patches for DPDK stable branches
 help / color / Atom feed
From: Pablo de Lara <pablo.de.lara.guarch@intel.com>
To: declan.doherty@intel.com
Cc: dev@dpdk.org, Pablo de Lara <pablo.de.lara.guarch@intel.com>,
	stable@dpdk.org
Subject: [dpdk-stable] [PATCH v2 2/3] crypto/aesni_mb: fix GCM digest size check
Date: Fri,  9 Oct 2020 12:05:20 +0000
Message-ID: <20201009120521.194542-2-pablo.de.lara.guarch@intel.com> (raw)
In-Reply-To: <20201009120521.194542-1-pablo.de.lara.guarch@intel.com>

GCM digest sizes should be between 1 and 16 bytes.

Fixes: 7b2d4706c90e ("crypto/aesni_mb: support newer library version only")
Cc: stable@dpdk.org

Signed-off-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
---

Changes:

This patchset depends on series http://patches.dpdk.org/project/dpdk/list/?series=12820.

-v2 : rebased on top of crypto subtree

---

 .../crypto/aesni_mb/aesni_mb_pmd_private.h    |  4 ++--
 drivers/crypto/aesni_mb/rte_aesni_mb_pmd.c    | 22 +++++++++----------
 .../crypto/aesni_mb/rte_aesni_mb_pmd_ops.c    |  8 +++----
 3 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/drivers/crypto/aesni_mb/aesni_mb_pmd_private.h b/drivers/crypto/aesni_mb/aesni_mb_pmd_private.h
index 9693bf985..7481e1d5e 100644
--- a/drivers/crypto/aesni_mb/aesni_mb_pmd_private.h
+++ b/drivers/crypto/aesni_mb/aesni_mb_pmd_private.h
@@ -85,7 +85,7 @@ static const unsigned auth_truncated_digest_byte_lengths[] = {
 		[AES_CMAC]			= 12,
 		[AES_CCM]			= 8,
 		[NULL_HASH]			= 0,
-		[AES_GMAC]			= 16,
+		[AES_GMAC]			= 12,
 		[PLAIN_SHA1]			= 20,
 		[PLAIN_SHA_224]			= 28,
 		[PLAIN_SHA_256]			= 32,
@@ -121,7 +121,7 @@ static const unsigned auth_digest_byte_lengths[] = {
 		[AES_XCBC]			= 16,
 		[AES_CMAC]			= 16,
 		[AES_CCM]			= 16,
-		[AES_GMAC]			= 12,
+		[AES_GMAC]			= 16,
 		[NULL_HASH]			= 0,
 		[PLAIN_SHA1]			= 20,
 		[PLAIN_SHA_224]			= 28,
diff --git a/drivers/crypto/aesni_mb/rte_aesni_mb_pmd.c b/drivers/crypto/aesni_mb/rte_aesni_mb_pmd.c
index ba2882d27..7dbe40e02 100644
--- a/drivers/crypto/aesni_mb/rte_aesni_mb_pmd.c
+++ b/drivers/crypto/aesni_mb/rte_aesni_mb_pmd.c
@@ -213,19 +213,11 @@ aesni_mb_set_session_auth_parameters(const MB_MGR *mb_mgr,
 			sess->cipher.direction = DECRYPT;
 
 		sess->auth.algo = AES_GMAC;
-		/*
-		 * Multi-buffer lib supports 8, 12 and 16 bytes of digest.
-		 * If size requested is different, generate the full digest
-		 * (16 bytes) in a temporary location and then memcpy
-		 * the requested number of bytes.
-		 */
-		if (sess->auth.req_digest_len != 16 &&
-				sess->auth.req_digest_len != 12 &&
-				sess->auth.req_digest_len != 8) {
-			sess->auth.gen_digest_len = 16;
-		} else {
-			sess->auth.gen_digest_len = sess->auth.req_digest_len;
+		if (sess->auth.req_digest_len > get_digest_byte_length(AES_GMAC)) {
+			AESNI_MB_LOG(ERR, "Invalid digest size\n");
+			return -EINVAL;
 		}
+		sess->auth.gen_digest_len = sess->auth.req_digest_len;
 		sess->iv.length = xform->auth.iv.length;
 		sess->iv.offset = xform->auth.iv.offset;
 
@@ -721,6 +713,12 @@ aesni_mb_set_session_aead_parameters(const MB_MGR *mb_mgr,
 			return -EINVAL;
 		}
 
+		/* GCM digest size must be between 1 and 16 */
+		if (sess->auth.req_digest_len == 0 ||
+				sess->auth.req_digest_len > 16) {
+			AESNI_MB_LOG(ERR, "Invalid digest size\n");
+			return -EINVAL;
+		}
 		break;
 
 	default:
diff --git a/drivers/crypto/aesni_mb/rte_aesni_mb_pmd_ops.c b/drivers/crypto/aesni_mb/rte_aesni_mb_pmd_ops.c
index 0f74be126..dc2238191 100644
--- a/drivers/crypto/aesni_mb/rte_aesni_mb_pmd_ops.c
+++ b/drivers/crypto/aesni_mb/rte_aesni_mb_pmd_ops.c
@@ -455,9 +455,9 @@ static const struct rte_cryptodev_capabilities aesni_mb_pmd_capabilities[] = {
 					.increment = 8
 				},
 				.digest_size = {
-					.min = 8,
+					.min = 1,
 					.max = 16,
-					.increment = 4
+					.increment = 1
 				},
 				.aad_size = {
 					.min = 0,
@@ -485,9 +485,9 @@ static const struct rte_cryptodev_capabilities aesni_mb_pmd_capabilities[] = {
 					.increment = 8
 				},
 				.digest_size = {
-					.min = 8,
+					.min = 1,
 					.max = 16,
-					.increment = 4
+					.increment = 1
 				},
 				.iv_size = {
 					.min = 12,
-- 
2.25.1


      reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-06 10:59 [dpdk-stable] [PATCH 1/3] crypto/aesni_mb: fix CCM " Pablo de Lara
2020-10-06 10:59 ` [dpdk-stable] [PATCH 2/3] crypto/aesni_mb: fix GCM " Pablo de Lara
2020-10-09 12:05 ` [dpdk-stable] [PATCH v2 1/3] crypto/aesni_mb: fix CCM " Pablo de Lara
2020-10-09 12:05   ` Pablo de Lara [this message]

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201009120521.194542-2-pablo.de.lara.guarch@intel.com \
    --to=pablo.de.lara.guarch@intel.com \
    --cc=declan.doherty@intel.com \
    --cc=dev@dpdk.org \
    --cc=stable@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

patches for DPDK stable branches

Archives are clonable:
	git clone --mirror http://inbox.dpdk.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ http://inbox.dpdk.org/stable \
		stable@dpdk.org
	public-inbox-index stable


Newsgroup available over NNTP:
	nntp://inbox.dpdk.org/inbox.dpdk.stable


AGPL code for this site: git clone https://public-inbox.org/ public-inbox