LXR linux/crypto/rsa-pkcs1pad.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * RSA padding templates.
   4 *
   5 * Copyright (c) 2015  Intel Corporation
   6 */
   7
   8#include <crypto/algapi.h>
   9#include <crypto/akcipher.h>
  10#include <crypto/internal/akcipher.h>
  11#include <crypto/internal/rsa.h>
  12#include <linux/err.h>
  13#include <linux/init.h>
  14#include <linux/kernel.h>
  15#include <linux/module.h>
  16#include <linux/random.h>
  17#include <linux/scatterlist.h>
  18
  19/*
  20 * Hash algorithm OIDs plus ASN.1 DER wrappings [RFC4880 sec 5.2.2].
  21 */
  22static const u8 rsa_digest_info_md5[] = {
  23        0x30, 0x20, 0x30, 0x0c, 0x06, 0x08,
  24        0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, /* OID */
  25        0x05, 0x00, 0x04, 0x10
  26};
  27
  28static const u8 rsa_digest_info_sha1[] = {
  29        0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
  30        0x2b, 0x0e, 0x03, 0x02, 0x1a,
  31        0x05, 0x00, 0x04, 0x14
  32};
  33
  34static const u8 rsa_digest_info_rmd160[] = {
  35        0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
  36        0x2b, 0x24, 0x03, 0x02, 0x01,
  37        0x05, 0x00, 0x04, 0x14
  38};
  39
  40static const u8 rsa_digest_info_sha224[] = {
  41        0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
  42        0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
  43        0x05, 0x00, 0x04, 0x1c
  44};
  45
  46static const u8 rsa_digest_info_sha256[] = {
  47        0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
  48        0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
  49        0x05, 0x00, 0x04, 0x20
  50};
  51
  52static const u8 rsa_digest_info_sha384[] = {
  53        0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
  54        0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
  55        0x05, 0x00, 0x04, 0x30
  56};
  57
  58static const u8 rsa_digest_info_sha512[] = {
  59        0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
  60        0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
  61        0x05, 0x00, 0x04, 0x40
  62};
  63
  64static const struct rsa_asn1_template {
  65        const char      *name;
  66        const u8        *data;
  67        size_t          size;
  68} rsa_asn1_templates[] = {
  69#define _(X) { #X, rsa_digest_info_##X, sizeof(rsa_digest_info_##X) }
  70        _(md5),
  71        _(sha1),
  72        _(rmd160),
  73        _(sha256),
  74        _(sha384),
  75        _(sha512),
  76        _(sha224),
  77        { NULL }
  78#undef _
  79};
  80
  81static const struct rsa_asn1_template *rsa_lookup_asn1(const char *name)
  82{
  83        const struct rsa_asn1_template *p;
  84
  85        for (p = rsa_asn1_templates; p->name; p++)
  86                if (strcmp(name, p->name) == 0)
  87                        return p;
  88        return NULL;
  89}
  90
  91struct pkcs1pad_ctx {
  92        struct crypto_akcipher *child;
  93        unsigned int key_size;
  94};
  95
  96struct pkcs1pad_inst_ctx {
  97        struct crypto_akcipher_spawn spawn;
  98        const struct rsa_asn1_template *digest_info;
  99};
 100
 101struct pkcs1pad_request {
 102        struct scatterlist in_sg[2], out_sg[1];
 103        uint8_t *in_buf, *out_buf;
 104        struct akcipher_request child_req;
 105};
 106
 107static int pkcs1pad_set_pub_key(struct crypto_akcipher *tfm, const void *key,
 108                unsigned int keylen)
 109{
 110        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 111        int err;
 112
 113        ctx->key_size = 0;
 114
 115        err = crypto_akcipher_set_pub_key(ctx->child, key, keylen);
 116        if (err)
 117                return err;
 118
 119        /* Find out new modulus size from rsa implementation */
 120        err = crypto_akcipher_maxsize(ctx->child);
 121        if (err > PAGE_SIZE)
 122                return -ENOTSUPP;
 123
 124        ctx->key_size = err;
 125        return 0;
 126}
 127
 128static int pkcs1pad_set_priv_key(struct crypto_akcipher *tfm, const void *key,
 129                unsigned int keylen)
 130{
 131        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 132        int err;
 133
 134        ctx->key_size = 0;
 135
 136        err = crypto_akcipher_set_priv_key(ctx->child, key, keylen);
 137        if (err)
 138                return err;
 139
 140        /* Find out new modulus size from rsa implementation */
 141        err = crypto_akcipher_maxsize(ctx->child);
 142        if (err > PAGE_SIZE)
 143                return -ENOTSUPP;
 144
 145        ctx->key_size = err;
 146        return 0;
 147}
 148
 149static unsigned int pkcs1pad_get_max_size(struct crypto_akcipher *tfm)
 150{
 151        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 152
 153        /*
 154         * The maximum destination buffer size for the encrypt/sign operations
 155         * will be the same as for RSA, even though it's smaller for
 156         * decrypt/verify.
 157         */
 158
 159        return ctx->key_size;
 160}
 161
 162static void pkcs1pad_sg_set_buf(struct scatterlist *sg, void *buf, size_t len,
 163                struct scatterlist *next)
 164{
 165        int nsegs = next ? 2 : 1;
 166
 167        sg_init_table(sg, nsegs);
 168        sg_set_buf(sg, buf, len);
 169
 170        if (next)
 171                sg_chain(sg, nsegs, next);
 172}
 173
 174static int pkcs1pad_encrypt_sign_complete(struct akcipher_request *req, int err)
 175{
 176        struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
 177        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 178        struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
 179        unsigned int pad_len;
 180        unsigned int len;
 181        u8 *out_buf;
 182
 183        if (err)
 184                goto out;
 185
 186        len = req_ctx->child_req.dst_len;
 187        pad_len = ctx->key_size - len;
 188
 189        /* Four billion to one */
 190        if (likely(!pad_len))
 191                goto out;
 192
 193        out_buf = kzalloc(ctx->key_size, GFP_KERNEL);
 194        err = -ENOMEM;
 195        if (!out_buf)
 196                goto out;
 197
 198        sg_copy_to_buffer(req->dst, sg_nents_for_len(req->dst, len),
 199                          out_buf + pad_len, len);
 200        sg_copy_from_buffer(req->dst,
 201                            sg_nents_for_len(req->dst, ctx->key_size),
 202                            out_buf, ctx->key_size);
 203        kfree_sensitive(out_buf);
 204
 205out:
 206        req->dst_len = ctx->key_size;
 207
 208        kfree(req_ctx->in_buf);
 209
 210        return err;
 211}
 212
 213static void pkcs1pad_encrypt_sign_complete_cb(
 214                struct crypto_async_request *child_async_req, int err)
 215{
 216        struct akcipher_request *req = child_async_req->data;
 217        struct crypto_async_request async_req;
 218
 219        if (err == -EINPROGRESS)
 220                return;
 221
 222        async_req.data = req->base.data;
 223        async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
 224        async_req.flags = child_async_req->flags;
 225        req->base.complete(&async_req,
 226                        pkcs1pad_encrypt_sign_complete(req, err));
 227}
 228
 229static int pkcs1pad_encrypt(struct akcipher_request *req)
 230{
 231        struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
 232        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 233        struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
 234        int err;
 235        unsigned int i, ps_end;
 236
 237        if (!ctx->key_size)
 238                return -EINVAL;
 239
 240        if (req->src_len > ctx->key_size - 11)
 241                return -EOVERFLOW;
 242
 243        if (req->dst_len < ctx->key_size) {
 244                req->dst_len = ctx->key_size;
 245                return -EOVERFLOW;
 246        }
 247
 248        req_ctx->in_buf = kmalloc(ctx->key_size - 1 - req->src_len,
 249                                  GFP_KERNEL);
 250        if (!req_ctx->in_buf)
 251                return -ENOMEM;
 252
 253        ps_end = ctx->key_size - req->src_len - 2;
 254        req_ctx->in_buf[0] = 0x02;
 255        for (i = 1; i < ps_end; i++)
 256                req_ctx->in_buf[i] = 1 + prandom_u32_max(255);
 257        req_ctx->in_buf[ps_end] = 0x00;
 258
 259        pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
 260                        ctx->key_size - 1 - req->src_len, req->src);
 261
 262        akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
 263        akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
 264                        pkcs1pad_encrypt_sign_complete_cb, req);
 265
 266        /* Reuse output buffer */
 267        akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,
 268                                   req->dst, ctx->key_size - 1, req->dst_len);
 269
 270        err = crypto_akcipher_encrypt(&req_ctx->child_req);
 271        if (err != -EINPROGRESS && err != -EBUSY)
 272                return pkcs1pad_encrypt_sign_complete(req, err);
 273
 274        return err;
 275}
 276
 277static int pkcs1pad_decrypt_complete(struct akcipher_request *req, int err)
 278{
 279        struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
 280        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 281        struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
 282        unsigned int dst_len;
 283        unsigned int pos;
 284        u8 *out_buf;
 285
 286        if (err)
 287                goto done;
 288
 289        err = -EINVAL;
 290        dst_len = req_ctx->child_req.dst_len;
 291        if (dst_len < ctx->key_size - 1)
 292                goto done;
 293
 294        out_buf = req_ctx->out_buf;
 295        if (dst_len == ctx->key_size) {
 296                if (out_buf[0] != 0x00)
 297                        /* Decrypted value had no leading 0 byte */
 298                        goto done;
 299
 300                dst_len--;
 301                out_buf++;
 302        }
 303
 304        if (out_buf[0] != 0x02)
 305                goto done;
 306
 307        for (pos = 1; pos < dst_len; pos++)
 308                if (out_buf[pos] == 0x00)
 309                        break;
 310        if (pos < 9 || pos == dst_len)
 311                goto done;
 312        pos++;
 313
 314        err = 0;
 315
 316        if (req->dst_len < dst_len - pos)
 317                err = -EOVERFLOW;
 318        req->dst_len = dst_len - pos;
 319
 320        if (!err)
 321                sg_copy_from_buffer(req->dst,
 322                                sg_nents_for_len(req->dst, req->dst_len),
 323                                out_buf + pos, req->dst_len);
 324
 325done:
 326        kfree_sensitive(req_ctx->out_buf);
 327
 328        return err;
 329}
 330
 331static void pkcs1pad_decrypt_complete_cb(
 332                struct crypto_async_request *child_async_req, int err)
 333{
 334        struct akcipher_request *req = child_async_req->data;
 335        struct crypto_async_request async_req;
 336
 337        if (err == -EINPROGRESS)
 338                return;
 339
 340        async_req.data = req->base.data;
 341        async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
 342        async_req.flags = child_async_req->flags;
 343        req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err));
 344}
 345
 346static int pkcs1pad_decrypt(struct akcipher_request *req)
 347{
 348        struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
 349        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 350        struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
 351        int err;
 352
 353        if (!ctx->key_size || req->src_len != ctx->key_size)
 354                return -EINVAL;
 355
 356        req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL);
 357        if (!req_ctx->out_buf)
 358                return -ENOMEM;
 359
 360        pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
 361                            ctx->key_size, NULL);
 362
 363        akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
 364        akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
 365                        pkcs1pad_decrypt_complete_cb, req);
 366
 367        /* Reuse input buffer, output to a new buffer */
 368        akcipher_request_set_crypt(&req_ctx->child_req, req->src,
 369                                   req_ctx->out_sg, req->src_len,
 370                                   ctx->key_size);
 371
 372        err = crypto_akcipher_decrypt(&req_ctx->child_req);
 373        if (err != -EINPROGRESS && err != -EBUSY)
 374                return pkcs1pad_decrypt_complete(req, err);
 375
 376        return err;
 377}
 378
 379static int pkcs1pad_sign(struct akcipher_request *req)
 380{
 381        struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
 382        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 383        struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
 384        struct akcipher_instance *inst = akcipher_alg_instance(tfm);
 385        struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
 386        const struct rsa_asn1_template *digest_info = ictx->digest_info;
 387        int err;
 388        unsigned int ps_end, digest_size = 0;
 389
 390        if (!ctx->key_size)
 391                return -EINVAL;
 392
 393        if (digest_info)
 394                digest_size = digest_info->size;
 395
 396        if (req->src_len + digest_size > ctx->key_size - 11)
 397                return -EOVERFLOW;
 398
 399        if (req->dst_len < ctx->key_size) {
 400                req->dst_len = ctx->key_size;
 401                return -EOVERFLOW;
 402        }
 403
 404        req_ctx->in_buf = kmalloc(ctx->key_size - 1 - req->src_len,
 405                                  GFP_KERNEL);
 406        if (!req_ctx->in_buf)
 407                return -ENOMEM;
 408
 409        ps_end = ctx->key_size - digest_size - req->src_len - 2;
 410        req_ctx->in_buf[0] = 0x01;
 411        memset(req_ctx->in_buf + 1, 0xff, ps_end - 1);
 412        req_ctx->in_buf[ps_end] = 0x00;
 413
 414        if (digest_info)
 415                memcpy(req_ctx->in_buf + ps_end + 1, digest_info->data,
 416                       digest_info->size);
 417
 418        pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
 419                        ctx->key_size - 1 - req->src_len, req->src);
 420
 421        akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
 422        akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
 423                        pkcs1pad_encrypt_sign_complete_cb, req);
 424
 425        /* Reuse output buffer */
 426        akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,
 427                                   req->dst, ctx->key_size - 1, req->dst_len);
 428
 429        err = crypto_akcipher_decrypt(&req_ctx->child_req);
 430        if (err != -EINPROGRESS && err != -EBUSY)
 431                return pkcs1pad_encrypt_sign_complete(req, err);
 432
 433        return err;
 434}
 435
 436static int pkcs1pad_verify_complete(struct akcipher_request *req, int err)
 437{
 438        struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
 439        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 440        struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
 441        struct akcipher_instance *inst = akcipher_alg_instance(tfm);
 442        struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
 443        const struct rsa_asn1_template *digest_info = ictx->digest_info;
 444        unsigned int dst_len;
 445        unsigned int pos;
 446        u8 *out_buf;
 447
 448        if (err)
 449                goto done;
 450
 451        err = -EINVAL;
 452        dst_len = req_ctx->child_req.dst_len;
 453        if (dst_len < ctx->key_size - 1)
 454                goto done;
 455
 456        out_buf = req_ctx->out_buf;
 457        if (dst_len == ctx->key_size) {
 458                if (out_buf[0] != 0x00)
 459                        /* Decrypted value had no leading 0 byte */
 460                        goto done;
 461
 462                dst_len--;
 463                out_buf++;
 464        }
 465
 466        err = -EBADMSG;
 467        if (out_buf[0] != 0x01)
 468                goto done;
 469
 470        for (pos = 1; pos < dst_len; pos++)
 471                if (out_buf[pos] != 0xff)
 472                        break;
 473
 474        if (pos < 9 || pos == dst_len || out_buf[pos] != 0x00)
 475                goto done;
 476        pos++;
 477
 478        if (digest_info) {
 479                if (crypto_memneq(out_buf + pos, digest_info->data,
 480                                  digest_info->size))
 481                        goto done;
 482
 483                pos += digest_info->size;
 484        }
 485
 486        err = 0;
 487
 488        if (req->dst_len != dst_len - pos) {
 489                err = -EKEYREJECTED;
 490                req->dst_len = dst_len - pos;
 491                goto done;
 492        }
 493        /* Extract appended digest. */
 494        sg_pcopy_to_buffer(req->src,
 495                           sg_nents_for_len(req->src,
 496                                            req->src_len + req->dst_len),
 497                           req_ctx->out_buf + ctx->key_size,
 498                           req->dst_len, ctx->key_size);
 499        /* Do the actual verification step. */
 500        if (memcmp(req_ctx->out_buf + ctx->key_size, out_buf + pos,
 501                   req->dst_len) != 0)
 502                err = -EKEYREJECTED;
 503done:
 504        kfree_sensitive(req_ctx->out_buf);
 505
 506        return err;
 507}
 508
 509static void pkcs1pad_verify_complete_cb(
 510                struct crypto_async_request *child_async_req, int err)
 511{
 512        struct akcipher_request *req = child_async_req->data;
 513        struct crypto_async_request async_req;
 514
 515        if (err == -EINPROGRESS)
 516                return;
 517
 518        async_req.data = req->base.data;
 519        async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
 520        async_req.flags = child_async_req->flags;
 521        req->base.complete(&async_req, pkcs1pad_verify_complete(req, err));
 522}
 523
 524/*
 525 * The verify operation is here for completeness similar to the verification
 526 * defined in RFC2313 section 10.2 except that block type 0 is not accepted,
 527 * as in RFC2437.  RFC2437 section 9.2 doesn't define any operation to
 528 * retrieve the DigestInfo from a signature, instead the user is expected
 529 * to call the sign operation to generate the expected signature and compare
 530 * signatures instead of the message-digests.
 531 */
 532static int pkcs1pad_verify(struct akcipher_request *req)
 533{
 534        struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
 535        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 536        struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
 537        int err;
 538
 539        if (WARN_ON(req->dst) ||
 540            WARN_ON(!req->dst_len) ||
 541            !ctx->key_size || req->src_len < ctx->key_size)
 542                return -EINVAL;
 543
 544        req_ctx->out_buf = kmalloc(ctx->key_size + req->dst_len, GFP_KERNEL);
 545        if (!req_ctx->out_buf)
 546                return -ENOMEM;
 547
 548        pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
 549                            ctx->key_size, NULL);
 550
 551        akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
 552        akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
 553                        pkcs1pad_verify_complete_cb, req);
 554
 555        /* Reuse input buffer, output to a new buffer */
 556        akcipher_request_set_crypt(&req_ctx->child_req, req->src,
 557                                   req_ctx->out_sg, req->src_len,
 558                                   ctx->key_size);
 559
 560        err = crypto_akcipher_encrypt(&req_ctx->child_req);
 561        if (err != -EINPROGRESS && err != -EBUSY)
 562                return pkcs1pad_verify_complete(req, err);
 563
 564        return err;
 565}
 566
 567static int pkcs1pad_init_tfm(struct crypto_akcipher *tfm)
 568{
 569        struct akcipher_instance *inst = akcipher_alg_instance(tfm);
 570        struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
 571        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 572        struct crypto_akcipher *child_tfm;
 573
 574        child_tfm = crypto_spawn_akcipher(&ictx->spawn);
 575        if (IS_ERR(child_tfm))
 576                return PTR_ERR(child_tfm);
 577
 578        ctx->child = child_tfm;
 579        return 0;
 580}
 581
 582static void pkcs1pad_exit_tfm(struct crypto_akcipher *tfm)
 583{
 584        struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
 585
 586        crypto_free_akcipher(ctx->child);
 587}
 588
 589static void pkcs1pad_free(struct akcipher_instance *inst)
 590{
 591        struct pkcs1pad_inst_ctx *ctx = akcipher_instance_ctx(inst);
 592        struct crypto_akcipher_spawn *spawn = &ctx->spawn;
 593
 594        crypto_drop_akcipher(spawn);
 595        kfree(inst);
 596}
 597
 598static int pkcs1pad_create(struct crypto_template *tmpl, struct rtattr **tb)
 599{
 600        u32 mask;
 601        struct akcipher_instance *inst;
 602        struct pkcs1pad_inst_ctx *ctx;
 603        struct akcipher_alg *rsa_alg;
 604        const char *hash_name;
 605        int err;
 606
 607        err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AKCIPHER, &mask);
 608        if (err)
 609                return err;
 610
 611        inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
 612        if (!inst)
 613                return -ENOMEM;
 614
 615        ctx = akcipher_instance_ctx(inst);
 616
 617        err = crypto_grab_akcipher(&ctx->spawn, akcipher_crypto_instance(inst),
 618                                   crypto_attr_alg_name(tb[1]), 0, mask);
 619        if (err)
 620                goto err_free_inst;
 621
 622        rsa_alg = crypto_spawn_akcipher_alg(&ctx->spawn);
 623
 624        err = -ENAMETOOLONG;
 625        hash_name = crypto_attr_alg_name(tb[2]);
 626        if (IS_ERR(hash_name)) {
 627                if (snprintf(inst->alg.base.cra_name,
 628                             CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s)",
 629                             rsa_alg->base.cra_name) >= CRYPTO_MAX_ALG_NAME)
 630                        goto err_free_inst;
 631
 632                if (snprintf(inst->alg.base.cra_driver_name,
 633                             CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s)",
 634                             rsa_alg->base.cra_driver_name) >=
 635                             CRYPTO_MAX_ALG_NAME)
 636                        goto err_free_inst;
 637        } else {
 638                ctx->digest_info = rsa_lookup_asn1(hash_name);
 639                if (!ctx->digest_info) {
 640                        err = -EINVAL;
 641                        goto err_free_inst;
 642                }
 643
 644                if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
 645                             "pkcs1pad(%s,%s)", rsa_alg->base.cra_name,
 646                             hash_name) >= CRYPTO_MAX_ALG_NAME)
 647                        goto err_free_inst;
 648
 649                if (snprintf(inst->alg.base.cra_driver_name,
 650                             CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s,%s)",
 651                             rsa_alg->base.cra_driver_name,
 652                             hash_name) >= CRYPTO_MAX_ALG_NAME)
 653                        goto err_free_inst;
 654        }
 655
 656        inst->alg.base.cra_priority = rsa_alg->base.cra_priority;
 657        inst->alg.base.cra_ctxsize = sizeof(struct pkcs1pad_ctx);
 658
 659        inst->alg.init = pkcs1pad_init_tfm;
 660        inst->alg.exit = pkcs1pad_exit_tfm;
 661
 662        inst->alg.encrypt = pkcs1pad_encrypt;
 663        inst->alg.decrypt = pkcs1pad_decrypt;
 664        inst->alg.sign = pkcs1pad_sign;
 665        inst->alg.verify = pkcs1pad_verify;
 666        inst->alg.set_pub_key = pkcs1pad_set_pub_key;
 667        inst->alg.set_priv_key = pkcs1pad_set_priv_key;
 668        inst->alg.max_size = pkcs1pad_get_max_size;
 669        inst->alg.reqsize = sizeof(struct pkcs1pad_request) + rsa_alg->reqsize;
 670
 671        inst->free = pkcs1pad_free;
 672
 673        err = akcipher_register_instance(tmpl, inst);
 674        if (err) {
 675err_free_inst:
 676                pkcs1pad_free(inst);
 677        }
 678        return err;
 679}
 680
 681struct crypto_template rsa_pkcs1pad_tmpl = {
 682        .name = "pkcs1pad",
 683        .create = pkcs1pad_create,
 684        .module = THIS_MODULE,
 685};
 686