crypto: skcipher - fix weak key check for lskciphers

When an algorithm of the new "lskcipher" type is exposed through the
"skcipher" API, calls to crypto_skcipher_setkey() don't pass on the
CRYPTO_TFM_REQ_FORBID_WEAK_KEYS flag to the lskcipher.  This causes
self-test failures for ecb(des), as weak keys are not rejected anymore.
Fix this.

Fixes: 31865c4c4db2 ("crypto: skcipher - Add lskcipher")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/lskcipher.c b/crypto/lskcipher.c
index cb6170ebcaa36ceb1e490d0ca2814fc7ae734660..9edc897309510b97d6d0ab2ab12b485025295c6d 100644 (file)
--- a/crypto/lskcipher.c
+++ b/crypto/lskcipher.c
@@ -194,14 +194,6 @@ int crypto_lskcipher_decrypt(struct crypto_lskcipher *tfm, const u8 *src,
 }
 EXPORT_SYMBOL_GPL(crypto_lskcipher_decrypt);
 
-int crypto_lskcipher_setkey_sg(struct crypto_skcipher *tfm, const u8 *key,
-                              unsigned int keylen)
-{
-       struct crypto_lskcipher **ctx = crypto_skcipher_ctx(tfm);
-
-       return crypto_lskcipher_setkey(*ctx, key, keylen);
-}
-
 static int crypto_lskcipher_crypt_sg(struct skcipher_request *req,
                                     int (*crypt)(struct crypto_lskcipher *tfm,
                                                  const u8 *src, u8 *dst,

diff --git a/crypto/skcipher.c b/crypto/skcipher.c
index b9496dc8a609f6b68f62345d9de1baed5e5abb61..ac8b8c04265429b2664dbe164296993560634ec0 100644 (file)
--- a/crypto/skcipher.c
+++ b/crypto/skcipher.c
@@ -621,7 +621,13 @@ int crypto_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key,
        int err;
 
        if (cipher->co.base.cra_type != &crypto_skcipher_type) {
-               err = crypto_lskcipher_setkey_sg(tfm, key, keylen);
+               struct crypto_lskcipher **ctx = crypto_skcipher_ctx(tfm);
+
+               crypto_lskcipher_clear_flags(*ctx, CRYPTO_TFM_REQ_MASK);
+               crypto_lskcipher_set_flags(*ctx,
+                                          crypto_skcipher_get_flags(tfm) &
+                                          CRYPTO_TFM_REQ_MASK);
+               err = crypto_lskcipher_setkey(*ctx, key, keylen);
                goto out;
        }
 

diff --git a/crypto/skcipher.h b/crypto/skcipher.h
index 6f1295f0fef24f6426d2daaa0f1068ec34b85f74..16c9484360dab0da2fa0bdeb731adcd63462c45e 100644 (file)
--- a/crypto/skcipher.h
+++ b/crypto/skcipher.h
@@ -20,8 +20,6 @@ static inline struct crypto_istat_cipher *skcipher_get_stat_common(
 #endif
 }
 
-int crypto_lskcipher_setkey_sg(struct crypto_skcipher *tfm, const u8 *key,
-                              unsigned int keylen);
 int crypto_lskcipher_encrypt_sg(struct skcipher_request *req);
 int crypto_lskcipher_decrypt_sg(struct skcipher_request *req);
 int crypto_init_lskcipher_ops_sg(struct crypto_tfm *tfm);