linux-kernel - Re: lib/mpi: call cond_resched() from mpi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20171127182404.GA8426@google.com>
Date:   Mon, 27 Nov 2017 10:24:04 -0800
From:   Eric Biggers <ebiggers@...gle.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     Herbert Xu <herbert@...dor.apana.org.au>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: lib/mpi: call cond_resched() from mpi_powm() loop

On Mon, Nov 27, 2017 at 01:13:05PM +0100, Greg KH wrote:
> On Tue, Nov 14, 2017 at 10:46:16PM +0000, Linux Kernel Mailing List wrote:
> > Web:        https://git.kernel.org/torvalds/c/1d9ddde12e3c9bab7f3d3484eb9446315e3571ca
> > Commit:     1d9ddde12e3c9bab7f3d3484eb9446315e3571ca
> > Parent:     63c53823f00f0ffd13e8c86b05c1486614a2df85
> > Refname:    refs/heads/master
> > Author:     Eric Biggers <ebiggers@...gle.com>
> > AuthorDate: Tue Nov 7 14:15:27 2017 -0800
> > Committer:  Herbert Xu <herbert@...dor.apana.org.au>
> > CommitDate: Fri Nov 10 19:20:26 2017 +0800
> > 
> >     lib/mpi: call cond_resched() from mpi_powm() loop
> >     
> >     On a non-preemptible kernel, if KEYCTL_DH_COMPUTE is called with the
> >     largest permitted inputs (16384 bits), the kernel spends 10+ seconds
> >     doing modular exponentiation in mpi_powm() without rescheduling.  If all
> >     threads do it, it locks up the system.  Moreover, it can cause
> >     rcu_sched-stall warnings.
> >     
> >     Notwithstanding the insanity of doing this calculation in kernel mode
> >     rather than in userspace, fix it by calling cond_resched() as each bit
> >     from the exponent is processed.  It's still noninterruptible, but at
> >     least it's preemptible now.
> >     
> >     Do the cond_resched() once per bit rather than once per MPI limb because
> >     each limb might still easily take 100+ milliseconds on slow CPUs.
> >     
> >     Cc: <stable@...r.kernel.org> # v4.12+
> >     Signed-off-by: Eric Biggers <ebiggers@...gle.com>
> >     Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>
> > ---
> >  lib/mpi/mpi-pow.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c
> > index e24388a863a7..468fb7cd1221 100644
> > --- a/lib/mpi/mpi-pow.c
> > +++ b/lib/mpi/mpi-pow.c
> > @@ -26,6 +26,7 @@
> >   *	 however I decided to publish this code under the plain GPL.
> >   */
> >  
> > +#include <linux/sched.h>
> >  #include <linux/string.h>
> >  #include "mpi-internal.h"
> >  #include "longlong.h"
> > @@ -256,6 +257,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
> >  				}
> >  				e <<= 1;
> >  				c--;
> > +				cond_resched();
> >  			}
> >  
> >  			i--;
> 
> Note, I've applied this to kernels older than 4.12 as well, as the issue
> seems to also be there as well, right?
> 
> thanks,
> 
> greg k-h

Indeed, I was going to point out that the "v4.12+" was wrong but you already
figured it out.  The code is reachable through RSA (via asymmetric_keys) in
older kernel versions.

Thanks!

Eric