linux-kernel - Re: [PATCH] crypto: pcrypt - Fix recursive instantiation by using proper instance naming

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aNZMOL-58r0NEteg@gondor.apana.org.au>
Date: Fri, 26 Sep 2025 16:18:00 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: Saeed Mirzamohammadi <saeed.mirzamohammadi@...cle.com>
Cc: "David S. Miller" <davem@...emloft.net>,
	Steffen Klassert <steffen.klassert@...unet.com>,
	linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
	smueller@...onox.de, vegard.nossum@...cle.com
Subject: Re: [PATCH] crypto: pcrypt - Fix recursive instantiation by using
 proper instance naming

On Thu, Sep 25, 2025 at 03:31:24PM -0700, Saeed Mirzamohammadi wrote:
> The pcrypt template recursively instantiates itself because it copies
> the child algorithm's cra_name directly, causing naming collisions with
> the larval instance. When aead_register_instance() fails with -EEXIST,
> the larval wait mechanism re-runs the lookup and finds the pcrypt instance
> instead of the real child algorithm, leading to pcrypt(pcrypt(...))
> recursion.
> 
> Fix by using crypto_inst_setname() instead of memcpy, ensuring pcrypt
> instances are named "pcrypt(<child>)" rather than reusing the child's name.
> This eliminates the naming collision that triggers the re-lookup mechanism.
> 
> Also apply the same fix to cryptd for consistency, even though it doesn't
> exhibit the same recursion issue.
> 
> To reproduce:
> python -c "import socket; socket.socket(socket.AF_ALG,
> socket.SOCK_SEQPACKET, 0).bind(('aead', 'pcrypt(ccm(aes))'))"
> ...
> OSError: [Errno 36] File name too long
> 
> Before the patch (/proc/crypto):
> name  : ccm(aes)
> driver: pcrypt(pcrypt(...(pcrypt(ccm_base(ctr-aes-aesni,cbcmac(aes-aesni))))...))
> [and 9 other ccm(aes) instances.]
> 
> After the patch (/proc/crypto):
> name  : pcrypt(ccm(aes))
> driver: pcrypt(ccm_base(ctr-aes-aesni,cbcmac(aes-aesni)))
> 
> Fixes: 5068c7a883d1 ("crypto: pcrypt - Add pcrypt crypto parallelization wrapper")
> Fixes: 4e0958d19bd8 ("crypto: cryptd - Add support for skcipher")
> Reported-by: Vegard Nossum <vegard.nossum@...cle.com>
> Closes: https://lore.kernel.org/linux-crypto/4c0e7a68-254e-4f71-a903-952415c609d9@oracle.com
> Signed-off-by: Saeed Mirzamohammadi <saeed.mirzamohammadi@...cle.com>
> ---
>  crypto/cryptd.c | 9 ++++-----
>  crypto/pcrypt.c | 8 ++++----
>  2 files changed, 8 insertions(+), 9 deletions(-)

The algorithm name must stay the same because the whole point of
pcrypt (and cryptd) is to wrap around the underlying algorithm
without turning it into a new algorithm.

The problem here is that the Crypto API only supports two types
of names, algorithm names and driver names.  Your python code
was using a mixture of the two, which creates a name that can
never be fulfilled by the Crypto API.  If you substituted the
name pcrypt(ccm(aes)) with pcrypt(ccm_base(ctr-aes-aesni,cbcmac(aes-aesni)))
then it should work.

Ideally we should support such mixed names so I'm happy to consider
any patches implementing that.

Cheers,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt