Skip to content

Commit 9ebc205

Browse files
Akhil Rgregkh
Akhil R
authored and
gregkh
committed
crypto: tegra - Do not use fixed size buffers
[ Upstream commit 1cb328d ] Allocate the buffer based on the request instead of a fixed buffer length. In operations which may require larger buffer size, a fixed buffer may fail. Fixes: 0880bb3 ("crypto: tegra - Add Tegra Security Engine driver") Signed-off-by: Akhil R <akhilrajeev@nvidia.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Stable-dep-of: 1ddaff4 ("crypto: tegra - Fix IV usage for AES ECB") Signed-off-by: Sasha Levin <sashal@kernel.org>
1 parent 28ec10e commit 9ebc205

File tree

3 files changed

+89
-75
lines changed

3 files changed

+89
-75
lines changed

‎drivers/crypto/tegra/tegra-se-aes.c‎

Lines changed: 64 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -263,12 +263,6 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)
263263
unsigned int cmdlen;
264264
int ret;
265265

266-
rctx->datbuf.buf = dma_alloc_coherent(se->dev, SE_AES_BUFLEN,
267-
&rctx->datbuf.addr, GFP_KERNEL);
268-
if (!rctx->datbuf.buf)
269-
return -ENOMEM;
270-
271-
rctx->datbuf.size = SE_AES_BUFLEN;
272266
rctx->iv = (u32 *)req->iv;
273267
rctx->len = req->cryptlen;
274268

@@ -278,6 +272,12 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)
278272
rctx->len += AES_BLOCK_SIZE - (rctx->len % AES_BLOCK_SIZE);
279273
}
280274

275+
rctx->datbuf.size = rctx->len;
276+
rctx->datbuf.buf = dma_alloc_coherent(se->dev, rctx->datbuf.size,
277+
&rctx->datbuf.addr, GFP_KERNEL);
278+
if (!rctx->datbuf.buf)
279+
return -ENOMEM;
280+
281281
scatterwalk_map_and_copy(rctx->datbuf.buf, req->src, 0, req->cryptlen, 0);
282282

283283
/* Prepare the command and submit for execution */
@@ -289,7 +289,7 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)
289289
scatterwalk_map_and_copy(rctx->datbuf.buf, req->dst, 0, req->cryptlen, 1);
290290

291291
/* Free the buffer */
292-
dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
292+
dma_free_coherent(ctx->se->dev, rctx->datbuf.size,
293293
rctx->datbuf.buf, rctx->datbuf.addr);
294294

295295
crypto_finalize_skcipher_request(se->engine, req, ret);
@@ -1120,6 +1120,11 @@ static int tegra_ccm_crypt_init(struct aead_request *req, struct tegra_se *se,
11201120
rctx->assoclen = req->assoclen;
11211121
rctx->authsize = crypto_aead_authsize(tfm);
11221122

1123+
if (rctx->encrypt)
1124+
rctx->cryptlen = req->cryptlen;
1125+
else
1126+
rctx->cryptlen = req->cryptlen - rctx->authsize;
1127+
11231128
memcpy(iv, req->iv, 16);
11241129

11251130
ret = tegra_ccm_check_iv(iv);
@@ -1148,30 +1153,26 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
11481153
struct tegra_se *se = ctx->se;
11491154
int ret;
11501155

1156+
ret = tegra_ccm_crypt_init(req, se, rctx);
1157+
if (ret)
1158+
return ret;
1159+
11511160
/* Allocate buffers required */
1152-
rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, SE_AES_BUFLEN,
1161+
rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100;
1162+
rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size,
11531163
&rctx->inbuf.addr, GFP_KERNEL);
11541164
if (!rctx->inbuf.buf)
11551165
return -ENOMEM;
11561166

1157-
rctx->inbuf.size = SE_AES_BUFLEN;
1158-
1159-
rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, SE_AES_BUFLEN,
1167+
rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100;
1168+
rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size,
11601169
&rctx->outbuf.addr, GFP_KERNEL);
11611170
if (!rctx->outbuf.buf) {
11621171
ret = -ENOMEM;
11631172
goto outbuf_err;
11641173
}
11651174

1166-
rctx->outbuf.size = SE_AES_BUFLEN;
1167-
1168-
ret = tegra_ccm_crypt_init(req, se, rctx);
1169-
if (ret)
1170-
goto out;
1171-
11721175
if (rctx->encrypt) {
1173-
rctx->cryptlen = req->cryptlen;
1174-
11751176
/* CBC MAC Operation */
11761177
ret = tegra_ccm_compute_auth(ctx, rctx);
11771178
if (ret)
@@ -1182,8 +1183,6 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
11821183
if (ret)
11831184
goto out;
11841185
} else {
1185-
rctx->cryptlen = req->cryptlen - ctx->authsize;
1186-
11871186
/* CTR operation */
11881187
ret = tegra_ccm_do_ctr(ctx, rctx);
11891188
if (ret)
@@ -1196,11 +1195,11 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
11961195
}
11971196

11981197
out:
1199-
dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
1198+
dma_free_coherent(ctx->se->dev, rctx->inbuf.size,
12001199
rctx->outbuf.buf, rctx->outbuf.addr);
12011200

12021201
outbuf_err:
1203-
dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
1202+
dma_free_coherent(ctx->se->dev, rctx->outbuf.size,
12041203
rctx->inbuf.buf, rctx->inbuf.addr);
12051204

12061205
crypto_finalize_aead_request(ctx->se->engine, req, ret);
@@ -1216,23 +1215,6 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
12161215
struct tegra_aead_reqctx *rctx = aead_request_ctx(req);
12171216
int ret;
12181217

1219-
/* Allocate buffers required */
1220-
rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, SE_AES_BUFLEN,
1221-
&rctx->inbuf.addr, GFP_KERNEL);
1222-
if (!rctx->inbuf.buf)
1223-
return -ENOMEM;
1224-
1225-
rctx->inbuf.size = SE_AES_BUFLEN;
1226-
1227-
rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, SE_AES_BUFLEN,
1228-
&rctx->outbuf.addr, GFP_KERNEL);
1229-
if (!rctx->outbuf.buf) {
1230-
ret = -ENOMEM;
1231-
goto outbuf_err;
1232-
}
1233-
1234-
rctx->outbuf.size = SE_AES_BUFLEN;
1235-
12361218
rctx->src_sg = req->src;
12371219
rctx->dst_sg = req->dst;
12381220
rctx->assoclen = req->assoclen;
@@ -1246,6 +1228,21 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
12461228
memcpy(rctx->iv, req->iv, GCM_AES_IV_SIZE);
12471229
rctx->iv[3] = (1 << 24);
12481230

1231+
/* Allocate buffers required */
1232+
rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen;
1233+
rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size,
1234+
&rctx->inbuf.addr, GFP_KERNEL);
1235+
if (!rctx->inbuf.buf)
1236+
return -ENOMEM;
1237+
1238+
rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen;
1239+
rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size,
1240+
&rctx->outbuf.addr, GFP_KERNEL);
1241+
if (!rctx->outbuf.buf) {
1242+
ret = -ENOMEM;
1243+
goto outbuf_err;
1244+
}
1245+
12491246
/* If there is associated data perform GMAC operation */
12501247
if (rctx->assoclen) {
12511248
ret = tegra_gcm_do_gmac(ctx, rctx);
@@ -1269,11 +1266,11 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
12691266
ret = tegra_gcm_do_verify(ctx->se, rctx);
12701267

12711268
out:
1272-
dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
1269+
dma_free_coherent(ctx->se->dev, rctx->outbuf.size,
12731270
rctx->outbuf.buf, rctx->outbuf.addr);
12741271

12751272
outbuf_err:
1276-
dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
1273+
dma_free_coherent(ctx->se->dev, rctx->inbuf.size,
12771274
rctx->inbuf.buf, rctx->inbuf.addr);
12781275

12791276
/* Finalize the request if there are no errors */
@@ -1500,6 +1497,11 @@ static int tegra_cmac_do_update(struct ahash_request *req)
15001497
return 0;
15011498
}
15021499

1500+
rctx->datbuf.buf = dma_alloc_coherent(se->dev, rctx->datbuf.size,
1501+
&rctx->datbuf.addr, GFP_KERNEL);
1502+
if (!rctx->datbuf.buf)
1503+
return -ENOMEM;
1504+
15031505
/* Copy the previous residue first */
15041506
if (rctx->residue.size)
15051507
memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
@@ -1525,6 +1527,9 @@ static int tegra_cmac_do_update(struct ahash_request *req)
15251527

15261528
tegra_cmac_copy_result(ctx->se, rctx);
15271529

1530+
dma_free_coherent(ctx->se->dev, rctx->datbuf.size,
1531+
rctx->datbuf.buf, rctx->datbuf.addr);
1532+
15281533
return ret;
15291534
}
15301535

@@ -1539,10 +1544,20 @@ static int tegra_cmac_do_final(struct ahash_request *req)
15391544

15401545
if (!req->nbytes && !rctx->total_len && ctx->fallback_tfm) {
15411546
return crypto_shash_tfm_digest(ctx->fallback_tfm,
1542-
rctx->datbuf.buf, 0, req->result);
1547+
NULL, 0, req->result);
1548+
}
1549+
1550+
if (rctx->residue.size) {
1551+
rctx->datbuf.buf = dma_alloc_coherent(se->dev, rctx->residue.size,
1552+
&rctx->datbuf.addr, GFP_KERNEL);
1553+
if (!rctx->datbuf.buf) {
1554+
ret = -ENOMEM;
1555+
goto out_free;
1556+
}
1557+
1558+
memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
15431559
}
15441560

1545-
memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
15461561
rctx->datbuf.size = rctx->residue.size;
15471562
rctx->total_len += rctx->residue.size;
15481563
rctx->config = tegra234_aes_cfg(SE_ALG_CMAC, 0);
@@ -1568,8 +1583,10 @@ static int tegra_cmac_do_final(struct ahash_request *req)
15681583
writel(0, se->base + se->hw->regs->result + (i * 4));
15691584

15701585
out:
1571-
dma_free_coherent(se->dev, SE_SHA_BUFLEN,
1572-
rctx->datbuf.buf, rctx->datbuf.addr);
1586+
if (rctx->residue.size)
1587+
dma_free_coherent(se->dev, rctx->datbuf.size,
1588+
rctx->datbuf.buf, rctx->datbuf.addr);
1589+
out_free:
15731590
dma_free_coherent(se->dev, crypto_ahash_blocksize(tfm) * 2,
15741591
rctx->residue.buf, rctx->residue.addr);
15751592
return ret;
@@ -1681,28 +1698,15 @@ static int tegra_cmac_init(struct ahash_request *req)
16811698
rctx->residue.buf = dma_alloc_coherent(se->dev, rctx->blk_size * 2,
16821699
&rctx->residue.addr, GFP_KERNEL);
16831700
if (!rctx->residue.buf)
1684-
goto resbuf_fail;
1701+
return -ENOMEM;
16851702

16861703
rctx->residue.size = 0;
16871704

1688-
rctx->datbuf.buf = dma_alloc_coherent(se->dev, SE_SHA_BUFLEN,
1689-
&rctx->datbuf.addr, GFP_KERNEL);
1690-
if (!rctx->datbuf.buf)
1691-
goto datbuf_fail;
1692-
1693-
rctx->datbuf.size = 0;
1694-
16951705
/* Clear any previous result */
16961706
for (i = 0; i < CMAC_RESULT_REG_COUNT; i++)
16971707
writel(0, se->base + se->hw->regs->result + (i * 4));
16981708

16991709
return 0;
1700-
1701-
datbuf_fail:
1702-
dma_free_coherent(se->dev, rctx->blk_size, rctx->residue.buf,
1703-
rctx->residue.addr);
1704-
resbuf_fail:
1705-
return -ENOMEM;
17061710
}
17071711

17081712
static int tegra_cmac_setkey(struct crypto_ahash *tfm, const u8 *key,

‎drivers/crypto/tegra/tegra-se-hash.c‎

Lines changed: 25 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,11 @@ static int tegra_sha_do_update(struct ahash_request *req)
332332
return 0;
333333
}
334334

335+
rctx->datbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->datbuf.size,
336+
&rctx->datbuf.addr, GFP_KERNEL);
337+
if (!rctx->datbuf.buf)
338+
return -ENOMEM;
339+
335340
/* Copy the previous residue first */
336341
if (rctx->residue.size)
337342
memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
@@ -368,6 +373,9 @@ static int tegra_sha_do_update(struct ahash_request *req)
368373
if (!(rctx->task & SHA_FINAL))
369374
tegra_sha_copy_hash_result(se, rctx);
370375

376+
dma_free_coherent(ctx->se->dev, rctx->datbuf.size,
377+
rctx->datbuf.buf, rctx->datbuf.addr);
378+
371379
return ret;
372380
}
373381

@@ -380,7 +388,17 @@ static int tegra_sha_do_final(struct ahash_request *req)
380388
u32 *cpuvaddr = se->cmdbuf->addr;
381389
int size, ret = 0;
382390

383-
memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
391+
if (rctx->residue.size) {
392+
rctx->datbuf.buf = dma_alloc_coherent(se->dev, rctx->residue.size,
393+
&rctx->datbuf.addr, GFP_KERNEL);
394+
if (!rctx->datbuf.buf) {
395+
ret = -ENOMEM;
396+
goto out_free;
397+
}
398+
399+
memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
400+
}
401+
384402
rctx->datbuf.size = rctx->residue.size;
385403
rctx->total_len += rctx->residue.size;
386404

@@ -397,8 +415,10 @@ static int tegra_sha_do_final(struct ahash_request *req)
397415
memcpy(req->result, rctx->digest.buf, rctx->digest.size);
398416

399417
out:
400-
dma_free_coherent(se->dev, SE_SHA_BUFLEN,
401-
rctx->datbuf.buf, rctx->datbuf.addr);
418+
if (rctx->residue.size)
419+
dma_free_coherent(se->dev, rctx->datbuf.size,
420+
rctx->datbuf.buf, rctx->datbuf.addr);
421+
out_free:
402422
dma_free_coherent(se->dev, crypto_ahash_blocksize(tfm),
403423
rctx->residue.buf, rctx->residue.addr);
404424
dma_free_coherent(se->dev, rctx->digest.size, rctx->digest.buf,
@@ -534,19 +554,11 @@ static int tegra_sha_init(struct ahash_request *req)
534554
if (!rctx->residue.buf)
535555
goto resbuf_fail;
536556

537-
rctx->datbuf.buf = dma_alloc_coherent(se->dev, SE_SHA_BUFLEN,
538-
&rctx->datbuf.addr, GFP_KERNEL);
539-
if (!rctx->datbuf.buf)
540-
goto datbuf_fail;
541-
542557
return 0;
543558

544-
datbuf_fail:
545-
dma_free_coherent(se->dev, rctx->blk_size, rctx->residue.buf,
546-
rctx->residue.addr);
547559
resbuf_fail:
548-
dma_free_coherent(se->dev, SE_SHA_BUFLEN, rctx->datbuf.buf,
549-
rctx->datbuf.addr);
560+
dma_free_coherent(se->dev, rctx->digest.size, rctx->digest.buf,
561+
rctx->digest.addr);
550562
digbuf_fail:
551563
return -ENOMEM;
552564
}

‎drivers/crypto/tegra/tegra-se.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -340,8 +340,6 @@
340340
#define SE_CRYPTO_CTR_REG_COUNT 4
341341
#define SE_MAX_KEYSLOT 15
342342
#define SE_MAX_MEM_ALLOC SZ_4M
343-
#define SE_AES_BUFLEN 0x8000
344-
#define SE_SHA_BUFLEN 0x2000
345343

346344
#define SHA_FIRST BIT(0)
347345
#define SHA_UPDATE BIT(1)

0 commit comments

Comments
 (0)