Re: [PATCH] crypto: ccm - preserve the IV buffer

[Tudor Ambarus <tudor.ambarus@microchip.com>]

On 10/31/2017 04:42 PM, Romain Izard wrote:
> The IV buffer used during CCM operations is used twice, during both the
> hashing step and the ciphering step.
> 
> When using a hardware accelerator that updates the contents of the IV
> buffer at the end of ciphering operations, the value will be modified.
> In the decryption case, the subsequent setup of the hashing algorithm
> will interpret the updated IV instead of the original value, which can
> lead to out-of-bounds writes.
> 
> Reuse the idata buffer, only used in the hashing step, to preserve the
> IV's value during the ciphering step in the decryption case.
> 
> Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
> ---
>   crypto/ccm.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/crypto/ccm.c b/crypto/ccm.c
> index 1ce37ae0ce56..0a083342ec8c 100644
> --- a/crypto/ccm.c
> +++ b/crypto/ccm.c
> @@ -363,7 +363,7 @@ static int crypto_ccm_decrypt(struct aead_request *req)
>   	unsigned int cryptlen = req->cryptlen;
>   	u8 *authtag = pctx->auth_tag;
>   	u8 *odata = pctx->odata;
> -	u8 *iv = req->iv;
> +	u8 *iv = pctx->idata;
>   	int err;
>   
>   	cryptlen -= authsize;
> @@ -379,6 +379,8 @@ static int crypto_ccm_decrypt(struct aead_request *req)
>   	if (req->src != req->dst)
>   		dst = pctx->dst;
>   
> +	memcpy(iv, req->iv, 16);
> +
>   	skcipher_request_set_tfm(skreq, ctx->ctr);
>   	skcipher_request_set_callback(skreq, pctx->flags,
>   				      crypto_ccm_decrypt_done, req);
> 

Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>