A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 11:11:45 -04:00
Code Issues Projects Releases Packages Wiki Activity

ANDROID: block: Prevent crypto fallback for wrapped keys

Browse source 
blk-crypto-fallback does not support wrapped keys, hence
prevent falling back when program_key fails. Add 'is_hw_wrapped'
flag to blk-crypto-key to mention if the key is wrapped
when the key is initialized.

Bug: 147209885

Test: Validate FBE, simulate a failure in the underlying blk
      device and ensure the call fails without falling back
      to blk-crypto-fallback.

Change-Id: I8bc301ca1ac9e55ba6ab622e8325486916b45c56
Signed-off-by: Barani Muthukumaran <[email protected]>
This commit is contained in:
Barani Muthukumaran 2020-02-06 18:01:20 -08:00 • committed by Todd Kjos
commit 3ab1972984
10 changed files with 89 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

3
fs/crypto/fscrypt_private.h
View file

@ -318,6 +318,7 @@ extern int fscrypt_prepare_inline_crypt_key(
struct fscrypt_prepared_key *prep_key,
const u8 *raw_key,
unsigned int raw_key_size,
bool is_hw_wrapped,
const struct fscrypt_info *ci);
extern void fscrypt_destroy_inline_crypt_key(
@ -362,6 +363,7 @@ static inline bool fscrypt_using_inline_encryption(
static inline int
fscrypt_prepare_inline_crypt_key(struct fscrypt_prepared_key *prep_key,
const u8 *raw_key, unsigned int raw_key_size,
bool is_hw_wrapped,
const struct fscrypt_info *ci)
{
WARN_ON(1);
@ -556,6 +558,7 @@ extern struct fscrypt_mode fscrypt_modes[];
extern int fscrypt_prepare_key(struct fscrypt_prepared_key *prep_key,
const u8 *raw_key, unsigned int raw_key_size,
bool is_hw_wrapped,
const struct fscrypt_info *ci);
extern void fscrypt_destroy_prepared_key(struct fscrypt_prepared_key *prep_key);

3
fs/crypto/inline_crypt.c
View file

@ -50,6 +50,7 @@ void fscrypt_select_encryption_impl(struct fscrypt_info *ci)
int fscrypt_prepare_inline_crypt_key(struct fscrypt_prepared_key *prep_key,
const u8 *raw_key,
unsigned int raw_key_size,
bool is_hw_wrapped,
const struct fscrypt_info *ci)
{
const struct inode *inode = ci->ci_inode;
@ -80,7 +81,7 @@ int fscrypt_prepare_inline_crypt_key(struct fscrypt_prepared_key *prep_key,
BLK_CRYPTO_MAX_WRAPPED_KEY_SIZE);
err = blk_crypto_init_key(&blk_key->base, raw_key, raw_key_size,
crypto_mode, sb->s_blocksize);
is_hw_wrapped, crypto_mode, sb->s_blocksize);
if (err) {
fscrypt_err(inode, "error %d initializing blk-crypto key", err);
goto fail;

14
fs/crypto/keysetup.c
View file

@ -117,15 +117,15 @@ err_free_tfm:
*/
int fscrypt_prepare_key(struct fscrypt_prepared_key *prep_key,
const u8 *raw_key, unsigned int raw_key_size,
const struct fscrypt_info *ci)
bool is_hw_wrapped, const struct fscrypt_info *ci)
{
struct crypto_skcipher *tfm;
if (fscrypt_using_inline_encryption(ci))
return fscrypt_prepare_inline_crypt_key(prep_key,
raw_key, raw_key_size, ci);
raw_key, raw_key_size, is_hw_wrapped, ci);
if (WARN_ON(raw_key_size != ci->ci_mode->keysize))
if (WARN_ON(is_hw_wrapped || raw_key_size != ci->ci_mode->keysize))
return -EINVAL;
tfm = fscrypt_allocate_skcipher(ci->ci_mode, raw_key, ci->ci_inode);
@ -150,8 +150,8 @@ void fscrypt_destroy_prepared_key(struct fscrypt_prepared_key *prep_key)
int fscrypt_set_per_file_enc_key(struct fscrypt_info *ci, const u8 *raw_key)
{
ci->ci_owns_key = true;
return fscrypt_prepare_key(&ci->ci_key, raw_key,
ci->ci_mode->keysize, ci);
return fscrypt_prepare_key(&ci->ci_key, raw_key, ci->ci_mode->keysize,
false /*is_hw_wrapped*/, ci);
}
static int setup_per_mode_enc_key(struct fscrypt_info *ci,
@ -202,7 +202,7 @@ static int setup_per_mode_enc_key(struct fscrypt_info *ci,
}
}
err = fscrypt_prepare_key(prep_key, mk->mk_secret.raw,
mk->mk_secret.size, ci);
mk->mk_secret.size, true, ci);
if (err)
goto out_unlock;
} else {
@ -221,7 +221,7 @@ static int setup_per_mode_enc_key(struct fscrypt_info *ci,
if (err)
goto out_unlock;
err = fscrypt_prepare_key(prep_key, mode_key, mode->keysize,
ci);
false /*is_hw_wrapped*/, ci);
memzero_explicit(mode_key, mode->keysize);
if (err)
goto out_unlock;

2
fs/crypto/keysetup_v1.c
View file

@ -234,7 +234,7 @@ fscrypt_get_direct_key(const struct fscrypt_info *ci, const u8 *raw_key)
refcount_set(&dk->dk_refcount, 1);
dk->dk_mode = ci->ci_mode;
err = fscrypt_prepare_key(&dk->dk_key, raw_key, ci->ci_mode->keysize,
ci);
false /*is_hw_wrapped*/, ci);
if (err)
goto err_free_dk;
memcpy(dk->dk_descriptor, ci->ci_policy.v1.master_key_descriptor,