crypto: aegis - fix handling chunked inputs

The generic AEGIS implementations all fail the improved AEAD tests
because they produce the wrong result with some data layouts.  The issue
is that they assume that if the skcipher_walk API gives 'nbytes' not
aligned to the walksize (a.k.a. walk.stride), then it is the end of the
data.  In fact, this can happen before the end.  Fix them.

Fixes: f606a88e5823 ("crypto: aegis - Add generic AEGIS AEAD implementations")
Cc: <stable@vger.kernel.org> # v4.18+
Cc: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/aegis128.c b/crypto/aegis128.c
index 96e078a8a00a1d94f2a4f259126fb26885fe51e9..3718a834130326e6ec729980b94fab658233a3de 100644 (file)
--- a/crypto/aegis128.c
+++ b/crypto/aegis128.c
@@ -286,19 +286,19 @@ static void crypto_aegis128_process_crypt(struct aegis_state *state,
                                          const struct aegis128_ops *ops)
 {
        struct skcipher_walk walk;
-       u8 *src, *dst;
-       unsigned int chunksize;
 
        ops->skcipher_walk_init(&walk, req, false);
 
        while (walk.nbytes) {
-               src = walk.src.virt.addr;
-               dst = walk.dst.virt.addr;
-               chunksize = walk.nbytes;
+               unsigned int nbytes = walk.nbytes;
 
-               ops->crypt_chunk(state, dst, src, chunksize);
+               if (nbytes < walk.total)
+                       nbytes = round_down(nbytes, walk.stride);
 
-               skcipher_walk_done(&walk, 0);
+               ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
+                                nbytes);
+
+               skcipher_walk_done(&walk, walk.nbytes - nbytes);
        }
 }
 

diff --git a/crypto/aegis128l.c b/crypto/aegis128l.c
index a210e779b911b4a1a1c6a1068ae578eaf4a0afac..275a8616d71bde31148779045f531a17ceb28046 100644 (file)
--- a/crypto/aegis128l.c
+++ b/crypto/aegis128l.c
@@ -349,19 +349,19 @@ static void crypto_aegis128l_process_crypt(struct aegis_state *state,
                                           const struct aegis128l_ops *ops)
 {
        struct skcipher_walk walk;
-       u8 *src, *dst;
-       unsigned int chunksize;
 
        ops->skcipher_walk_init(&walk, req, false);
 
        while (walk.nbytes) {
-               src = walk.src.virt.addr;
-               dst = walk.dst.virt.addr;
-               chunksize = walk.nbytes;
+               unsigned int nbytes = walk.nbytes;
 
-               ops->crypt_chunk(state, dst, src, chunksize);
+               if (nbytes < walk.total)
+                       nbytes = round_down(nbytes, walk.stride);
 
-               skcipher_walk_done(&walk, 0);
+               ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
+                                nbytes);
+
+               skcipher_walk_done(&walk, walk.nbytes - nbytes);
        }
 }
 

diff --git a/crypto/aegis256.c b/crypto/aegis256.c
index 49882a28e93e97ca9741a19dce5682661274f829..ecd6b7f34a2d235503af93bc08ef0a123ee932c1 100644 (file)
--- a/crypto/aegis256.c
+++ b/crypto/aegis256.c
@@ -299,19 +299,19 @@ static void crypto_aegis256_process_crypt(struct aegis_state *state,
                                          const struct aegis256_ops *ops)
 {
        struct skcipher_walk walk;
-       u8 *src, *dst;
-       unsigned int chunksize;
 
        ops->skcipher_walk_init(&walk, req, false);
 
        while (walk.nbytes) {
-               src = walk.src.virt.addr;
-               dst = walk.dst.virt.addr;
-               chunksize = walk.nbytes;
+               unsigned int nbytes = walk.nbytes;
 
-               ops->crypt_chunk(state, dst, src, chunksize);
+               if (nbytes < walk.total)
+                       nbytes = round_down(nbytes, walk.stride);
 
-               skcipher_walk_done(&walk, 0);
+               ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
+                                nbytes);
+
+               skcipher_walk_done(&walk, walk.nbytes - nbytes);
        }
 }