linux-kernel - RE: [PATCH 03/13] crypto: x86/sha - yield FPU context during long loops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <MW5PR84MB1842C7F8190348625158DE9CABC29@MW5PR84MB1842.NAMPRD84.PROD.OUTLOOK.COM>
Date:   Fri, 13 Jan 2023 19:35:07 +0000
From:   "Elliott, Robert (Servers)" <elliott@....com>
To:     Herbert Xu <herbert@...dor.apana.org.au>,
        Eric Biggers <ebiggers@...nel.org>
CC:     "davem@...emloft.net" <davem@...emloft.net>,
        "Jason@...c4.com" <Jason@...c4.com>,
        "ardb@...nel.org" <ardb@...nel.org>,
        "ap420073@...il.com" <ap420073@...il.com>,
        "David.Laight@...lab.com" <David.Laight@...lab.com>,
        "tim.c.chen@...ux.intel.com" <tim.c.chen@...ux.intel.com>,
        "peter@...jl.ca" <peter@...jl.ca>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH 03/13] crypto: x86/sha - yield FPU context during long
 loops



> -----Original Message-----
> From: Herbert Xu <herbert@...dor.apana.org.au>
> Sent: Thursday, January 12, 2023 8:38 PM
> To: Eric Biggers <ebiggers@...nel.org>
> Cc: Elliott, Robert (Servers) <elliott@....com>; davem@...emloft.net;
> Jason@...c4.com; ardb@...nel.org; ap420073@...il.com;
> David.Laight@...lab.com; tim.c.chen@...ux.intel.com; peter@...jl.ca;
> tglx@...utronix.de; mingo@...hat.com; bp@...en8.de;
> dave.hansen@...ux.intel.com; linux-crypto@...r.kernel.org; x86@...nel.org;
> linux-kernel@...r.kernel.org
> Subject: Re: [PATCH 03/13] crypto: x86/sha - yield FPU context during long
> loops
> 
> On Fri, Jan 13, 2023 at 10:36:08AM +0800, Herbert Xu wrote:
> >
> > Perhaps we should just convert any users that trigger these warnings
> > over to ahash? The shash interface was never meant to process large
> > amounts of data anyway.
> 
> We could even add some length checks in shash to ensure that
> all large updates fail with a big bright warning once the existing
> users have been converted.

The call trace that triggered this whole topic was checking module
signatures during boot (thousands of files totaling 2.4 GB):
[   29.729849]  ? sha512_finup.part.0+0x1de/0x230 [sha512_ssse3]
[   29.729851]  ? pkcs7_digest+0xaf/0x1f0
[   29.729854]  ? pkcs7_verify+0x61/0x540
[   29.729856]  ? verify_pkcs7_message_sig+0x4a/0xe0
[   29.729859]  ? pkcs7_parse_message+0x174/0x1b0
[   29.729861]  ? verify_pkcs7_signature+0x4c/0x80
[   29.729862]  ? mod_verify_sig+0x74/0x90
[   29.729867]  ? module_sig_check+0x87/0xd0
[   29.729868]  ? load_module+0x4e/0x1fc0
[   29.729871]  ? xfs_file_read_iter+0x70/0xe0 [xfs]
[   29.729955]  ? __kernel_read+0x118/0x290
[   29.729959]  ? ima_post_read_file+0xac/0xc0
[   29.729962]  ? kernel_read_file+0x211/0x2a0
[   29.729965]  ? __do_sys_finit_module+0x93/0xf0

pkcs_digest() uses shash like this:
        /* Allocate the hashing algorithm we're going to need and find out how
         * big the hash operational data will be.
         */
        tfm = crypto_alloc_shash(sinfo->sig->hash_algo, 0, 0);
        if (IS_ERR(tfm))
                return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm);

        desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
        sig->digest_size = crypto_shash_digestsize(tfm);

        ret = -ENOMEM;
        sig->digest = kmalloc(sig->digest_size, GFP_KERNEL);
        if (!sig->digest)
                goto error_no_desc;

        desc = kzalloc(desc_size, GFP_KERNEL);
        if (!desc)
                goto error_no_desc;

        desc->tfm   = tfm;

        /* Digest the message [RFC2315 9.3] */
        ret = crypto_shash_digest(desc, pkcs7->data, pkcs7->data_len,
                                  sig->digest);
        if (ret < 0)
                goto error;
        pr_devel("MsgDigest = [%*ph]\n", 8, sig->digest);

There is a crypto_ahash_digest() available. Interestingly, the number of
users of each one happens to be identical:
    $ grep -Er --include '*.[chS]' "crypto_shash_digest\(" | wc -l
    37
    $ grep -Er --include '*.[chS]' "crypto_ahash_digest\(" | wc -l
    37