From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 41084489EF for ; Mon, 27 Oct 2025 17:24:06 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 3C8E24028B; Mon, 27 Oct 2025 17:24:06 +0100 (CET) Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) by mails.dpdk.org (Postfix) with ESMTP id 0CC404028B for ; Mon, 27 Oct 2025 17:24:04 +0100 (CET) Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-426f1574a14so3204532f8f.3 for ; Mon, 27 Oct 2025 09:24:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1761582243; x=1762187043; darn=dpdk.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=K5muB0s8Dk0bwohHzNTcBi3rIsF2TF1It5BKGnqsv8Q=; b=QN5P+lhgK/o9uTIFgNF/k/p6KLHnz87zUCtlUFpvWn3iLSTILpJ5gwrUWm0i9ZXK0G iXxKsv+Rr2CJvplatU3FQgZ8sVs7yYncObq6dUb3+YGZmcVMdy3C3BfBIZLTZXAjFVO1 dj3A/XfkyPJbOqFXDCeLQBjtVXGQkMokvapDYJtd52PnikN8ivvSspOB04TSnlw4O+4D LsNrN7hyGpamlffcndlL4/2OonMTwuKYvLzKK+G7KA2dMBgaE1i1wkoWdb+SluXD6INA hVq3gHUNAwit3oHiFQocRvQlH9ZthWNy/y1cfuzpnVaeJk86cn11x+z2TStKMdfkp+AD NmdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1761582244; x=1762187044; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=K5muB0s8Dk0bwohHzNTcBi3rIsF2TF1It5BKGnqsv8Q=; b=sG2JLJfWyD1Ahem9gFl/mKVtFMLaaiHU+383UsroG5JSuAG/MhQavYyHplqtBI7uk4 5pfpfd87LUJMKUK+c1bIcqKgq6U02et/vZZSXAA4t82oJii6cDEYqIWn5D4cDc9Lofuy 77vvcg0DB+scp8N6fhs3iub+CpS8QlfMLGE5vfw1MgDX7n03oCdRdEFjw4/JnpUSlh/T FRtCHT1YVEgYyxThbaIBwo/mlT9Rm3tYA7WZQt5BA2VtFea7VuyOizdafZaMGOoIj69N BqsYvCKKa5NiI6C06qhgI0PriwSDUo5agMHLssw4M48oshg+LcylTtcCAVCPTbR2FR3G QmfA== X-Gm-Message-State: AOJu0Yxav2+FFlnUUHklK+c7ePoQXJfDisc64nImPoEcgIoj+3dtI1wM v7djb1BUr46TY6rUZxsy7cLSTyW0jE1aWEOmeJhCs8ieO2fCXHY1L8vKfG/OYNhC X-Gm-Gg: ASbGncuqwHKpZZ+rj6eVO9bQF1Zzek2JDud5SZPGYtLxkqFNtCYH06Gdofccw+QjMda /hfxfoKprqZvB+GI34SElHGii7uCZAgCI3o3ClpyOVk2opoiGw+z3gJnRmNXCC40Mr8sGcyuzZw n2sEMbN/5xKex5+5C/4o4dBnAOSl8xreyktVDGWLxp+mFwNqIWfV9GInZGcRMQZMe58Zks51zL1 FXhKk3EVeJXukHpAhAA69TMAtK2yTEnMoyTb7MmoO2aGkBibIh4PjPIIpUiXGMyc4tM7V7I/D4I rqFnonyiziATqSoxLaKeYqnlfCv3SEXUiZ4nGIYYQ/Cfr8+MueXL53pPrntrHpuSkIDV/vFLtJy mG6NnilnPZcqYOajenKc0VAN3pY7O4FOqtUIdqdzZmhncMd5YQnJyChNaJaKXA093v7lKQhMPct 7R+uUqBw== X-Google-Smtp-Source: AGHT+IHvfRqrJ8TP0P+rQUcZOkwJoRWctVzoas9AA9DFfDAyjBRyKb5YtzxCE9MmPm1hcEiARXOw9A== X-Received: by 2002:a05:6000:2507:b0:427:854:770 with SMTP id ffacd0b85a97d-429a7e81e77mr227497f8f.43.1761582243468; Mon, 27 Oct 2025 09:24:03 -0700 (PDT) Received: from localhost ([2a01:4b00:d036:ae00:6fc5:c3bc:147e:832c]) by smtp.gmail.com with UTF8SMTPSA id 5b1f17b1804b1-475dd494d5csm147880455e9.9.2025.10.27.09.24.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Oct 2025 09:24:02 -0700 (PDT) From: luca.boccassi@gmail.com To: Sucharitha Sarananaga Cc: dpdk stable Subject: patch 'crypto/cnxk: refactor RSA verification' has been queued to stable release 22.11.11 Date: Mon, 27 Oct 2025 16:19:52 +0000 Message-ID: <20251027162001.3710450-74-luca.boccassi@gmail.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20251027162001.3710450-1-luca.boccassi@gmail.com> References: <20251027162001.3710450-1-luca.boccassi@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Hi, FYI, your patch has been queued to stable release 22.11.11 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 10/29/25. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Queued patches are on a temporary branch at: https://github.com/bluca/dpdk-stable This queued commit can be viewed at: https://github.com/bluca/dpdk-stable/commit/3b34eb20115e16dc18577a4d5d087bb519eb73b5 Thanks. Luca Boccassi --- >From 3b34eb20115e16dc18577a4d5d087bb519eb73b5 Mon Sep 17 00:00:00 2001 From: Sucharitha Sarananaga Date: Mon, 29 Sep 2025 15:13:49 +0530 Subject: [PATCH] crypto/cnxk: refactor RSA verification [ upstream commit dfd038b97ec3d173ded0f985df39301b7c7662f2 ] This patch avoid copying the decrypted message into the signature buffer, which is actually an input to the verify operation. This prevents overwriting the input buffer unnecessarily. Fixes: 6661bedf1605 ("crypto/cnxk: add asymmetric datapath") Signed-off-by: Sucharitha Sarananaga --- drivers/crypto/cnxk/cnxk_ae.h | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/drivers/crypto/cnxk/cnxk_ae.h b/drivers/crypto/cnxk/cnxk_ae.h index 156bd2e94f..231060b387 100644 --- a/drivers/crypto/cnxk/cnxk_ae.h +++ b/drivers/crypto/cnxk/cnxk_ae.h @@ -841,20 +841,17 @@ cnxk_ae_dequeue_rsa_op(struct rte_crypto_op *cop, uint8_t *rptr, case RTE_CRYPTO_ASYM_OP_VERIFY: if (rsa->padding.type == RTE_CRYPTO_RSA_PADDING_NONE) { rsa->sign.length = rsa_ctx->n.length; - memcpy(rsa->sign.data, rptr, rsa->sign.length); + if (memcmp(rptr, rsa->message.data, rsa->message.length)) + cop->status = RTE_CRYPTO_OP_STATUS_ERROR; } else { /* Get length of signed output */ - rsa->sign.length = - rte_cpu_to_be_16(*((uint16_t *)rptr)); + rsa->sign.length = rte_cpu_to_be_16(*((uint16_t *)rptr)); /* * Offset output data pointer by length field - * (2 bytes) and copy signed data. + * (2 bytes) and compare signed data. */ - memcpy(rsa->sign.data, rptr + 2, rsa->sign.length); - } - if (memcmp(rsa->sign.data, rsa->message.data, - rsa->message.length)) { - cop->status = RTE_CRYPTO_OP_STATUS_ERROR; + if (memcmp(rptr + 2, rsa->message.data, rsa->message.length)) + cop->status = RTE_CRYPTO_OP_STATUS_ERROR; } break; default: -- 2.47.3 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2025-10-27 15:54:37.474262967 +0000 +++ 0074-crypto-cnxk-refactor-RSA-verification.patch 2025-10-27 15:54:34.851950954 +0000 @@ -1 +1 @@ -From dfd038b97ec3d173ded0f985df39301b7c7662f2 Mon Sep 17 00:00:00 2001 +From 3b34eb20115e16dc18577a4d5d087bb519eb73b5 Mon Sep 17 00:00:00 2001 @@ -5,0 +6,2 @@ +[ upstream commit dfd038b97ec3d173ded0f985df39301b7c7662f2 ] + @@ -12 +13,0 @@ -Cc: stable@dpdk.org @@ -20 +21 @@ -index 8508ab8736..912a2a9496 100644 +index 156bd2e94f..231060b387 100644 @@ -23 +24 @@ -@@ -1592,20 +1592,17 @@ cnxk_ae_dequeue_rsa_op(struct rte_crypto_op *cop, uint8_t *rptr, +@@ -841,20 +841,17 @@ cnxk_ae_dequeue_rsa_op(struct rte_crypto_op *cop, uint8_t *rptr, @@ -25 +26 @@ - if (rsa_ctx->padding.type == RTE_CRYPTO_RSA_PADDING_NONE) { + if (rsa->padding.type == RTE_CRYPTO_RSA_PADDING_NONE) {