Jason A. Donenfeld c5596fe183 crypto: skcipher - Copy iv from desc even for 0-len walks ... commit 70d906bc17500edfa9bdd8c8b7e59618c7911613 upstream. Some ciphers actually support encrypting zero length plaintexts. For example, many AEAD modes support this. The resulting ciphertext for those winds up being only the authentication tag, which is a result of the key, the iv, the additional data, and the fact that the plaintext had zero length. The blkcipher constructors won't copy the IV to the right place, however, when using a zero length input, resulting in some significant problems when ciphers call their initialization routines, only to find that the ->iv parameter is uninitialized. One such example of this would be using chacha20poly1305 with a zero length input, which then calls chacha20, which calls the key setup routine, which eventually OOPSes due to the uninitialized ->iv member. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> [lizf: Backported to 3.4: adjust context] Signed-off-by: Zefan Li <lizefan@huawei.com>		2016-10-26 23:15:36 +08:00
..
async_tx	crypto: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:16 +08:00
ablkcipher.c	crypto: skcipher - Copy iv from desc even for 0-len walks	2016-10-26 23:15:36 +08:00
aead.c	crypto: user - fix info leaks in report API	2013-03-14 11:29:50 -07:00
aes_generic.c
af_alg.c	crypto: af_alg - fix backlog handling	2015-04-14 17:33:48 +08:00
ahash.c	crypto: ahash - ensure statesize is non-zero	2016-04-27 18:55:27 +08:00
algapi.c	crypto: api - Only abort operations on fatal signal	2016-04-27 18:55:28 +08:00
algboss.c
algif_hash.c	crypto: algif_hash - Only export and import on sockets with data	2016-10-26 23:15:26 +08:00
algif_skcipher.c	Revert "net: update consumers of MSG_MORE to recognize MSG_SENDPAGE_NOTLAST"	2013-12-20 07:34:21 -08:00
ansi_cprng.c	crypto: ansi_cprng - Fix off by one error in non-block size request	2013-11-29 10:50:32 -08:00
anubis.c
api.c	crypto: api - Only abort operations on fatal signal	2016-04-27 18:55:28 +08:00
arc4.c	crypto: arc4 - Fixed coding style issues	2011-06-30 07:44:05 +08:00
authenc.c	crypto: authenc - Find proper IV address in ablkcipher callback	2013-12-11 22:34:10 -08:00
authencesn.c
blkcipher.c	crypto: skcipher - Copy iv from desc even for 0-len walks	2016-10-26 23:15:36 +08:00
blowfish_common.c	crypto: blowfish - split generic and common c code	2011-09-22 21:25:25 +10:00
blowfish_generic.c	crypto: blowfish - rename C-version to blowfish_generic	2011-09-22 21:25:26 +10:00
camellia_generic.c	crypto: camellia - rename camellia.c to camellia_generic.c	2012-03-14 17:25:55 +08:00
cast5.c
cast6.c
cbc.c
ccm.c	crypto: ccm - Fix handling of zero plaintext when computing mac	2013-12-11 22:34:10 -08:00
chainiv.c
cipher.c
compress.c
crc32c.c	crypto: crc32c should use library implementation	2012-03-23 16:58:38 -07:00
cryptd.c	crypto: cryptd - disable softirqs in cryptd_queue_worker to prevent data corruption	2012-11-26 11:37:41 -08:00
crypto_null.c
crypto_user.c	crypto: api - Only abort operations on fatal signal	2016-04-27 18:55:28 +08:00
crypto_wq.c	crypto: crypto_wq - Fix late crypto work queue initialization	2014-06-07 16:02:02 -07:00
ctr.c
cts.c
deflate.c	net+crypto: Use vmalloc for zlib inflate buffers.	2011-06-29 05:48:41 -07:00
des_generic.c
ecb.c
eseqiv.c
fcrypt.c
fips.c
gcm.c	crypto: gcm - fix assumption that assoc has one segment	2013-04-12 09:38:46 -07:00
gf128mul.c	crypto: gf128mul - fix call to memset()	2011-07-08 17:21:21 +08:00
ghash-generic.c	crypto: ghash - Avoid null pointer dereference if no key is set	2011-10-21 13:18:42 +02:00
hmac.c
internal.h	crypto: Export crypto_remove_final	2011-10-21 14:24:03 +02:00
Kconfig	um: several x86 hw-dependent crypto modules won't build on uml	2012-04-09 14:02:13 -04:00
khazad.c
krng.c
lrw.c	crypto: lrw - add interface for parallelized cipher implementions	2011-11-09 11:50:31 +08:00
lzo.c
Makefile	crypto: camellia - rename camellia.c to camellia_generic.c	2012-03-14 17:25:55 +08:00
md4.c	crypto: add module.h to those files that are explicitly using it	2011-10-31 19:31:11 -04:00
md5.c	crypto: Move md5_transform to lib/md5.c	2011-08-06 18:32:45 -07:00
michael_mic.c
pcbc.c
pcompress.c	crypto: user - fix info leaks in report API	2013-03-14 11:29:50 -07:00
pcrypt.c	crypto: pcrypt - Use the online cpumask as the default	2012-03-29 19:52:47 +08:00
proc.c	crypto: add module.h to those files that are explicitly using it	2011-10-31 19:31:11 -04:00
ripemd.h
rmd128.c
rmd160.c
rmd256.c
rmd320.c
rng.c	crypto: user - fix info leaks in report API	2013-03-14 11:29:50 -07:00
salsa20_generic.c
scatterwalk.c	crypto: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:16 +08:00
seed.c
seqiv.c
serpent_generic.c	crypto: serpent - rename serpent.c to serpent_generic.c	2011-11-30 16:12:44 +08:00
sha1_generic.c	crypto: sha1 - export sha1_update for reuse	2011-08-10 19:00:28 +08:00
sha256_generic.c
sha512_generic.c	crypto: sha512 - Fix byte counter overflow in SHA-512	2012-04-05 20:34:20 +08:00
shash.c	crypto: user - fix info leaks in report API	2013-03-14 11:29:50 -07:00
tcrypt.c	crypto: tcrypt - add more camellia tests	2012-03-14 17:25:55 +08:00
tcrypt.h	crypto: tcrypt - add xts(serpent) tests	2011-11-09 11:57:56 +08:00
tea.c
testmgr.c	crypto: testmgr - add more camellia test vectors	2012-03-14 17:25:54 +08:00
testmgr.h	crypto: testmgr - update LZO compression test vectors	2014-07-28 07:06:44 -07:00
tgr192.c
twofish_common.c	crypto: twofish-x86_64-3way - add lrw support	2011-11-09 11:53:32 +08:00
twofish_generic.c
vmac.c	crypto: add module.h to those files that are explicitly using it	2011-10-31 19:31:11 -04:00
wp512.c	crypto: whirlpool - count rounds from 0	2011-10-21 14:24:16 +02:00
xcbc.c	crypto: add module.h to those files that are explicitly using it	2011-10-31 19:31:11 -04:00
xor.c
xts.c	crypto: xts: add interface for parallelized cipher implementations	2011-11-09 11:56:06 +08:00
zlib.c	net+crypto: Use vmalloc for zlib inflate buffers.	2011-06-29 05:48:41 -07:00