Commit cb9ca9b4 authored by Eric Biggers's avatar Eric Biggers Committed by Treehugger Robot
Browse files

ANDROID: fips140: avoid crypto driver name collisions



Starting in Linux v6.8, the crypto API enforces uniqueness of
implementation names, i.e. it no longer allows an algorithm to be
registered when another algorithm with the same cra_driver_name is
already registered.  fips140.ko was relying on the old behavior, as it
did not unregister the kernel's copies of all its algorithms before
registering its copies.  It did do this for "FIPS approved" algorithms,
since that was already required for FIPS, but this was skipped for some
non-approved algorithms defined in the same files, e.g. xcbc-aes-ce.

This commit makes fips140.ko compatible with the new crypto API behavior
by making it unregister all algorithms that it registers.

Due to the extended list of unregistrations, there would be an increased
chance of bugs where fips140.ko accidentally unregisters an algorithm
that it doesn't actually replace.  To prevent such bugs, this commit
also makes fips140.ko check that after it unregisters an algorithm, it
indeed registers a replacement for it.

Bug: 188620248
Change-Id: Iff87fe4e055b53ec0a9217f3ee6d6649dac7d75e
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
parent 9fed4416
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment