| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 29 May 2018 15:24:02 -0700
From: Kees Cook <keescook@...omium.org>
To: Kyle Spiers <ksspiers@...gle.com>,
Dan Williams <dan.j.williams@...el.com>, vinod.koul@...el.com,
Herbert Xu <herbert@...dor.apana.org.au>
Cc: "David S. Miller" <davem@...emloft.net>, ray.jui@...adcom.com,
linux-crypto <linux-crypto@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] async_pq: Remove VLA usage
On Thu, May 10, 2018 at 1:57 PM, Kees Cook <keescook@...omium.org> wrote:
> On Sat, May 5, 2018 at 12:58 AM, Kyle Spiers <ksspiers@...gle.com> wrote:
>> In the quest to remove VLAs from the kernel[1], this moves the
>> allocation of coefs and blocks from the stack to being kmalloc()ed.
>>
>> [1] https://lkml.org/lkml/2018/3/7/621
>>
>> Signed-off-by: Kyle Spiers <ksspiers@...gle.com>
>
> Reviewed-by: Kees Cook <keescook@...omium.org>
>
> Is this something that should go via Vinod, Dan, or direct through
> Herbert's crypto tree?
Friendly ping. Any news on this patch?
Thanks!
-Kees
>
> Thanks!
>
> -Kees
>
>> ---
>> Forgot to add slab.h
>> ---
>> crypto/async_tx/async_pq.c | 18 ++++++++++++++----
>> crypto/async_tx/raid6test.c | 9 ++++++++-
>> 2 files changed, 22 insertions(+), 5 deletions(-)
>>
>> diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c
>> index 56bd612927ab..af1912313a23 100644
>> --- a/crypto/async_tx/async_pq.c
>> +++ b/crypto/async_tx/async_pq.c
>> @@ -194,9 +194,9 @@ async_gen_syndrome(struct page **blocks, unsigned int offset, int disks,
>> (src_cnt <= dma_maxpq(device, 0) ||
>> dma_maxpq(device, DMA_PREP_CONTINUE) > 0) &&
>> is_dma_pq_aligned(device, offset, 0, len)) {
>> - struct dma_async_tx_descriptor *tx;
>> + struct dma_async_tx_descriptor *tx = NULL;
>> enum dma_ctrl_flags dma_flags = 0;
>> - unsigned char coefs[src_cnt];
>> + unsigned char *coefs;
>> int i, j;
>>
>> /* run the p+q asynchronously */
>> @@ -207,6 +207,9 @@ async_gen_syndrome(struct page **blocks, unsigned int offset, int disks,
>> * sources and update the coefficients accordingly
>> */
>> unmap->len = len;
>> + coefs = kmalloc_array(src_cnt, sizeof(*coefs), GFP_KERNEL);
>> + if (!coefs)
>> + goto out;
>> for (i = 0, j = 0; i < src_cnt; i++) {
>> if (blocks[i] == NULL)
>> continue;
>> @@ -240,7 +243,9 @@ async_gen_syndrome(struct page **blocks, unsigned int offset, int disks,
>> }
>>
>> tx = do_async_gen_syndrome(chan, coefs, j, unmap, dma_flags, submit);
>> +out:
>> dmaengine_unmap_put(unmap);
>> + kfree(coefs);
>> return tx;
>> }
>>
>> @@ -298,8 +303,8 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
>> {
>> struct dma_chan *chan = pq_val_chan(submit, blocks, disks, len);
>> struct dma_device *device = chan ? chan->device : NULL;
>> - struct dma_async_tx_descriptor *tx;
>> - unsigned char coefs[disks-2];
>> + struct dma_async_tx_descriptor *tx = NULL;
>> + unsigned char *coefs = NULL;
>> enum dma_ctrl_flags dma_flags = submit->cb_fn ? DMA_PREP_INTERRUPT : 0;
>> struct dmaengine_unmap_data *unmap = NULL;
>>
>> @@ -318,6 +323,9 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
>> __func__, disks, len);
>>
>> unmap->len = len;
>> + coefs = kmalloc_array(disks - 2, sizeof(*coefs), GFP_KERNEL);
>> + if (!coefs)
>> + goto out;
>> for (i = 0; i < disks-2; i++)
>> if (likely(blocks[i])) {
>> unmap->addr[j] = dma_map_page(dev, blocks[i],
>> @@ -423,6 +431,8 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
>> async_tx_sync_epilog(submit);
>> tx = NULL;
>> }
>> +out:
>> + kfree(coefs);
>> dmaengine_unmap_put(unmap);
>>
>> return tx;
>> diff --git a/crypto/async_tx/raid6test.c b/crypto/async_tx/raid6test.c
>> index dad95f45b88f..4237a5ae8f42 100644
>> --- a/crypto/async_tx/raid6test.c
>> +++ b/crypto/async_tx/raid6test.c
>> @@ -24,6 +24,7 @@
>> #include <linux/mm.h>
>> #include <linux/random.h>
>> #include <linux/module.h>
>> +#include <linux/slab.h>
>>
>> #undef pr
>> #define pr(fmt, args...) pr_info("raid6test: " fmt, ##args)
>> @@ -81,11 +82,16 @@ static void raid6_dual_recov(int disks, size_t bytes, int faila, int failb, stru
>> init_async_submit(&submit, 0, NULL, NULL, NULL, addr_conv);
>> tx = async_gen_syndrome(ptrs, 0, disks, bytes, &submit);
>> } else {
>> - struct page *blocks[disks];
>> + struct page **blocks;
>> struct page *dest;
>> int count = 0;
>> int i;
>>
>> + blocks = kmalloc_array(disks, sizeof(*blocks),
>> + GFP_KERNEL);
>> + if (!blocks)
>> + return;
>> +
>> /* data+Q failure. Reconstruct data from P,
>> * then rebuild syndrome
>> */
>> @@ -101,6 +107,7 @@ static void raid6_dual_recov(int disks, size_t bytes, int faila, int failb, stru
>>
>> init_async_submit(&submit, 0, tx, NULL, NULL, addr_conv);
>> tx = async_gen_syndrome(ptrs, 0, disks, bytes, &submit);
>> + kfree(blocks);
>> }
>> } else {
>> if (failb == disks-2) {
>> --
>> 2.17.0.441.gb46fe60e1d-goog
>>
>
>
>
> --
> Kees Cook
> Pixel Security
--
Kees Cook
Pixel Security
Powered by blists - more mailing lists