linux-kernel - Re: [PATCH 10/25] ubifs: add helper functions for authentication support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180829063003.goc3eekjo42jkrgy@pengutronix.de>
Date:   Wed, 29 Aug 2018 08:30:03 +0200
From:   Sascha Hauer <s.hauer@...gutronix.de>
To:     Richard Weinberger <richard@....at>
Cc:     linux-mtd@...ts.infradead.org, David Gstir <david@...ma-star.at>,
        kernel@...gutronix.de, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 10/25] ubifs: add helper functions for authentication
 support

Hi Richard,

On Mon, Aug 27, 2018 at 02:50:37PM +0200, Richard Weinberger wrote:
> Am Mittwoch, 4. Juli 2018, 14:41:22 CEST schrieb Sascha Hauer:
> > This patch adds the various helper functions needed for authentication
> > support. We need functions to hash nodes, to embed HMACs into a node and
> > to compare hashes and HMACs. Most functions first check if this
> > filesystem is authenticated and bail out early if not, which makes the
> > functions safe to be called with disabled authentication.
> > 
> > Signed-off-by: Sascha Hauer <s.hauer@...gutronix.de>
> > ---
> > +void ubifs_prepare_auth_node(struct ubifs_info *c, void *node,
> > +			     struct shash_desc *inhash)
> > +{
> > +	SHASH_DESC_ON_STACK(hash_desc, c->hash_tfm);
> > +	struct ubifs_auth_node *auth = node;
> > +	u8 hash[crypto_shash_descsize(c->hash_tfm)];
> 
> Doesn't this introduce a new VLA?
> Not that me make Kees unhappy. ;-)

/me just read https://lwn.net/Articles/749064/ and now realizes why this
is considered harmful.

Thanks for the review. I'll look into this and all the other points. I
guess that'll keep me busy for some time.

Thanks
  Sascha

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |