From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932518AbcLLX6Q (ORCPT ); Mon, 12 Dec 2016 18:58:16 -0500 Received: from mail-ua0-f180.google.com ([209.85.217.180]:34088 "EHLO mail-ua0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932282AbcLLX6O (ORCPT ); Mon, 12 Dec 2016 18:58:14 -0500 MIME-Version: 1.0 In-Reply-To: <20161212214447.GA12142@kroah.com> References: <8c273c9c41f51b34bb3115086f1d776895580637.1481575835.git.luto@kernel.org> <20161212214447.GA12142@kroah.com> From: Andy Lutomirski Date: Mon, 12 Dec 2016 15:57:52 -0800 Message-ID: Subject: Re: [PATCH] wusbcore: Fix one more crypto-on-the-stack bug To: Greg KH Cc: Andy Lutomirski , "linux-kernel@vger.kernel.org" , USB list , Eric Biggers , linux-crypto@vger.kernel.org, Herbert Xu , Stephan Mueller Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Dec 12, 2016 at 1:44 PM, Greg KH wrote: > On Mon, Dec 12, 2016 at 12:52:45PM -0800, Andy Lutomirski wrote: >> The driver put a constant buffer of all zeros on the stack and >> pointed a scatterlist entry at it. This doesn't work with virtual >> stacks. Make the buffer static to fix it. >> >> Cc: stable@vger.kernel.org # 4.9 only >> Reported-by: Eric Biggers >> Signed-off-by: Andy Lutomirski >> --- >> drivers/usb/wusbcore/crypto.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/usb/wusbcore/crypto.c b/drivers/usb/wusbcore/crypto.c >> index 79451f7ef1b7..a7e007a0cd49 100644 >> --- a/drivers/usb/wusbcore/crypto.c >> +++ b/drivers/usb/wusbcore/crypto.c >> @@ -216,7 +216,7 @@ static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc, >> struct scatterlist sg[4], sg_dst; >> void *dst_buf; >> size_t dst_size; >> - const u8 bzero[16] = { 0 }; >> + static const u8 bzero[16] = { 0 }; > > Hm, can static memory handle DMA? That's a requirement of the USB > stack, does this data later end up being sent down to a USB host > controller? I think it doesn't, but I'll switch it to use empty_zero_page instead. --Andy