linux-kernel - [BUG] crypto: export() overran state buffer on test vector

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200206085442.GA5585@Red>
Date:   Thu, 6 Feb 2020 09:54:42 +0100
From:   Corentin Labbe <clabbe.montjoie@...il.com>
To:     herbert@...dor.apana.org.au, davem@...emloft.net,
        linux-crypto@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org
Subject: [BUG] crypto: export() overran state buffer on test vector

Hello

When working on adding hash support on sun8i-ce, I made a simple version which always fallback.
but booting it lead to this:
[   52.274278] sun8i-ce 1c15000.crypto: Register sha1
[   52.279286] sun8i-ce 1c15000.crypto: sun8i_hash_crainit statesize is 96
[   52.285933] sun8i-ce 1c15000.crypto: Fallback for sha1-sun8i-ce is sha1-ce
[   52.312423] shash_default_export descsize=104
[   52.316021] alg: ahash: sha1-sun8i-ce export() overran state buffer on test vector 0, cfg=\"import/export\" statesize=96
[   52.333189] sun8i-ce 1c15000.crypto: Register sha224
[   52.338387] sun8i-ce 1c15000.crypto: sun8i_hash_crainit statesize is 104
[   52.345097] sun8i-ce 1c15000.crypto: Fallback for sha224-sun8i-ce is sha224-ce
[   52.371865] shash_default_export descsize=112
[   52.375459] alg: ahash: sha224-sun8i-ce export() overran state buffer on test vector 0, cfg=\"import/export\" statesize=104
[   52.393039] sun8i-ce 1c15000.crypto: Register sha256
[   52.398219] sun8i-ce 1c15000.crypto: sun8i_hash_crainit statesize is 104
[   52.404937] sun8i-ce 1c15000.crypto: Fallback for sha256-sun8i-ce is sha256-ce
[   52.431476] shash_default_export descsize=112
[   52.435073] alg: ahash: sha256-sun8i-ce export() overran state buffer on test vector 0, cfg=\"import/export\" statesize=104

For sha1, sha224 and sha256, my driver fail to pass the test.
This is due to the fact that export() (and so shash_async_export/shash_default_export) use crypto_shash_descsize() as length but selftest expect it to be statesize.

Just in case, this is my export code:
int sun8i_hash_crainit(struct crypto_tfm *tfm)
{
        struct sun8i_hash_tfm_ctx *op = crypto_tfm_ctx(tfm);
        struct ahash_alg *alg = __crypto_ahash_alg(tfm->__crt_alg);
        struct sun8i_ce_alg_template *algt;

        memset(op, 0, sizeof(struct sun8i_hash_tfm_ctx));

        crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm), sizeof(struct sun8i_hash_reqctx));

        op->fallback_tfm = crypto_alloc_ahash(crypto_tfm_alg_name(tfm), 0, CRYPTO_ALG_NEED_FALLBACK);
        if (IS_ERR(op->fallback_tfm)) {
                dev_err(algt->ce->dev, "Fallback driver cound no be loaded\n");
                return PTR_ERR(op->fallback_tfm);
        }
        dev_info(op->ce->dev, "%s statesize is %u\n", __func__, algt->alg.hash.halg.statesize);
        dev_info(op->ce->dev, "Fallback for %s is %s\n",
                crypto_tfm_alg_driver_name(tfm),
                crypto_tfm_alg_driver_name(&op->fallback_tfm->base));
        return 0;
}

int sun8i_hash_init(struct ahash_request *areq)
{
        struct sun8i_hash_reqctx *rctx = ahash_request_ctx(areq);
        struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
        struct sun8i_hash_tfm_ctx *tfmctx = crypto_ahash_ctx(tfm);

        memset(rctx, 0, sizeof(struct sun8i_hash_reqctx));

        ahash_request_set_tfm(&rctx->fallback_req, tfmctx->fallback_tfm);
        rctx->fallback_req.base.flags = areq->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP;

        return crypto_ahash_init(&rctx->fallback_req);
}

int sun8i_hash_export(struct ahash_request *areq, void *out)
{
        struct sun8i_hash_reqctx *rctx = ahash_request_ctx(areq);
        struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
        struct sun8i_hash_tfm_ctx *tfmctx = crypto_ahash_ctx(tfm);

        ahash_request_set_tfm(&rctx->fallback_req, tfmctx->fallback_tfm);
        rctx->fallback_req.base.flags = areq->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP;
                                                                                
        return crypto_ahash_export(&rctx->fallback_req, out);                   
}

Regards