1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * algif_skcipher: User-space interface for skcipher algorithms 4 * 5 * This file provides the user-space API for symmetric key ciphers. 6 * 7 * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au> 8 * 9 * The following concept of the memory management is used: 10 * 11 * The kernel maintains two SGLs, the TX SGL and the RX SGL. The TX SGL is 12 * filled by user space with the data submitted via sendmsg. Filling up the TX 13 * SGL does not cause a crypto operation -- the data will only be tracked by 14 * the kernel. Upon receipt of one recvmsg call, the caller must provide a 15 * buffer which is tracked with the RX SGL. 16 * 17 * During the processing of the recvmsg operation, the cipher request is 18 * allocated and prepared. As part of the recvmsg operation, the processed 19 * TX buffers are extracted from the TX SGL into a separate SGL. 20 * 21 * After the completion of the crypto operation, the RX SGL and the cipher 22 * request is released. The extracted TX SGL parts are released together with 23 * the RX SGL release. 24 */ 25 26 #include <crypto/scatterwalk.h> 27 #include <crypto/skcipher.h> 28 #include <crypto/if_alg.h> 29 #include <linux/init.h> 30 #include <linux/list.h> 31 #include <linux/kernel.h> 32 #include <linux/mm.h> 33 #include <linux/module.h> 34 #include <linux/net.h> 35 #include <linux/string.h> 36 #include <net/sock.h> 37 38 static const struct af_alg_allowlist_entry skcipher_allowlist[] = { 39 { "adiantum(xchacha12,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ 40 { "adiantum(xchacha20,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ 41 { "cbc(aes)" }, /* iwd */ 42 { "cbc(des)" }, /* iwd */ 43 { "cbc(des3_ede)" }, /* iwd */ 44 { "cbc(paes)" }, /* caam and others */ 45 { "ctr(aes)" }, /* iwd */ 46 { "ecb(aes)" }, /* iwd, bluez */ 47 { "ecb(des)" }, /* iwd */ 48 { "hctr2(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ 49 { "xts(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup benchmark */ 50 { "xts(camellia)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ 51 { "xts(serpent)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ 52 { "xts(twofish)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ 53 {}, 54 }; 55 56 static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg, 57 size_t size) 58 { 59 struct sock *sk = sock->sk; 60 struct alg_sock *ask = alg_sk(sk); 61 struct sock *psk = ask->parent; 62 struct alg_sock *pask = alg_sk(psk); 63 struct crypto_skcipher *tfm = pask->private; 64 unsigned ivsize = crypto_skcipher_ivsize(tfm); 65 66 return af_alg_sendmsg(sock, msg, size, ivsize); 67 } 68 69 static int algif_skcipher_export(struct sock *sk, struct skcipher_request *req) 70 { 71 struct alg_sock *ask = alg_sk(sk); 72 struct crypto_skcipher *tfm; 73 struct af_alg_ctx *ctx; 74 struct alg_sock *pask; 75 unsigned statesize; 76 struct sock *psk; 77 int err; 78 79 if (!(req->base.flags & CRYPTO_SKCIPHER_REQ_NOTFINAL)) 80 return 0; 81 82 ctx = ask->private; 83 psk = ask->parent; 84 pask = alg_sk(psk); 85 tfm = pask->private; 86 87 statesize = crypto_skcipher_statesize(tfm); 88 ctx->state = sock_kmalloc(sk, statesize, GFP_ATOMIC); 89 if (!ctx->state) 90 return -ENOMEM; 91 92 err = crypto_skcipher_export(req, ctx->state); 93 if (err) { 94 sock_kzfree_s(sk, ctx->state, statesize); 95 ctx->state = NULL; 96 } 97 98 return err; 99 } 100 101 static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, 102 size_t ignored, int flags) 103 { 104 struct sock *sk = sock->sk; 105 struct alg_sock *ask = alg_sk(sk); 106 struct sock *psk = ask->parent; 107 struct alg_sock *pask = alg_sk(psk); 108 struct af_alg_ctx *ctx = ask->private; 109 struct crypto_skcipher *tfm = pask->private; 110 unsigned int bs = crypto_skcipher_chunksize(tfm); 111 struct af_alg_async_req *areq; 112 unsigned cflags = 0; 113 int err = 0; 114 size_t len = 0; 115 116 if (!ctx->init || (ctx->more && ctx->used < bs)) { 117 err = af_alg_wait_for_data(sk, flags, bs); 118 if (err) 119 return err; 120 } 121 122 /* Allocate cipher request for current operation. */ 123 areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) + 124 crypto_skcipher_reqsize(tfm)); 125 if (IS_ERR(areq)) 126 return PTR_ERR(areq); 127 128 /* convert iovecs of output buffers into RX SGL */ 129 err = af_alg_get_rsgl(sk, msg, flags, areq, ctx->used, &len); 130 if (err) 131 goto free; 132 133 /* 134 * If more buffers are to be expected to be processed, process only 135 * full block size buffers. 136 */ 137 if (ctx->more || len < ctx->used) { 138 size_t excess = len % bs; 139 140 len -= excess; 141 iov_iter_revert(&msg->msg_iter, excess); 142 143 if (!len) { 144 err = -EINVAL; 145 goto free; 146 } 147 148 cflags |= CRYPTO_SKCIPHER_REQ_NOTFINAL; 149 } 150 151 /* 152 * Create a per request TX SGL for this request which tracks the 153 * SG entries from the global TX SGL. 154 */ 155 areq->tsgl_entries = af_alg_count_tsgl(sk, len); 156 if (!areq->tsgl_entries) 157 areq->tsgl_entries = 1; 158 areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl), 159 areq->tsgl_entries), 160 GFP_KERNEL); 161 if (!areq->tsgl) { 162 err = -ENOMEM; 163 goto free; 164 } 165 sg_init_table(areq->tsgl, areq->tsgl_entries); 166 af_alg_pull_tsgl(sk, len, areq->tsgl); 167 168 /* Initialize the crypto operation */ 169 skcipher_request_set_tfm(&areq->cra_u.skcipher_req, tfm); 170 skcipher_request_set_crypt(&areq->cra_u.skcipher_req, areq->tsgl, 171 areq->first_rsgl.sgl.sgt.sgl, len, ctx->iv); 172 173 if (ctx->state) { 174 err = crypto_skcipher_import(&areq->cra_u.skcipher_req, 175 ctx->state); 176 sock_kzfree_s(sk, ctx->state, crypto_skcipher_statesize(tfm)); 177 ctx->state = NULL; 178 if (err) 179 goto free; 180 cflags |= CRYPTO_SKCIPHER_REQ_CONT; 181 } 182 183 skcipher_request_set_callback(&areq->cra_u.skcipher_req, 184 cflags | 185 CRYPTO_TFM_REQ_MAY_SLEEP | 186 CRYPTO_TFM_REQ_MAY_BACKLOG, 187 crypto_req_done, &ctx->wait); 188 err = crypto_wait_req(ctx->enc ? 189 crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) : 190 crypto_skcipher_decrypt(&areq->cra_u.skcipher_req), 191 &ctx->wait); 192 193 if (!err) 194 err = algif_skcipher_export( 195 sk, &areq->cra_u.skcipher_req); 196 197 free: 198 af_alg_free_resources(areq); 199 200 return err ? err : len; 201 } 202 203 static int skcipher_recvmsg(struct socket *sock, struct msghdr *msg, 204 size_t ignored, int flags) 205 { 206 struct sock *sk = sock->sk; 207 int ret = 0; 208 209 lock_sock(sk); 210 while (msg_data_left(msg)) { 211 int err = _skcipher_recvmsg(sock, msg, ignored, flags); 212 213 /* 214 * This error covers -EIOCBQUEUED which implies that we can 215 * only handle one AIO request. If the caller wants to have 216 * multiple AIO requests in parallel, he must make multiple 217 * separate AIO calls. 218 * 219 * Also return the error if no data has been processed so far. 220 */ 221 if (err <= 0) { 222 if (err == -EIOCBQUEUED || !ret) 223 ret = err; 224 goto out; 225 } 226 227 ret += err; 228 } 229 230 out: 231 af_alg_wmem_wakeup(sk); 232 release_sock(sk); 233 return ret; 234 } 235 236 static struct proto_ops algif_skcipher_ops = { 237 .family = PF_ALG, 238 239 .connect = sock_no_connect, 240 .socketpair = sock_no_socketpair, 241 .getname = sock_no_getname, 242 .ioctl = sock_no_ioctl, 243 .listen = sock_no_listen, 244 .shutdown = sock_no_shutdown, 245 .mmap = sock_no_mmap, 246 .bind = sock_no_bind, 247 .accept = sock_no_accept, 248 249 .release = af_alg_release, 250 .sendmsg = skcipher_sendmsg, 251 .recvmsg = skcipher_recvmsg, 252 .poll = af_alg_poll, 253 }; 254 255 static int skcipher_check_key(struct socket *sock) 256 { 257 int err = 0; 258 struct sock *psk; 259 struct alg_sock *pask; 260 struct crypto_skcipher *tfm; 261 struct sock *sk = sock->sk; 262 struct alg_sock *ask = alg_sk(sk); 263 264 lock_sock(sk); 265 if (!atomic_read(&ask->nokey_refcnt)) 266 goto unlock_child; 267 268 psk = ask->parent; 269 pask = alg_sk(ask->parent); 270 tfm = pask->private; 271 272 err = -ENOKEY; 273 lock_sock_nested(psk, SINGLE_DEPTH_NESTING); 274 if (crypto_skcipher_get_flags(tfm) & CRYPTO_TFM_NEED_KEY) 275 goto unlock; 276 277 atomic_dec(&pask->nokey_refcnt); 278 atomic_set(&ask->nokey_refcnt, 0); 279 280 err = 0; 281 282 unlock: 283 release_sock(psk); 284 unlock_child: 285 release_sock(sk); 286 287 return err; 288 } 289 290 static int skcipher_sendmsg_nokey(struct socket *sock, struct msghdr *msg, 291 size_t size) 292 { 293 int err; 294 295 err = skcipher_check_key(sock); 296 if (err) 297 return err; 298 299 return skcipher_sendmsg(sock, msg, size); 300 } 301 302 static int skcipher_recvmsg_nokey(struct socket *sock, struct msghdr *msg, 303 size_t ignored, int flags) 304 { 305 int err; 306 307 err = skcipher_check_key(sock); 308 if (err) 309 return err; 310 311 return skcipher_recvmsg(sock, msg, ignored, flags); 312 } 313 314 static struct proto_ops algif_skcipher_ops_nokey = { 315 .family = PF_ALG, 316 317 .connect = sock_no_connect, 318 .socketpair = sock_no_socketpair, 319 .getname = sock_no_getname, 320 .ioctl = sock_no_ioctl, 321 .listen = sock_no_listen, 322 .shutdown = sock_no_shutdown, 323 .mmap = sock_no_mmap, 324 .bind = sock_no_bind, 325 .accept = sock_no_accept, 326 327 .release = af_alg_release, 328 .sendmsg = skcipher_sendmsg_nokey, 329 .recvmsg = skcipher_recvmsg_nokey, 330 .poll = af_alg_poll, 331 }; 332 333 static void *skcipher_bind(const char *name) 334 { 335 u32 mask = AF_ALG_CRYPTOAPI_MASK; 336 int err; 337 338 err = af_alg_check_restriction(name, skcipher_allowlist); 339 if (err) 340 return ERR_PTR(err); 341 342 if (strcmp(name, "cbc(paes)") == 0) 343 mask = 0; 344 345 return crypto_alloc_skcipher(name, 0, mask); 346 } 347 348 static void skcipher_release(void *private) 349 { 350 crypto_free_skcipher(private); 351 } 352 353 static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen) 354 { 355 return crypto_skcipher_setkey(private, key, keylen); 356 } 357 358 static void skcipher_sock_destruct(struct sock *sk) 359 { 360 struct alg_sock *ask = alg_sk(sk); 361 struct af_alg_ctx *ctx = ask->private; 362 struct sock *psk = ask->parent; 363 struct alg_sock *pask = alg_sk(psk); 364 struct crypto_skcipher *tfm = pask->private; 365 366 af_alg_pull_tsgl(sk, ctx->used, NULL); 367 sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm)); 368 if (ctx->state) 369 sock_kzfree_s(sk, ctx->state, crypto_skcipher_statesize(tfm)); 370 sock_kfree_s(sk, ctx, ctx->len); 371 af_alg_release_parent(sk); 372 } 373 374 static int skcipher_accept_parent_nokey(void *private, struct sock *sk) 375 { 376 struct af_alg_ctx *ctx; 377 struct alg_sock *ask = alg_sk(sk); 378 struct crypto_skcipher *tfm = private; 379 unsigned int len = sizeof(*ctx); 380 381 ctx = sock_kmalloc(sk, len, GFP_KERNEL); 382 if (!ctx) 383 return -ENOMEM; 384 memset(ctx, 0, len); 385 386 ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm), 387 GFP_KERNEL); 388 if (!ctx->iv) { 389 sock_kfree_s(sk, ctx, len); 390 return -ENOMEM; 391 } 392 memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm)); 393 394 INIT_LIST_HEAD(&ctx->tsgl_list); 395 ctx->len = len; 396 crypto_init_wait(&ctx->wait); 397 398 ask->private = ctx; 399 400 sk->sk_destruct = skcipher_sock_destruct; 401 402 return 0; 403 } 404 405 static int skcipher_accept_parent(void *private, struct sock *sk) 406 { 407 struct crypto_skcipher *tfm = private; 408 409 if (crypto_skcipher_get_flags(tfm) & CRYPTO_TFM_NEED_KEY) 410 return -ENOKEY; 411 412 return skcipher_accept_parent_nokey(private, sk); 413 } 414 415 static const struct af_alg_type algif_type_skcipher = { 416 .bind = skcipher_bind, 417 .release = skcipher_release, 418 .setkey = skcipher_setkey, 419 .accept = skcipher_accept_parent, 420 .accept_nokey = skcipher_accept_parent_nokey, 421 .ops = &algif_skcipher_ops, 422 .ops_nokey = &algif_skcipher_ops_nokey, 423 .name = "skcipher", 424 .owner = THIS_MODULE 425 }; 426 427 static int __init algif_skcipher_init(void) 428 { 429 return af_alg_register_type(&algif_type_skcipher); 430 } 431 432 static void __exit algif_skcipher_exit(void) 433 { 434 int err = af_alg_unregister_type(&algif_type_skcipher); 435 BUG_ON(err); 436 } 437 438 module_init(algif_skcipher_init); 439 module_exit(algif_skcipher_exit); 440 MODULE_DESCRIPTION("Userspace interface for skcipher algorithms"); 441 MODULE_LICENSE("GPL"); 442