Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

[linux-2.6-block.git] / net / rxrpc / rxkad.c

diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index c60c520fde7c0a57850d53886e0fce9fc622f58c..8d8aa3c230b5515d8cde676432c77a733f14afe5 100644 (file)
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -43,6 +43,7 @@ struct rxkad_level2_hdr {
  * packets
  */
 static struct crypto_sync_skcipher *rxkad_ci;
+static struct skcipher_request *rxkad_ci_req;
 static DEFINE_MUTEX(rxkad_ci_mutex);
 
 /*
@@ -99,8 +100,8 @@ error:
  */
 static int rxkad_prime_packet_security(struct rxrpc_connection *conn)
 {
+       struct skcipher_request *req;
        struct rxrpc_key_token *token;
-       SYNC_SKCIPHER_REQUEST_ON_STACK(req, conn->cipher);
        struct scatterlist sg;
        struct rxrpc_crypt iv;
        __be32 *tmpbuf;
@@ -115,6 +116,12 @@ static int rxkad_prime_packet_security(struct rxrpc_connection *conn)
        if (!tmpbuf)
                return -ENOMEM;
 
+       req = skcipher_request_alloc(&conn->cipher->base, GFP_NOFS);
+       if (!req) {
+               kfree(tmpbuf);
+               return -ENOMEM;
+       }
+
        token = conn->params.key->payload.data[0];
        memcpy(&iv, token->kad->session_key, sizeof(iv));
 
@@ -128,7 +135,7 @@ static int rxkad_prime_packet_security(struct rxrpc_connection *conn)
        skcipher_request_set_callback(req, 0, NULL, NULL);
        skcipher_request_set_crypt(req, &sg, &sg, tmpsize, iv.x);
        crypto_skcipher_encrypt(req);
-       skcipher_request_zero(req);
+       skcipher_request_free(req);
 
        memcpy(&conn->csum_iv, tmpbuf + 2, sizeof(conn->csum_iv));
        kfree(tmpbuf);
@@ -136,6 +143,35 @@ static int rxkad_prime_packet_security(struct rxrpc_connection *conn)
        return 0;
 }
 
+/*
+ * Allocate and prepare the crypto request on a call.  For any particular call,
+ * this is called serially for the packets, so no lock should be necessary.
+ */
+static struct skcipher_request *rxkad_get_call_crypto(struct rxrpc_call *call)
+{
+       struct crypto_skcipher *tfm = &call->conn->cipher->base;
+       struct skcipher_request *cipher_req = call->cipher_req;
+
+       if (!cipher_req) {
+               cipher_req = skcipher_request_alloc(tfm, GFP_NOFS);
+               if (!cipher_req)
+                       return NULL;
+               call->cipher_req = cipher_req;
+       }
+
+       return cipher_req;
+}
+
+/*
+ * Clean up the crypto on a call.
+ */
+static void rxkad_free_call_crypto(struct rxrpc_call *call)
+{
+       if (call->cipher_req)
+               skcipher_request_free(call->cipher_req);
+       call->cipher_req = NULL;
+}
+
 /*
  * partially encrypt a packet (level 1 security)
  */
@@ -243,7 +279,7 @@ static int rxkad_secure_packet(struct rxrpc_call *call,
                               void *sechdr)
 {
        struct rxrpc_skb_priv *sp;
-       SYNC_SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
+       struct skcipher_request *req;
        struct rxrpc_crypt iv;
        struct scatterlist sg;
        u32 x, y;
@@ -262,6 +298,10 @@ static int rxkad_secure_packet(struct rxrpc_call *call,
        if (ret < 0)
                return ret;
 
+       req = rxkad_get_call_crypto(call);
+       if (!req)
+               return -ENOMEM;
+
        /* continue encrypting from where we left off */
        memcpy(&iv, call->conn->csum_iv.x, sizeof(iv));
 
@@ -488,7 +528,7 @@ static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
                               unsigned int offset, unsigned int len,
                               rxrpc_seq_t seq, u16 expected_cksum)
 {
-       SYNC_SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
+       struct skcipher_request *req;
        struct rxrpc_crypt iv;
        struct scatterlist sg;
        bool aborted;
@@ -501,6 +541,10 @@ static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
        if (!call->conn->cipher)
                return 0;
 
+       req = rxkad_get_call_crypto(call);
+       if (!req)
+               return -ENOMEM;
+
        /* continue encrypting from where we left off */
        memcpy(&iv, call->conn->csum_iv.x, sizeof(iv));
 
@@ -733,14 +777,18 @@ static void rxkad_calc_response_checksum(struct rxkad_response *response)
 /*
  * encrypt the response packet
  */
-static void rxkad_encrypt_response(struct rxrpc_connection *conn,
-                                  struct rxkad_response *resp,
-                                  const struct rxkad_key *s2)
+static int rxkad_encrypt_response(struct rxrpc_connection *conn,
+                                 struct rxkad_response *resp,
+                                 const struct rxkad_key *s2)
 {
-       SYNC_SKCIPHER_REQUEST_ON_STACK(req, conn->cipher);
+       struct skcipher_request *req;
        struct rxrpc_crypt iv;
        struct scatterlist sg[1];
 
+       req = skcipher_request_alloc(&conn->cipher->base, GFP_NOFS);
+       if (!req)
+               return -ENOMEM;
+
        /* continue encrypting from where we left off */
        memcpy(&iv, s2->session_key, sizeof(iv));
 
@@ -750,7 +798,8 @@ static void rxkad_encrypt_response(struct rxrpc_connection *conn,
        skcipher_request_set_callback(req, 0, NULL, NULL);
        skcipher_request_set_crypt(req, sg, sg, sizeof(resp->encrypted), iv.x);
        crypto_skcipher_encrypt(req);
-       skcipher_request_zero(req);
+       skcipher_request_free(req);
+       return 0;
 }
 
 /*
@@ -825,8 +874,9 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
 
        /* calculate the response checksum and then do the encryption */
        rxkad_calc_response_checksum(resp);
-       rxkad_encrypt_response(conn, resp, token->kad);
-       ret = rxkad_send_response(conn, &sp->hdr, resp, token->kad);
+       ret = rxkad_encrypt_response(conn, resp, token->kad);
+       if (ret == 0)
+               ret = rxkad_send_response(conn, &sp->hdr, resp, token->kad);
        kfree(resp);
        return ret;
 
@@ -1003,18 +1053,16 @@ static void rxkad_decrypt_response(struct rxrpc_connection *conn,
                                   struct rxkad_response *resp,
                                   const struct rxrpc_crypt *session_key)
 {
-       SYNC_SKCIPHER_REQUEST_ON_STACK(req, rxkad_ci);
+       struct skcipher_request *req = rxkad_ci_req;
        struct scatterlist sg[1];
        struct rxrpc_crypt iv;
 
        _enter(",,%08x%08x",
               ntohl(session_key->n[0]), ntohl(session_key->n[1]));
 
-       ASSERT(rxkad_ci != NULL);
-
        mutex_lock(&rxkad_ci_mutex);
        if (crypto_sync_skcipher_setkey(rxkad_ci, session_key->x,
-                                  sizeof(*session_key)) < 0)
+                                       sizeof(*session_key)) < 0)
                BUG();
 
        memcpy(&iv, session_key, sizeof(iv));
@@ -1208,10 +1256,26 @@ static void rxkad_clear(struct rxrpc_connection *conn)
  */
 static int rxkad_init(void)
 {
+       struct crypto_sync_skcipher *tfm;
+       struct skcipher_request *req;
+
        /* pin the cipher we need so that the crypto layer doesn't invoke
         * keventd to go get it */
-       rxkad_ci = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
-       return PTR_ERR_OR_ZERO(rxkad_ci);
+       tfm = crypto_alloc_sync_skcipher("pcbc(fcrypt)", 0, 0);
+       if (IS_ERR(tfm))
+               return PTR_ERR(tfm);
+
+       req = skcipher_request_alloc(&tfm->base, GFP_KERNEL);
+       if (!req)
+               goto nomem_tfm;
+
+       rxkad_ci_req = req;
+       rxkad_ci = tfm;
+       return 0;
+
+nomem_tfm:
+       crypto_free_sync_skcipher(tfm);
+       return -ENOMEM;
 }
 
 /*
@@ -1219,8 +1283,8 @@ static int rxkad_init(void)
  */
 static void rxkad_exit(void)
 {
-       if (rxkad_ci)
-               crypto_free_sync_skcipher(rxkad_ci);
+       crypto_free_sync_skcipher(rxkad_ci);
+       skcipher_request_free(rxkad_ci_req);
 }
 
 /*
@@ -1235,6 +1299,7 @@ const struct rxrpc_security rxkad = {
        .prime_packet_security          = rxkad_prime_packet_security,
        .secure_packet                  = rxkad_secure_packet,
        .verify_packet                  = rxkad_verify_packet,
+       .free_call_crypto               = rxkad_free_call_crypto,
        .locate_data                    = rxkad_locate_data,
        .issue_challenge                = rxkad_issue_challenge,
        .respond_to_challenge           = rxkad_respond_to_challenge,