer_size(unsigned len,
                                                   unsigned long mask)
 {
@@ -477,8 +488,7 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
 
        if (alg->setkey) {
                hash->setkey = alg->setkey;
-               if (!(alg->halg.base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY))
-                       crypto_ahash_set_flags(hash, CRYPTO_TFM_NEED_KEY);
+               ahash_set_needkey(hash);
        }
        if (alg->export)
                hash->export = alg->export;

diff --git a/crypto/shash.c b/crypto/shash.c
index 5d732c6bb4b2158f59e7e16e0f96508b8ae90f91..a04145e5306a5491ff02bd1a535c54e18aaf3a4e 100644 (file)
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -53,6 +53,13 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
        return err;
 }
 
+static void shash_set_needkey(struct crypto_shash *tfm, struct shash_alg *alg)
+{
+       if (crypto_shash_alg_has_setkey(alg) &&
+           !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY))
+               crypto_shash_set_flags(tfm, CRYPTO_TFM_NEED_KEY);
+}
+
 int crypto_shash_setkey(struct crypto_shash *tfm, const u8 *key,
                        unsigned int keylen)
 {
@@ -65,8 +72,10 @@ int crypto_shash_setkey(struct crypto_shash *tfm, const u8 *key,
        else
                err = shash->setkey(tfm, key, keylen);
 
-       if (err)
+       if (unlikely(err)) {
+               shash_set_needkey(tfm, shash);
                return err;
+       }
 
        crypto_shash_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
        return 0;
@@ -368,7 +377,8 @@ int crypto_init_shash_ops_async(struct crypto_tfm *tfm)
        crt->final = shash_async_final;
        crt->finup = shash_async_finup;
        crt->digest = shash_async_digest;
-       crt->setkey = shash_async_setkey;
+       if (crypto_shash_alg_has_setkey(alg))
+               crt->setkey = shash_async_setkey;
 
        crypto_ahash_set_flags(crt, crypto_shash_get_flags(shash) &
                                    CRYPTO_TFM_NEED_KEY);
@@ -390,9 +400,7 @@ static int crypto_shash_init_tfm(struct crypto_tfm *tfm)
 
        hash->descsize = alg->descsize;
 
-       if (crypto_shash_alg_has_setkey(alg) &&
-           !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY))
-               crypto_shash_set_flags(hash, CRYPTO_TFM_NEED_KEY);
+       shash_set_needkey(hash, alg);
 
        return 0;
 }