570b90fa23
Eric Biggers pointed out that the orinoco driver pointed scatterlists at the stack. Fix it by switching from ahash to shash. The result should be simpler, faster, and more correct. kvalo: cherry picked from commit 1fef293b8a9850cfa124a53c1d8878d355010403 as I accidentally applied this patch to wireless-drivers-next when I was supposed to apply this wireless-drivers Cc: stable@vger.kernel.org # 4.9 only Reported-by: Eric Biggers <ebiggers3@gmail.com> Signed-off-by: Andy Lutomirski <luto@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
93 lines
2.2 KiB
C
93 lines
2.2 KiB
C
/* Orinoco MIC helpers
|
|
*
|
|
* See copyright notice in main.c
|
|
*/
|
|
#include <linux/kernel.h>
|
|
#include <linux/string.h>
|
|
#include <linux/if_ether.h>
|
|
#include <linux/scatterlist.h>
|
|
#include <crypto/hash.h>
|
|
|
|
#include "orinoco.h"
|
|
#include "mic.h"
|
|
|
|
/********************************************************************/
|
|
/* Michael MIC crypto setup */
|
|
/********************************************************************/
|
|
int orinoco_mic_init(struct orinoco_private *priv)
|
|
{
|
|
priv->tx_tfm_mic = crypto_alloc_shash("michael_mic", 0,
|
|
CRYPTO_ALG_ASYNC);
|
|
if (IS_ERR(priv->tx_tfm_mic)) {
|
|
printk(KERN_DEBUG "orinoco_mic_init: could not allocate "
|
|
"crypto API michael_mic\n");
|
|
priv->tx_tfm_mic = NULL;
|
|
return -ENOMEM;
|
|
}
|
|
|
|
priv->rx_tfm_mic = crypto_alloc_shash("michael_mic", 0,
|
|
CRYPTO_ALG_ASYNC);
|
|
if (IS_ERR(priv->rx_tfm_mic)) {
|
|
printk(KERN_DEBUG "orinoco_mic_init: could not allocate "
|
|
"crypto API michael_mic\n");
|
|
priv->rx_tfm_mic = NULL;
|
|
return -ENOMEM;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
void orinoco_mic_free(struct orinoco_private *priv)
|
|
{
|
|
if (priv->tx_tfm_mic)
|
|
crypto_free_shash(priv->tx_tfm_mic);
|
|
if (priv->rx_tfm_mic)
|
|
crypto_free_shash(priv->rx_tfm_mic);
|
|
}
|
|
|
|
int orinoco_mic(struct crypto_shash *tfm_michael, u8 *key,
|
|
u8 *da, u8 *sa, u8 priority,
|
|
u8 *data, size_t data_len, u8 *mic)
|
|
{
|
|
SHASH_DESC_ON_STACK(desc, tfm_michael);
|
|
u8 hdr[ETH_HLEN + 2]; /* size of header + padding */
|
|
int err;
|
|
|
|
if (tfm_michael == NULL) {
|
|
printk(KERN_WARNING "orinoco_mic: tfm_michael == NULL\n");
|
|
return -1;
|
|
}
|
|
|
|
/* Copy header into buffer. We need the padding on the end zeroed */
|
|
memcpy(&hdr[0], da, ETH_ALEN);
|
|
memcpy(&hdr[ETH_ALEN], sa, ETH_ALEN);
|
|
hdr[ETH_ALEN * 2] = priority;
|
|
hdr[ETH_ALEN * 2 + 1] = 0;
|
|
hdr[ETH_ALEN * 2 + 2] = 0;
|
|
hdr[ETH_ALEN * 2 + 3] = 0;
|
|
|
|
desc->tfm = tfm_michael;
|
|
desc->flags = 0;
|
|
|
|
err = crypto_shash_setkey(tfm_michael, key, MIC_KEYLEN);
|
|
if (err)
|
|
return err;
|
|
|
|
err = crypto_shash_init(desc);
|
|
if (err)
|
|
return err;
|
|
|
|
err = crypto_shash_update(desc, hdr, sizeof(hdr));
|
|
if (err)
|
|
return err;
|
|
|
|
err = crypto_shash_update(desc, data, data_len);
|
|
if (err)
|
|
return err;
|
|
|
|
err = crypto_shash_final(desc, mic);
|
|
shash_desc_zero(desc);
|
|
|
|
return err;
|
|
}
|