crypto/aead.c

   1 /*
   2  * AEAD: Authenticated Encryption with Associated Data
   3  *
   4  * This file provides API support for AEAD algorithms.
   5  *
   6  * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the Free
  10  * Software Foundation; either version 2 of the License, or (at your option)
  11  * any later version.
  12  *
  13  */
  14
  15 #include <crypto/internal/geniv.h>
  16 #include <crypto/scatterwalk.h>
  17 #include <linux/err.h>
  18 #include <linux/init.h>
  19 #include <linux/kernel.h>
  20 #include <linux/module.h>
  21 #include <linux/rtnetlink.h>
  22 #include <linux/sched.h>
  23 #include <linux/slab.h>
  24 #include <linux/seq_file.h>
  25 #include <linux/cryptouser.h>
  26 #include <net/netlink.h>
  27
  28 #include "internal.h"
  29
  30 struct compat_request_ctx {
  31         struct scatterlist src[2];
  32         struct scatterlist dst[2];
  33         struct scatterlist ivbuf[2];
  34         struct scatterlist *ivsg;
  35         struct aead_givcrypt_request subreq;
  36 };
  37
  38 static int aead_null_givencrypt(struct aead_givcrypt_request *req);
  39 static int aead_null_givdecrypt(struct aead_givcrypt_request *req);
  40
  41 static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key,
  42                             unsigned int keylen)
  43 {
  44         unsigned long alignmask = crypto_aead_alignmask(tfm);
  45         int ret;
  46         u8 *buffer, *alignbuffer;
  47         unsigned long absize;
  48
  49         absize = keylen + alignmask;
  50         buffer = kmalloc(absize, GFP_ATOMIC);
  51         if (!buffer)
  52                 return -ENOMEM;
  53
  54         alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
  55         memcpy(alignbuffer, key, keylen);
  56         ret = tfm->setkey(tfm, alignbuffer, keylen);
  57         memset(alignbuffer, 0, keylen);
  58         kfree(buffer);
  59         return ret;
  60 }
  61
  62 int crypto_aead_setkey(struct crypto_aead *tfm,
  63                        const u8 *key, unsigned int keylen)
  64 {
  65         unsigned long alignmask = crypto_aead_alignmask(tfm);
  66
  67         tfm = tfm->child;
  68
  69         if ((unsigned long)key & alignmask)
  70                 return setkey_unaligned(tfm, key, keylen);
  71
  72         return tfm->setkey(tfm, key, keylen);
  73 }
  74 EXPORT_SYMBOL_GPL(crypto_aead_setkey);
  75
  76 int crypto_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
  77 {
  78         int err;
  79
  80         if (authsize > crypto_aead_maxauthsize(tfm))
  81                 return -EINVAL;
  82
  83         if (tfm->setauthsize) {
  84                 err = tfm->setauthsize(tfm->child, authsize);
  85                 if (err)
  86                         return err;
  87         }
  88
  89         tfm->child->authsize = authsize;
  90         tfm->authsize = authsize;
  91         return 0;
  92 }
  93 EXPORT_SYMBOL_GPL(crypto_aead_setauthsize);
  94
  95 struct aead_old_request {
  96         struct scatterlist srcbuf[2];
  97         struct scatterlist dstbuf[2];
  98         struct aead_request subreq;
  99 };
 100
 101 unsigned int crypto_aead_reqsize(struct crypto_aead *tfm)
 102 {
 103         return tfm->reqsize + sizeof(struct aead_old_request);
 104 }
 105 EXPORT_SYMBOL_GPL(crypto_aead_reqsize);
 106
 107 static int old_crypt(struct aead_request *req,
 108                      int (*crypt)(struct aead_request *req))
 109 {
 110         struct aead_old_request *nreq = aead_request_ctx(req);
 111         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 112         struct scatterlist *src, *dst;
 113
 114         if (req->old)
 115                 return crypt(req);
 116
 117         src = scatterwalk_ffwd(nreq->srcbuf, req->src, req->assoclen);
 118         dst = req->src == req->dst ?
 119               src : scatterwalk_ffwd(nreq->dstbuf, req->dst, req->assoclen);
 120
 121         aead_request_set_tfm(&nreq->subreq, aead);
 122         aead_request_set_callback(&nreq->subreq, aead_request_flags(req),
 123                                   req->base.complete, req->base.data);
 124         aead_request_set_crypt(&nreq->subreq, src, dst, req->cryptlen,
 125                                req->iv);
 126         aead_request_set_assoc(&nreq->subreq, req->src, req->assoclen);
 127
 128         return crypt(&nreq->subreq);
 129 }
 130
 131 static int old_encrypt(struct aead_request *req)
 132 {
 133         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 134         struct old_aead_alg *alg = crypto_old_aead_alg(aead);
 135
 136         return old_crypt(req, alg->encrypt);
 137 }
 138
 139 static int old_decrypt(struct aead_request *req)
 140 {
 141         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 142         struct old_aead_alg *alg = crypto_old_aead_alg(aead);
 143
 144         return old_crypt(req, alg->decrypt);
 145 }
 146
 147 static int no_givcrypt(struct aead_givcrypt_request *req)
 148 {
 149         return -ENOSYS;
 150 }
 151
 152 static int crypto_old_aead_init_tfm(struct crypto_tfm *tfm)
 153 {
 154         struct old_aead_alg *alg = &tfm->__crt_alg->cra_aead;
 155         struct crypto_aead *crt = __crypto_aead_cast(tfm);
 156
 157         if (max(alg->maxauthsize, alg->ivsize) > PAGE_SIZE / 8)
 158                 return -EINVAL;
 159
 160         crt->setkey = alg->setkey;
 161         crt->setauthsize = alg->setauthsize;
 162         crt->encrypt = old_encrypt;
 163         crt->decrypt = old_decrypt;
 164         if (alg->ivsize) {
 165                 crt->givencrypt = alg->givencrypt ?: no_givcrypt;
 166                 crt->givdecrypt = alg->givdecrypt ?: no_givcrypt;
 167         } else {
 168                 crt->givencrypt = aead_null_givencrypt;
 169                 crt->givdecrypt = aead_null_givdecrypt;
 170         }
 171         crt->child = __crypto_aead_cast(tfm);
 172         crt->authsize = alg->maxauthsize;
 173
 174         return 0;
 175 }
 176
 177 static void crypto_aead_exit_tfm(struct crypto_tfm *tfm)
 178 {
 179         struct crypto_aead *aead = __crypto_aead_cast(tfm);
 180         struct aead_alg *alg = crypto_aead_alg(aead);
 181
 182         alg->exit(aead);
 183 }
 184
 185 static int crypto_aead_init_tfm(struct crypto_tfm *tfm)
 186 {
 187         struct crypto_aead *aead = __crypto_aead_cast(tfm);
 188         struct aead_alg *alg = crypto_aead_alg(aead);
 189
 190         if (crypto_old_aead_alg(aead)->encrypt)
 191                 return crypto_old_aead_init_tfm(tfm);
 192
 193         aead->setkey = alg->setkey;
 194         aead->setauthsize = alg->setauthsize;
 195         aead->encrypt = alg->encrypt;
 196         aead->decrypt = alg->decrypt;
 197         aead->child = __crypto_aead_cast(tfm);
 198         aead->authsize = alg->maxauthsize;
 199
 200         if (alg->exit)
 201                 aead->base.exit = crypto_aead_exit_tfm;
 202
 203         if (alg->init)
 204                 return alg->init(aead);
 205
 206         return 0;
 207 }
 208
 209 #ifdef CONFIG_NET
 210 static int crypto_old_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
 211 {
 212         struct crypto_report_aead raead;
 213         struct old_aead_alg *aead = &alg->cra_aead;
 214
 215         strncpy(raead.type, "aead", sizeof(raead.type));
 216         strncpy(raead.geniv, aead->geniv ?: "<built-in>", sizeof(raead.geniv));
 217
 218         raead.blocksize = alg->cra_blocksize;
 219         raead.maxauthsize = aead->maxauthsize;
 220         raead.ivsize = aead->ivsize;
 221
 222         if (nla_put(skb, CRYPTOCFGA_REPORT_AEAD,
 223                     sizeof(struct crypto_report_aead), &raead))
 224                 goto nla_put_failure;
 225         return 0;
 226
 227 nla_put_failure:
 228         return -EMSGSIZE;
 229 }
 230 #else
 231 static int crypto_old_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
 232 {
 233         return -ENOSYS;
 234 }
 235 #endif
 236
 237 static void crypto_old_aead_show(struct seq_file *m, struct crypto_alg *alg)
 238         __attribute__ ((unused));
 239 static void crypto_old_aead_show(struct seq_file *m, struct crypto_alg *alg)
 240 {
 241         struct old_aead_alg *aead = &alg->cra_aead;
 242
 243         seq_printf(m, "type         : aead\n");
 244         seq_printf(m, "async        : %s\n", alg->cra_flags & CRYPTO_ALG_ASYNC ?
 245                                              "yes" : "no");
 246         seq_printf(m, "blocksize    : %u\n", alg->cra_blocksize);
 247         seq_printf(m, "ivsize       : %u\n", aead->ivsize);
 248         seq_printf(m, "maxauthsize  : %u\n", aead->maxauthsize);
 249         seq_printf(m, "geniv        : %s\n", aead->geniv ?: "<built-in>");
 250 }
 251
 252 const struct crypto_type crypto_aead_type = {
 253         .extsize = crypto_alg_extsize,
 254         .init_tfm = crypto_aead_init_tfm,
 255 #ifdef CONFIG_PROC_FS
 256         .show = crypto_old_aead_show,
 257 #endif
 258         .report = crypto_old_aead_report,
 259         .lookup = crypto_lookup_aead,
 260         .maskclear = ~(CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_GENIV),
 261         .maskset = CRYPTO_ALG_TYPE_MASK,
 262         .type = CRYPTO_ALG_TYPE_AEAD,
 263         .tfmsize = offsetof(struct crypto_aead, base),
 264 };
 265 EXPORT_SYMBOL_GPL(crypto_aead_type);
 266
 267 #ifdef CONFIG_NET
 268 static int crypto_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
 269 {
 270         struct crypto_report_aead raead;
 271         struct aead_alg *aead = container_of(alg, struct aead_alg, base);
 272
 273         strncpy(raead.type, "aead", sizeof(raead.type));
 274         strncpy(raead.geniv, "<none>", sizeof(raead.geniv));
 275
 276         raead.blocksize = alg->cra_blocksize;
 277         raead.maxauthsize = aead->maxauthsize;
 278         raead.ivsize = aead->ivsize;
 279
 280         if (nla_put(skb, CRYPTOCFGA_REPORT_AEAD,
 281                     sizeof(struct crypto_report_aead), &raead))
 282                 goto nla_put_failure;
 283         return 0;
 284
 285 nla_put_failure:
 286         return -EMSGSIZE;
 287 }
 288 #else
 289 static int crypto_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
 290 {
 291         return -ENOSYS;
 292 }
 293 #endif
 294
 295 static void crypto_aead_show(struct seq_file *m, struct crypto_alg *alg)
 296         __attribute__ ((unused));
 297 static void crypto_aead_show(struct seq_file *m, struct crypto_alg *alg)
 298 {
 299         struct aead_alg *aead = container_of(alg, struct aead_alg, base);
 300
 301         seq_printf(m, "type         : aead\n");
 302         seq_printf(m, "async        : %s\n", alg->cra_flags & CRYPTO_ALG_ASYNC ?
 303                                              "yes" : "no");
 304         seq_printf(m, "blocksize    : %u\n", alg->cra_blocksize);
 305         seq_printf(m, "ivsize       : %u\n", aead->ivsize);
 306         seq_printf(m, "maxauthsize  : %u\n", aead->maxauthsize);
 307         seq_printf(m, "geniv        : <none>\n");
 308 }
 309
 310 static void crypto_aead_free_instance(struct crypto_instance *inst)
 311 {
 312         struct aead_instance *aead = aead_instance(inst);
 313
 314         if (!aead->free) {
 315                 inst->tmpl->free(inst);
 316                 return;
 317         }
 318
 319         aead->free(aead);
 320 }
 321
 322 static const struct crypto_type crypto_new_aead_type = {
 323         .extsize = crypto_alg_extsize,
 324         .init_tfm = crypto_aead_init_tfm,
 325         .free = crypto_aead_free_instance,
 326 #ifdef CONFIG_PROC_FS
 327         .show = crypto_aead_show,
 328 #endif
 329         .report = crypto_aead_report,
 330         .maskclear = ~CRYPTO_ALG_TYPE_MASK,
 331         .maskset = CRYPTO_ALG_TYPE_MASK,
 332         .type = CRYPTO_ALG_TYPE_AEAD,
 333         .tfmsize = offsetof(struct crypto_aead, base),
 334 };
 335
 336 static int aead_null_givencrypt(struct aead_givcrypt_request *req)
 337 {
 338         return crypto_aead_encrypt(&req->areq);
 339 }
 340
 341 static int aead_null_givdecrypt(struct aead_givcrypt_request *req)
 342 {
 343         return crypto_aead_decrypt(&req->areq);
 344 }
 345
 346 #ifdef CONFIG_NET
 347 static int crypto_nivaead_report(struct sk_buff *skb, struct crypto_alg *alg)
 348 {
 349         struct crypto_report_aead raead;
 350         struct old_aead_alg *aead = &alg->cra_aead;
 351
 352         strncpy(raead.type, "nivaead", sizeof(raead.type));
 353         strncpy(raead.geniv, aead->geniv, sizeof(raead.geniv));
 354
 355         raead.blocksize = alg->cra_blocksize;
 356         raead.maxauthsize = aead->maxauthsize;
 357         raead.ivsize = aead->ivsize;
 358
 359         if (nla_put(skb, CRYPTOCFGA_REPORT_AEAD,
 360                     sizeof(struct crypto_report_aead), &raead))
 361                 goto nla_put_failure;
 362         return 0;
 363
 364 nla_put_failure:
 365         return -EMSGSIZE;
 366 }
 367 #else
 368 static int crypto_nivaead_report(struct sk_buff *skb, struct crypto_alg *alg)
 369 {
 370         return -ENOSYS;
 371 }
 372 #endif
 373
 374
 375 static void crypto_nivaead_show(struct seq_file *m, struct crypto_alg *alg)
 376         __attribute__ ((unused));
 377 static void crypto_nivaead_show(struct seq_file *m, struct crypto_alg *alg)
 378 {
 379         struct old_aead_alg *aead = &alg->cra_aead;
 380
 381         seq_printf(m, "type         : nivaead\n");
 382         seq_printf(m, "async        : %s\n", alg->cra_flags & CRYPTO_ALG_ASYNC ?
 383                                              "yes" : "no");
 384         seq_printf(m, "blocksize    : %u\n", alg->cra_blocksize);
 385         seq_printf(m, "ivsize       : %u\n", aead->ivsize);
 386         seq_printf(m, "maxauthsize  : %u\n", aead->maxauthsize);
 387         seq_printf(m, "geniv        : %s\n", aead->geniv);
 388 }
 389
 390 const struct crypto_type crypto_nivaead_type = {
 391         .extsize = crypto_alg_extsize,
 392         .init_tfm = crypto_aead_init_tfm,
 393 #ifdef CONFIG_PROC_FS
 394         .show = crypto_nivaead_show,
 395 #endif
 396         .report = crypto_nivaead_report,
 397         .maskclear = ~(CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_GENIV),
 398         .maskset = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_GENIV,
 399         .type = CRYPTO_ALG_TYPE_AEAD,
 400         .tfmsize = offsetof(struct crypto_aead, base),
 401 };
 402 EXPORT_SYMBOL_GPL(crypto_nivaead_type);
 403
 404 static int crypto_grab_nivaead(struct crypto_aead_spawn *spawn,
 405                                const char *name, u32 type, u32 mask)
 406 {
 407         spawn->base.frontend = &crypto_nivaead_type;
 408         return crypto_grab_spawn(&spawn->base, name, type, mask);
 409 }
 410
 411 static int aead_geniv_setkey(struct crypto_aead *tfm,
 412                              const u8 *key, unsigned int keylen)
 413 {
 414         struct aead_geniv_ctx *ctx = crypto_aead_ctx(tfm);
 415
 416         return crypto_aead_setkey(ctx->child, key, keylen);
 417 }
 418
 419 static int aead_geniv_setauthsize(struct crypto_aead *tfm,
 420                                   unsigned int authsize)
 421 {
 422         struct aead_geniv_ctx *ctx = crypto_aead_ctx(tfm);
 423
 424         return crypto_aead_setauthsize(ctx->child, authsize);
 425 }
 426
 427 static void compat_encrypt_complete2(struct aead_request *req, int err)
 428 {
 429         struct compat_request_ctx *rctx = aead_request_ctx(req);
 430         struct aead_givcrypt_request *subreq = &rctx->subreq;
 431         struct crypto_aead *geniv;
 432
 433         if (err == -EINPROGRESS)
 434                 return;
 435
 436         if (err)
 437                 goto out;
 438
 439         geniv = crypto_aead_reqtfm(req);
 440         scatterwalk_map_and_copy(subreq->giv, rctx->ivsg, 0,
 441                                  crypto_aead_ivsize(geniv), 1);
 442
 443 out:
 444         kzfree(subreq->giv);
 445 }
 446
 447 static void compat_encrypt_complete(struct crypto_async_request *base, int err)
 448 {
 449         struct aead_request *req = base->data;
 450
 451         compat_encrypt_complete2(req, err);
 452         aead_request_complete(req, err);
 453 }
 454
 455 static int compat_encrypt(struct aead_request *req)
 456 {
 457         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 458         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 459         struct compat_request_ctx *rctx = aead_request_ctx(req);
 460         struct aead_givcrypt_request *subreq = &rctx->subreq;
 461         unsigned int ivsize = crypto_aead_ivsize(geniv);
 462         struct scatterlist *src, *dst;
 463         crypto_completion_t compl;
 464         void *data;
 465         u8 *info;
 466         __be64 seq;
 467         int err;
 468
 469         if (req->cryptlen < ivsize)
 470                 return -EINVAL;
 471
 472         compl = req->base.complete;
 473         data = req->base.data;
 474
 475         rctx->ivsg = scatterwalk_ffwd(rctx->ivbuf, req->dst, req->assoclen);
 476         info = PageHighMem(sg_page(rctx->ivsg)) ? NULL : sg_virt(rctx->ivsg);
 477
 478         if (!info) {
 479                 info = kmalloc(ivsize, req->base.flags &
 480                                        CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
 481                                                                   GFP_ATOMIC);
 482                 if (!info)
 483                         return -ENOMEM;
 484
 485                 compl = compat_encrypt_complete;
 486                 data = req;
 487         }
 488
 489         memcpy(&seq, req->iv + ivsize - sizeof(seq), sizeof(seq));
 490
 491         src = scatterwalk_ffwd(rctx->src, req->src, req->assoclen + ivsize);
 492         dst = req->src == req->dst ?
 493               src : scatterwalk_ffwd(rctx->dst, rctx->ivsg, ivsize);
 494
 495         aead_givcrypt_set_tfm(subreq, ctx->child);
 496         aead_givcrypt_set_callback(subreq, req->base.flags,
 497                                    req->base.complete, req->base.data);
 498         aead_givcrypt_set_crypt(subreq, src, dst,
 499                                 req->cryptlen - ivsize, req->iv);
 500         aead_givcrypt_set_assoc(subreq, req->src, req->assoclen);
 501         aead_givcrypt_set_giv(subreq, info, be64_to_cpu(seq));
 502
 503         err = crypto_aead_givencrypt(subreq);
 504         if (unlikely(PageHighMem(sg_page(rctx->ivsg))))
 505                 compat_encrypt_complete2(req, err);
 506         return err;
 507 }
 508
 509 static int compat_decrypt(struct aead_request *req)
 510 {
 511         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 512         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 513         struct compat_request_ctx *rctx = aead_request_ctx(req);
 514         struct aead_request *subreq = &rctx->subreq.areq;
 515         unsigned int ivsize = crypto_aead_ivsize(geniv);
 516         struct scatterlist *src, *dst;
 517         crypto_completion_t compl;
 518         void *data;
 519
 520         if (req->cryptlen < ivsize)
 521                 return -EINVAL;
 522
 523         aead_request_set_tfm(subreq, ctx->child);
 524
 525         compl = req->base.complete;
 526         data = req->base.data;
 527
 528         src = scatterwalk_ffwd(rctx->src, req->src, req->assoclen + ivsize);
 529         dst = req->src == req->dst ?
 530               src : scatterwalk_ffwd(rctx->dst, req->dst,
 531                                      req->assoclen + ivsize);
 532
 533         aead_request_set_callback(subreq, req->base.flags, compl, data);
 534         aead_request_set_crypt(subreq, src, dst,
 535                                req->cryptlen - ivsize, req->iv);
 536         aead_request_set_assoc(subreq, req->src, req->assoclen);
 537
 538         scatterwalk_map_and_copy(req->iv, req->src, req->assoclen, ivsize, 0);
 539
 540         return crypto_aead_decrypt(subreq);
 541 }
 542
 543 static int compat_encrypt_first(struct aead_request *req)
 544 {
 545         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 546         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 547         int err = 0;
 548
 549         spin_lock_bh(&ctx->lock);
 550         if (geniv->encrypt != compat_encrypt_first)
 551                 goto unlock;
 552
 553         geniv->encrypt = compat_encrypt;
 554
 555 unlock:
 556         spin_unlock_bh(&ctx->lock);
 557
 558         if (err)
 559                 return err;
 560
 561         return compat_encrypt(req);
 562 }
 563
 564 static int aead_geniv_init_compat(struct crypto_tfm *tfm)
 565 {
 566         struct crypto_aead *geniv = __crypto_aead_cast(tfm);
 567         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 568         int err;
 569
 570         spin_lock_init(&ctx->lock);
 571
 572         crypto_aead_set_reqsize(geniv, sizeof(struct compat_request_ctx));
 573
 574         err = aead_geniv_init(tfm);
 575
 576         ctx->child = geniv->child;
 577         geniv->child = geniv;
 578
 579         return err;
 580 }
 581
 582 static void aead_geniv_exit_compat(struct crypto_tfm *tfm)
 583 {
 584         struct crypto_aead *geniv = __crypto_aead_cast(tfm);
 585         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 586
 587         crypto_free_aead(ctx->child);
 588 }
 589
 590 struct aead_instance *aead_geniv_alloc(struct crypto_template *tmpl,
 591                                        struct rtattr **tb, u32 type, u32 mask)
 592 {
 593         const char *name;
 594         struct crypto_aead_spawn *spawn;
 595         struct crypto_attr_type *algt;
 596         struct aead_instance *inst;
 597         struct aead_alg *alg;
 598         unsigned int ivsize;
 599         unsigned int maxauthsize;
 600         int err;
 601
 602         algt = crypto_get_attr_type(tb);
 603         if (IS_ERR(algt))
 604                 return ERR_CAST(algt);
 605
 606         if ((algt->type ^ (CRYPTO_ALG_TYPE_AEAD | CRYPTO_ALG_GENIV)) &
 607             algt->mask)
 608                 return ERR_PTR(-EINVAL);
 609
 610         name = crypto_attr_alg_name(tb[1]);
 611         if (IS_ERR(name))
 612                 return ERR_CAST(name);
 613
 614         inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
 615         if (!inst)
 616                 return ERR_PTR(-ENOMEM);
 617
 618         spawn = aead_instance_ctx(inst);
 619
 620         /* Ignore async algorithms if necessary. */
 621         mask |= crypto_requires_sync(algt->type, algt->mask);
 622
 623         crypto_set_aead_spawn(spawn, aead_crypto_instance(inst));
 624         err = (algt->mask & CRYPTO_ALG_GENIV) ?
 625               crypto_grab_nivaead(spawn, name, type, mask) :
 626               crypto_grab_aead(spawn, name, type, mask);
 627         if (err)
 628                 goto err_free_inst;
 629
 630         alg = crypto_spawn_aead_alg(spawn);
 631
 632         ivsize = crypto_aead_alg_ivsize(alg);
 633         maxauthsize = crypto_aead_alg_maxauthsize(alg);
 634
 635         err = -EINVAL;
 636         if (ivsize < sizeof(u64))
 637                 goto err_drop_alg;
 638
 639         /*
 640          * This is only true if we're constructing an algorithm with its
 641          * default IV generator.  For the default generator we elide the
 642          * template name and double-check the IV generator.
 643          */
 644         if (algt->mask & CRYPTO_ALG_GENIV) {
 645                 if (!alg->base.cra_aead.encrypt)
 646                         goto err_drop_alg;
 647                 if (strcmp(tmpl->name, alg->base.cra_aead.geniv))
 648                         goto err_drop_alg;
 649
 650                 memcpy(inst->alg.base.cra_name, alg->base.cra_name,
 651                        CRYPTO_MAX_ALG_NAME);
 652                 memcpy(inst->alg.base.cra_driver_name,
 653                        alg->base.cra_driver_name, CRYPTO_MAX_ALG_NAME);
 654
 655                 inst->alg.base.cra_flags = CRYPTO_ALG_TYPE_AEAD |
 656                                            CRYPTO_ALG_GENIV;
 657                 inst->alg.base.cra_flags |= alg->base.cra_flags &
 658                                             CRYPTO_ALG_ASYNC;
 659                 inst->alg.base.cra_priority = alg->base.cra_priority;
 660                 inst->alg.base.cra_blocksize = alg->base.cra_blocksize;
 661                 inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
 662                 inst->alg.base.cra_type = &crypto_aead_type;
 663
 664                 inst->alg.base.cra_aead.ivsize = ivsize;
 665                 inst->alg.base.cra_aead.maxauthsize = maxauthsize;
 666
 667                 inst->alg.base.cra_aead.setkey = alg->base.cra_aead.setkey;
 668                 inst->alg.base.cra_aead.setauthsize =
 669                         alg->base.cra_aead.setauthsize;
 670                 inst->alg.base.cra_aead.encrypt = alg->base.cra_aead.encrypt;
 671                 inst->alg.base.cra_aead.decrypt = alg->base.cra_aead.decrypt;
 672
 673                 goto out;
 674         }
 675
 676         err = -ENAMETOOLONG;
 677         if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
 678                      "%s(%s)", tmpl->name, alg->base.cra_name) >=
 679             CRYPTO_MAX_ALG_NAME)
 680                 goto err_drop_alg;
 681         if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
 682                      "%s(%s)", tmpl->name, alg->base.cra_driver_name) >=
 683             CRYPTO_MAX_ALG_NAME)
 684                 goto err_drop_alg;
 685
 686         inst->alg.base.cra_flags = alg->base.cra_flags & CRYPTO_ALG_ASYNC;
 687         inst->alg.base.cra_priority = alg->base.cra_priority;
 688         inst->alg.base.cra_blocksize = alg->base.cra_blocksize;
 689         inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
 690         inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
 691
 692         inst->alg.setkey = aead_geniv_setkey;
 693         inst->alg.setauthsize = aead_geniv_setauthsize;
 694
 695         inst->alg.ivsize = ivsize;
 696         inst->alg.maxauthsize = maxauthsize;
 697
 698         inst->alg.encrypt = compat_encrypt_first;
 699         inst->alg.decrypt = compat_decrypt;
 700
 701         inst->alg.base.cra_init = aead_geniv_init_compat;
 702         inst->alg.base.cra_exit = aead_geniv_exit_compat;
 703
 704 out:
 705         return inst;
 706
 707 err_drop_alg:
 708         crypto_drop_aead(spawn);
 709 err_free_inst:
 710         kfree(inst);
 711         inst = ERR_PTR(err);
 712         goto out;
 713 }
 714 EXPORT_SYMBOL_GPL(aead_geniv_alloc);
 715
 716 void aead_geniv_free(struct aead_instance *inst)
 717 {
 718         crypto_drop_aead(aead_instance_ctx(inst));
 719         kfree(inst);
 720 }
 721 EXPORT_SYMBOL_GPL(aead_geniv_free);
 722
 723 int aead_geniv_init(struct crypto_tfm *tfm)
 724 {
 725         struct crypto_instance *inst = (void *)tfm->__crt_alg;
 726         struct crypto_aead *child;
 727         struct crypto_aead *aead;
 728
 729         aead = __crypto_aead_cast(tfm);
 730
 731         child = crypto_spawn_aead(crypto_instance_ctx(inst));
 732         if (IS_ERR(child))
 733                 return PTR_ERR(child);
 734
 735         aead->child = child;
 736         aead->reqsize += crypto_aead_reqsize(child);
 737
 738         return 0;
 739 }
 740 EXPORT_SYMBOL_GPL(aead_geniv_init);
 741
 742 void aead_geniv_exit(struct crypto_tfm *tfm)
 743 {
 744         crypto_free_aead(__crypto_aead_cast(tfm)->child);
 745 }
 746 EXPORT_SYMBOL_GPL(aead_geniv_exit);
 747
 748 static int crypto_nivaead_default(struct crypto_alg *alg, u32 type, u32 mask)
 749 {
 750         struct rtattr *tb[3];
 751         struct {
 752                 struct rtattr attr;
 753                 struct crypto_attr_type data;
 754         } ptype;
 755         struct {
 756                 struct rtattr attr;
 757                 struct crypto_attr_alg data;
 758         } palg;
 759         struct crypto_template *tmpl;
 760         struct crypto_instance *inst;
 761         struct crypto_alg *larval;
 762         const char *geniv;
 763         int err;
 764
 765         larval = crypto_larval_lookup(alg->cra_driver_name,
 766                                       CRYPTO_ALG_TYPE_AEAD | CRYPTO_ALG_GENIV,
 767                                       CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_GENIV);
 768         err = PTR_ERR(larval);
 769         if (IS_ERR(larval))
 770                 goto out;
 771
 772         err = -EAGAIN;
 773         if (!crypto_is_larval(larval))
 774                 goto drop_larval;
 775
 776         ptype.attr.rta_len = sizeof(ptype);
 777         ptype.attr.rta_type = CRYPTOA_TYPE;
 778         ptype.data.type = type | CRYPTO_ALG_GENIV;
 779         /* GENIV tells the template that we're making a default geniv. */
 780         ptype.data.mask = mask | CRYPTO_ALG_GENIV;
 781         tb[0] = &ptype.attr;
 782
 783         palg.attr.rta_len = sizeof(palg);
 784         palg.attr.rta_type = CRYPTOA_ALG;
 785         /* Must use the exact name to locate ourselves. */
 786         memcpy(palg.data.name, alg->cra_driver_name, CRYPTO_MAX_ALG_NAME);
 787         tb[1] = &palg.attr;
 788
 789         tb[2] = NULL;
 790
 791         geniv = alg->cra_aead.geniv;
 792
 793         tmpl = crypto_lookup_template(geniv);
 794         err = -ENOENT;
 795         if (!tmpl)
 796                 goto kill_larval;
 797
 798         if (tmpl->create) {
 799                 err = tmpl->create(tmpl, tb);
 800                 if (err)
 801                         goto put_tmpl;
 802                 goto ok;
 803         }
 804
 805         inst = tmpl->alloc(tb);
 806         err = PTR_ERR(inst);
 807         if (IS_ERR(inst))
 808                 goto put_tmpl;
 809
 810         err = crypto_register_instance(tmpl, inst);
 811         if (err) {
 812                 tmpl->free(inst);
 813                 goto put_tmpl;
 814         }
 815
 816 ok:
 817         /* Redo the lookup to use the instance we just registered. */
 818         err = -EAGAIN;
 819
 820 put_tmpl:
 821         crypto_tmpl_put(tmpl);
 822 kill_larval:
 823         crypto_larval_kill(larval);
 824 drop_larval:
 825         crypto_mod_put(larval);
 826 out:
 827         crypto_mod_put(alg);
 828         return err;
 829 }
 830
 831 struct crypto_alg *crypto_lookup_aead(const char *name, u32 type, u32 mask)
 832 {
 833         struct crypto_alg *alg;
 834
 835         alg = crypto_alg_mod_lookup(name, type, mask);
 836         if (IS_ERR(alg))
 837                 return alg;
 838
 839         if (alg->cra_type == &crypto_aead_type)
 840                 return alg;
 841
 842         if (!alg->cra_aead.ivsize)
 843                 return alg;
 844
 845         crypto_mod_put(alg);
 846         alg = crypto_alg_mod_lookup(name, type | CRYPTO_ALG_TESTED,
 847                                     mask & ~CRYPTO_ALG_TESTED);
 848         if (IS_ERR(alg))
 849                 return alg;
 850
 851         if (alg->cra_type == &crypto_aead_type) {
 852                 if (~alg->cra_flags & (type ^ ~mask) & CRYPTO_ALG_TESTED) {
 853                         crypto_mod_put(alg);
 854                         alg = ERR_PTR(-ENOENT);
 855                 }
 856                 return alg;
 857         }
 858
 859         BUG_ON(!alg->cra_aead.ivsize);
 860
 861         return ERR_PTR(crypto_nivaead_default(alg, type, mask));
 862 }
 863 EXPORT_SYMBOL_GPL(crypto_lookup_aead);
 864
 865 int crypto_grab_aead(struct crypto_aead_spawn *spawn, const char *name,
 866                      u32 type, u32 mask)
 867 {
 868         spawn->base.frontend = &crypto_aead_type;
 869         return crypto_grab_spawn(&spawn->base, name, type, mask);
 870 }
 871 EXPORT_SYMBOL_GPL(crypto_grab_aead);
 872
 873 struct crypto_aead *crypto_alloc_aead(const char *alg_name, u32 type, u32 mask)
 874 {
 875         return crypto_alloc_tfm(alg_name, &crypto_aead_type, type, mask);
 876 }
 877 EXPORT_SYMBOL_GPL(crypto_alloc_aead);
 878
 879 static int aead_prepare_alg(struct aead_alg *alg)
 880 {
 881         struct crypto_alg *base = &alg->base;
 882
 883         if (max(alg->maxauthsize, alg->ivsize) > PAGE_SIZE / 8)
 884                 return -EINVAL;
 885
 886         base->cra_type = &crypto_new_aead_type;
 887         base->cra_flags &= ~CRYPTO_ALG_TYPE_MASK;
 888         base->cra_flags |= CRYPTO_ALG_TYPE_AEAD;
 889
 890         return 0;
 891 }
 892
 893 int crypto_register_aead(struct aead_alg *alg)
 894 {
 895         struct crypto_alg *base = &alg->base;
 896         int err;
 897
 898         err = aead_prepare_alg(alg);
 899         if (err)
 900                 return err;
 901
 902         return crypto_register_alg(base);
 903 }
 904 EXPORT_SYMBOL_GPL(crypto_register_aead);
 905
 906 void crypto_unregister_aead(struct aead_alg *alg)
 907 {
 908         crypto_unregister_alg(&alg->base);
 909 }
 910 EXPORT_SYMBOL_GPL(crypto_unregister_aead);
 911
 912 int crypto_register_aeads(struct aead_alg *algs, int count)
 913 {
 914         int i, ret;
 915
 916         for (i = 0; i < count; i++) {
 917                 ret = crypto_register_aead(&algs[i]);
 918                 if (ret)
 919                         goto err;
 920         }
 921
 922         return 0;
 923
 924 err:
 925         for (--i; i >= 0; --i)
 926                 crypto_unregister_aead(&algs[i]);
 927
 928         return ret;
 929 }
 930 EXPORT_SYMBOL_GPL(crypto_register_aeads);
 931
 932 void crypto_unregister_aeads(struct aead_alg *algs, int count)
 933 {
 934         int i;
 935
 936         for (i = count - 1; i >= 0; --i)
 937                 crypto_unregister_aead(&algs[i]);
 938 }
 939 EXPORT_SYMBOL_GPL(crypto_unregister_aeads);
 940
 941 int aead_register_instance(struct crypto_template *tmpl,
 942                            struct aead_instance *inst)
 943 {
 944         int err;
 945
 946         err = aead_prepare_alg(&inst->alg);
 947         if (err)
 948                 return err;
 949
 950         return crypto_register_instance(tmpl, aead_crypto_instance(inst));
 951 }
 952 EXPORT_SYMBOL_GPL(aead_register_instance);
 953
 954 MODULE_LICENSE("GPL");
 955 MODULE_DESCRIPTION("Authenticated Encryption with Associated Data (AEAD)");