56ea774604
commit 68279380266a5fa70e664de754503338e2ec3f43 upstream. Commit88c02b3f79("s390/sha3: Support sha3 performance enhancements") added the field s390_sha_ctx::first_message_part and made it be used by s390_sha_update() (now s390_sha_update_blocks()). At the time, s390_sha_update() was used by all the s390 SHA-1, SHA-2, and SHA-3 algorithms. However, only the initialization functions for SHA-3 were updated, leaving SHA-1 and SHA-2 using first_message_part uninitialized. This could cause e.g. the function code CPACF_KIMD_SHA_512 | CPACF_KIMD_NIP to be used instead of just CPACF_KIMD_SHA_512. This apparently was harmless, as the SHA-1 and SHA-2 function codes ignore CPACF_KIMD_NIP; it is recognized only by the SHA-3 function codes (https://lore.kernel.org/r/73477fe9-a1dc-4e38-98a6-eba9921e8afa@linux.ibm.com/). Therefore, this bug was found only when first_message_part was later converted to a boolean and UBSAN detected its uninitialized use. Regardless, let's fix this by just initializing to zero. Note: in 6.16, we need to patch SHA-1, SHA-384, and SHA-512. In 6.15 and earlier, we'll also need to patch SHA-224 and SHA-256, as they hadn't yet been librarified (which incidentally fixed this bug). Fixes:88c02b3f79("s390/sha3: Support sha3 performance enhancements") Cc: stable@vger.kernel.org Reported-by: Ingo Franzki <ifranzki@linux.ibm.com> Closes: https://lore.kernel.org/r/12740696-595c-4604-873e-aefe8b405fbf@linux.ibm.com Acked-by: Heiko Carstens <hca@linux.ibm.com> Link: https://lore.kernel.org/r/20250703172316.7914-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
106 lines
2.6 KiB
C
106 lines
2.6 KiB
C
// SPDX-License-Identifier: GPL-2.0+
|
|
/*
|
|
* Cryptographic API.
|
|
*
|
|
* s390 implementation of the SHA1 Secure Hash Algorithm.
|
|
*
|
|
* Derived from cryptoapi implementation, adapted for in-place
|
|
* scatterlist interface. Originally based on the public domain
|
|
* implementation written by Steve Reid.
|
|
*
|
|
* s390 Version:
|
|
* Copyright IBM Corp. 2003, 2007
|
|
* Author(s): Thomas Spatzier
|
|
* Jan Glauber (jan.glauber@de.ibm.com)
|
|
*
|
|
* Derived from "crypto/sha1_generic.c"
|
|
* Copyright (c) Alan Smithee.
|
|
* Copyright (c) Andrew McDonald <andrew@mcdonald.org.uk>
|
|
* Copyright (c) Jean-Francois Dive <jef@linuxbe.org>
|
|
*/
|
|
#include <crypto/internal/hash.h>
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/cpufeature.h>
|
|
#include <crypto/sha1.h>
|
|
#include <asm/cpacf.h>
|
|
|
|
#include "sha.h"
|
|
|
|
static int s390_sha1_init(struct shash_desc *desc)
|
|
{
|
|
struct s390_sha_ctx *sctx = shash_desc_ctx(desc);
|
|
|
|
sctx->state[0] = SHA1_H0;
|
|
sctx->state[1] = SHA1_H1;
|
|
sctx->state[2] = SHA1_H2;
|
|
sctx->state[3] = SHA1_H3;
|
|
sctx->state[4] = SHA1_H4;
|
|
sctx->count = 0;
|
|
sctx->func = CPACF_KIMD_SHA_1;
|
|
sctx->first_message_part = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int s390_sha1_export(struct shash_desc *desc, void *out)
|
|
{
|
|
struct s390_sha_ctx *sctx = shash_desc_ctx(desc);
|
|
struct sha1_state *octx = out;
|
|
|
|
octx->count = sctx->count;
|
|
memcpy(octx->state, sctx->state, sizeof(octx->state));
|
|
memcpy(octx->buffer, sctx->buf, sizeof(octx->buffer));
|
|
return 0;
|
|
}
|
|
|
|
static int s390_sha1_import(struct shash_desc *desc, const void *in)
|
|
{
|
|
struct s390_sha_ctx *sctx = shash_desc_ctx(desc);
|
|
const struct sha1_state *ictx = in;
|
|
|
|
sctx->count = ictx->count;
|
|
memcpy(sctx->state, ictx->state, sizeof(ictx->state));
|
|
memcpy(sctx->buf, ictx->buffer, sizeof(ictx->buffer));
|
|
sctx->func = CPACF_KIMD_SHA_1;
|
|
sctx->first_message_part = 0;
|
|
return 0;
|
|
}
|
|
|
|
static struct shash_alg alg = {
|
|
.digestsize = SHA1_DIGEST_SIZE,
|
|
.init = s390_sha1_init,
|
|
.update = s390_sha_update,
|
|
.final = s390_sha_final,
|
|
.export = s390_sha1_export,
|
|
.import = s390_sha1_import,
|
|
.descsize = sizeof(struct s390_sha_ctx),
|
|
.statesize = sizeof(struct sha1_state),
|
|
.base = {
|
|
.cra_name = "sha1",
|
|
.cra_driver_name= "sha1-s390",
|
|
.cra_priority = 300,
|
|
.cra_blocksize = SHA1_BLOCK_SIZE,
|
|
.cra_module = THIS_MODULE,
|
|
}
|
|
};
|
|
|
|
static int __init sha1_s390_init(void)
|
|
{
|
|
if (!cpacf_query_func(CPACF_KIMD, CPACF_KIMD_SHA_1))
|
|
return -ENODEV;
|
|
return crypto_register_shash(&alg);
|
|
}
|
|
|
|
static void __exit sha1_s390_fini(void)
|
|
{
|
|
crypto_unregister_shash(&alg);
|
|
}
|
|
|
|
module_cpu_feature_match(S390_CPU_FEATURE_MSA, sha1_s390_init);
|
|
module_exit(sha1_s390_fini);
|
|
|
|
MODULE_ALIAS_CRYPTO("sha1");
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_DESCRIPTION("SHA1 Secure Hash Algorithm");
|