kernel/git/stable/linux-stable.git/crypto/sha512_generic.c, branch linux-3.16.y

crypto: memzero_explicit - make sure to clear out sensitive data

2018-12-16T22:08:08+00:00

commit 7185ad2672a7d50bc384de0e38d90b75d99f3d82 upstream. Recently, in commit 13aa93c70e71 ("random: add and use memzero_explicit() for clearing data"), we have found that GCC may optimize some memset() cases away when it detects a stack variable is not being used anymore and going out of scope. This can happen, for example, in cases when we are clearing out sensitive information such as keying material or any e.g. intermediate results from crypto computations, etc. With the help of Coccinelle, we can figure out and fix such occurences in the crypto subsytem as well. Julia Lawall provided the following Coccinelle program: @@ type T; identifier x; @@ T x; ... when exists when any -memset +memzero_explicit (&x, -0, ...) ... when != x when strict @@ type T; identifier x; @@ T x[...]; ... when exists when any -memset +memzero_explicit (x, -0, ...) ... when != x when strict Therefore, make use of the drop-in replacement memzero_explicit() for exactly such cases instead of using memset(). Signed-off-by: Daniel Borkmann Cc: Julia Lawall Cc: Herbert Xu Cc: Theodore Ts'o Cc: Hannes Frederic Sowa Acked-by: Hannes Frederic Sowa Acked-by: Herbert Xu Signed-off-by: Theodore Ts'o Signed-off-by: Ben Hutchings

crypto: add missing crypto module aliases

2015-02-04T10:57:50+00:00

commit 3e14dcf7cb80b34a1f38b55bc96f02d23fdaaaaf upstream. Commit 5d26a105b5a7 ("crypto: prefix module autoloading with "crypto-"") changed the automatic module loading when requesting crypto algorithms to prefix all module requests with "crypto-". This requires all crypto modules to have a crypto specific module alias even if their file name would otherwise match the requested crypto algorithm. Even though commit 5d26a105b5a7 added those aliases for a vast amount of modules, it was missing a few. Add the required MODULE_ALIAS_CRYPTO annotations to those files to make them get loaded automatically, again. This fixes, e.g., requesting 'ecb(blowfish-generic)', which used to work with kernels v3.18 and below. Also change MODULE_ALIAS() lines to MODULE_ALIAS_CRYPTO(). The former won't work for crypto modules any more. Fixes: 5d26a105b5a7 ("crypto: prefix module autoloading with "crypto-"") Cc: Kees Cook Signed-off-by: Mathias Krause Signed-off-by: Herbert Xu [ luis: backported to 3.16: dropped changes to: - arch/x86/crypto/sha-mb/sha1_mb.c ] Signed-off-by: Luis Henriques

crypto: prefix module autoloading with "crypto-"

2015-02-04T10:57:48+00:00

commit 5d26a105b5a73e5635eae0629b42fa0a90e07b7b upstream. This prefixes all crypto module loading with "crypto-" so we never run the risk of exposing module auto-loading to userspace via a crypto API, as demonstrated by Mathias Krause: https://lkml.org/lkml/2013/3/4/70 Signed-off-by: Kees Cook Signed-off-by: Herbert Xu [ luis: backported to 3.16: dropped changes to: - arch/arm/crypto/sha1_neon_glue.c - arch/arm/crypto/sha512_neon_glue.c - arch/x86/crypto/des3_ede_glue.c - drivers/crypto/qat/qat_common/adf_ctl_drv.c ] Signed-off-by: Luis Henriques

crypto: sha512_generic - set cra_driver_name

2013-05-28T07:43:04+00:00

'sha512_generic' should set driver name now that there is alternative sha512 provider (sha512_ssse3). Signed-off-by: Jussi Kivilinna Signed-off-by: Herbert Xu

crypto: sha512 - Expose generic sha512 routine to be callable from other modules

2013-04-25T13:00:57+00:00

Other SHA512 routines may need to use the generic routine when FPU is not available. Signed-off-by: Tim Chen Signed-off-by: Herbert Xu

crypto: sha512 - use crypto_[un]register_shashes

2012-08-01T09:47:26+00:00

Combine all shash algs to be registered and use new crypto_[un]register_shashes functions. This simplifies init/exit code. Signed-off-by: Jussi Kivilinna Signed-off-by: Herbert Xu

crypto: sha512 - Fix byte counter overflow in SHA-512

2012-04-05T12:34:20+00:00

The current code only increments the upper 64 bits of the SHA-512 byte counter when the number of bytes hashed happens to hit 2^64 exactly. This patch increments the upper 64 bits whenever the lower 64 bits overflows. Signed-off-by: Kent Yoder Cc: stable@kernel.org Signed-off-by: Herbert Xu

crypto: sha512 - use standard ror64()

2012-02-16T04:12:33+00:00

Use standard ror64() instead of hand-written. There is no standard ror64, so create it. The difference is shift value being "unsigned int" instead of uint64_t (for which there is no reason). gcc starts to emit native ROR instructions which it doesn't do for some reason currently. This should make the code faster. Patch survives in-tree crypto test and ping flood with hmac(sha512) on. Signed-off-by: Alexey Dobriyan Signed-off-by: Herbert Xu

crypto: sha512 - Avoid stack bloat on i386

2012-02-05T04:09:28+00:00

Unfortunately in reducing W from 80 to 16 we ended up unrolling the loop twice. As gcc has issues dealing with 64-bit ops on i386 this means that we end up using even more stack space (>1K). This patch solves the W reduction by moving LOAD_OP/BLEND_OP into the loop itself, thus avoiding the need to duplicate it. While the stack space still isn't great (>0.5K) it is at least in the same ball park as the amount of stack used for our C sha1 implementation. Note that this patch basically reverts to the original code so the diff looks bigger than it really is. Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu

crypto: sha512 - Use binary and instead of modulus

2012-01-26T04:03:16+00:00

The previous patch used the modulus operator over a power of 2 unnecessarily which may produce suboptimal binary code. This patch changes changes them to binary ands instead. Signed-off-by: Herbert Xu