From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754960AbcLNIiW (ORCPT ); Wed, 14 Dec 2016 03:38:22 -0500 Received: from mx1.redhat.com ([209.132.183.28]:37900 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753190AbcLNIiT (ORCPT ); Wed, 14 Dec 2016 03:38:19 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: References: <627e948e37314c13a67c90917386c814c56b8e20.1481683609.git.luto@kernel.org> To: Andy Lutomirski Cc: dhowells@redhat.com, Andy Lutomirski , "linux-kernel@vger.kernel.org" , USB list , keyrings@vger.kernel.org, Eric Biggers , linux-crypto@vger.kernel.org, Herbert Xu , Stephan Mueller Subject: Re: [PATCH v2] keys/encrypted: Fix two crypto-on-the-stack bugs MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <18038.1481704679.1@warthog.procyon.org.uk> Date: Wed, 14 Dec 2016 08:37:59 +0000 Message-ID: <18039.1481704679@warthog.procyon.org.uk> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Wed, 14 Dec 2016 08:38:03 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Andy Lutomirski wrote: > > - sg_set_buf(&sg_out[1], pad, sizeof pad); > > + sg_set_buf(&sg_out[1], empty_zero_page, 16); > > My fix here is obviously bogus (I meant to use ZERO_PAGE(0)), but what > exactly is the code trying to do? The old code makes no sense. It's > setting the *output* buffer to zeroed padding. Padding goes into the encrypt function and is going to come out of the decrypt function. Possibly derived_key_decrypt() should be checking that the padding that comes out is actually a bunch of zeros. Maybe we don't actually need to get the padding out, but I'm not sure whether the crypto layer will malfunction if we don't give it a buffer for the padding. David