linux-kernel - Re: [PATCH] crypto: sun4i-ss - Fix SHA1 hash on A33-variant with BE CPU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200907145501.GB11894@Red>
Date:   Mon, 7 Sep 2020 16:55:01 +0200
From:   Corentin Labbe <clabbe.montjoie@...il.com>
To:     Herbert Xu <herbert@...dor.apana.org.au>
Cc:     kernel test robot <lkp@...el.com>, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org,
        Linux Crypto Mailing List <linux-crypto@...r.kernel.org>
Subject: Re: [PATCH] crypto: sun4i-ss - Fix SHA1 hash on A33-variant with BE
 CPU

On Mon, Sep 07, 2020 at 04:24:00PM +1000, Herbert Xu wrote:
> On Sun, Sep 06, 2020 at 04:52:24PM +0800, kernel test robot wrote:
> >
> > >> drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c:483:35: sparse: sparse: incorrect type in assignment (different base types) @@     expected unsigned int [assigned] [usertype] v @@     got restricted __le32 [usertype] @@
> >    drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c:483:35: sparse:     expected unsigned int [assigned] [usertype] v
> >    drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c:483:35: sparse:     got restricted __le32 [usertype]
> >    drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c:485:35: sparse: sparse: incorrect type in assignment (different base types) @@     expected unsigned int [assigned] [usertype] v @@     got restricted __be32 [usertype] @@
> >    drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c:485:35: sparse:     expected unsigned int [assigned] [usertype] v
> >    drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c:485:35: sparse:     got restricted __be32 [usertype]
> >    drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c:490:27: sparse: sparse: incorrect type in assignment (different base types) @@     expected unsigned int [addressable] [assigned] [usertype] v @@     got restricted __le32 [usertype] @@
> >    drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c:490:27: sparse:     expected unsigned int [addressable] [assigned] [usertype] v
> >    drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c:490:27: sparse:     got restricted __le32 [usertype]
> 
> This appears to be a genuine bug, on big-endian CPUs at least.
> 
> ---8<---
> When the hash is written out on the A33 variant, it is incorrectly
> swabbed on big-endian CPUs, when it should simply be written out as
> is because it's already in the right format.  This was caught by
> sparse warnings.
> 
> Instead of using cpu_to_Xe32 followed by a memcpy, this patch
> converts the final hash write to use put_unaligned instead.  This
> simplifies the code and makes the A33 variant handling a lot clearer.
> 
> This patch also fixes the incorrect endianness marking on wb,
> although this should have no effect in the genereated code.
> 
> Fixes: 1e02e6fbdadb ("crypto: sun4i-ss - add the A33 variant of SS")
> Reported-by: kernel test robot <lkp@...el.com>
> Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>
> 
> diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c
> index dc35edd90034..84f7921de577 100644
> --- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c
> +++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-hash.c
> @@ -9,6 +9,7 @@
>   * You could find the datasheet in Documentation/arm/sunxi.rst
>   */
>  #include "sun4i-ss.h"
> +#include <asm/unaligned.h>
>  #include <linux/scatterlist.h>
>  
>  /* This is a totally arbitrary value */
> @@ -196,7 +197,7 @@ static int sun4i_hash(struct ahash_request *areq)
>  	struct sg_mapping_iter mi;
>  	int in_r, err = 0;
>  	size_t copied = 0;
> -	__le32 wb = 0;
> +	u32 wb = 0;
>  
>  	dev_dbg(ss->dev, "%s %s bc=%llu len=%u mode=%x wl=%u h0=%0x",
>  		__func__, crypto_tfm_alg_name(areq->base.tfm),
> @@ -408,7 +409,7 @@ static int sun4i_hash(struct ahash_request *areq)
>  
>  		nbw = op->len - 4 * nwait;
>  		if (nbw) {
> -			wb = cpu_to_le32(*(u32 *)(op->buf + nwait * 4));
> +			wb = le32_to_cpup((__le32 *)(op->buf + nwait * 4));
>  			wb &= GENMASK((nbw * 8) - 1, 0);
>  
>  			op->byte_count += nbw;
> @@ -417,7 +418,7 @@ static int sun4i_hash(struct ahash_request *areq)
>  
>  	/* write the remaining bytes of the nbw buffer */
>  	wb |= ((1 << 7) << (nbw * 8));
> -	bf[j++] = le32_to_cpu(wb);
> +	((__le32 *)bf)[j++] = cpu_to_le32(wb);
>  
>  	/*
>  	 * number of space to pad to obtain 64o minus 8(size) minus 4 (final 1)
> @@ -479,16 +480,16 @@ static int sun4i_hash(struct ahash_request *areq)
>  	/* Get the hash from the device */
>  	if (op->mode == SS_OP_SHA1) {
>  		for (i = 0; i < 5; i++) {
> +			v = readl(ss->base + SS_MD0 + i * 4);
>  			if (ss->variant->sha1_in_be)
> -				v = cpu_to_le32(readl(ss->base + SS_MD0 + i * 4));
> +				put_unaligned(v, areq->result + i * 4);
>  			else
> -				v = cpu_to_be32(readl(ss->base + SS_MD0 + i * 4));
> -			memcpy(areq->result + i * 4, &v, 4);
> +				put_unaligned_be32(v, areq->result + i * 4);
>  		}
>  	} else {
>  		for (i = 0; i < 4; i++) {
> -			v = cpu_to_le32(readl(ss->base + SS_MD0 + i * 4));
> -			memcpy(areq->result + i * 4, &v, 4);
> +			v = readl(ss->base + SS_MD0 + i * 4);
> +			put_unaligned_le32(v, areq->result + i * 4);
>  		}
>  	}
>  

modprobe tcrypt on BE+next-20200828 fail with this patch on A33:
alg: ahash: sha1-sun4i-ss test failed (wrong result) on test vector 0, cfg=\"init+update+final aligned buffer\"

I will try to debug it.