averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels

Browse Source 
commit 6f49f00c98 upstream.

On 64-bit kernels, drbg_max_addtl() returns 2**35 bytes.  That's too
large, for two reasons:

1. SP800-90A says the maximum limit is 2**35 *bits*, not 2**35 bytes.
   So the implemented limit has confused bits and bytes.

2. When drbg_kcapi_hash() calls crypto_shash_update() on the additional
   information string, the length is implicitly cast to 'unsigned int'.
   That truncates the additional information string to U32_MAX bytes.

Fix the maximum additional information string length to always be
U32_MAX - 1, causing an error to be returned for any longer lengths.

Fixes: 541af946fe ("crypto: drbg - SP800-90A Deterministic Random Bit Generator")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Eric Biggers
2026-07-24 16:02:52 +02:00
committed by Greg Kroah-Hartman
parent cc42fb4017
commit d955e2127c
1 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/crypto/drbg.h
+7 -11
View File
@@ -171,19 +171,15 @@ static inline size_t drbg_max_request_bytes(struct drbg_state *drbg)
return (1 << 16);
}
/*
* SP800-90A allows implementations to support additional info / personalization
* strings of up to 2**35 bits. Implementations can have a smaller maximum. We
* use 2**35 - 16 bits == U32_MAX - 1 bytes so that the max + 1 always fits in a
* size_t, allowing drbg_healthcheck_sanity() to verify its enforcement.
*/
static inline size_t drbg_max_addtl(struct drbg_state *drbg)
{
/* SP800-90A requires 2**35 bytes additional info str / pers str */
#if (__BITS_PER_LONG == 32)
/*
* SP800-90A allows smaller maximum numbers to be returned -- we
* return SIZE_MAX - 1 to allow the verification of the enforcement
* of this value in drbg_healthcheck_sanity.
*/
return (SIZE_MAX - 1);
#else
return (1UL<<35);
#endif
return U32_MAX - 1;
}
static inline size_t drbg_max_requests(struct drbg_state *drbg)