From: Kees Cook <keescook@chromium.org>
To: David Howells <dhowells@redhat.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
Eric Biggers <ebiggers@google.com>,
"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
linux-crypto <linux-crypto@vger.kernel.org>,
Network Development <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
"David S. Miller" <davem@davemloft.net>
Subject: Re: [PATCH v6 16/18] rxrpc: Reuse SKCIPHER_REQUEST_ON_STACK buffer
Date: Thu, 2 Aug 2018 16:46:05 -0700 [thread overview]
Message-ID: <CAGXu5jLVNnUXkyzGdee3zvLHw5zMaDhEGm4c4YLqU=L8q9TshA@mail.gmail.com> (raw)
In-Reply-To: <20180724164936.37477-17-keescook@chromium.org>
On Tue, Jul 24, 2018 at 9:49 AM, Kees Cook <keescook@chromium.org> wrote:
> The use of SKCIPHER_REQUEST_ON_STACK() will trigger FRAME_WARN warnings
> (when less than 2048) once the VLA is no longer hidden from the check:
>
> net/rxrpc/rxkad.c:398:1: warning: the frame size of 1152 bytes is larger than 1024 bytes [-Wframe-larger-than=]
> net/rxrpc/rxkad.c:242:1: warning: the frame size of 1152 bytes is larger than 1024 bytes [-Wframe-larger-than=]
>
> This passes the initial SKCIPHER_REQUEST_ON_STACK allocation to the leaf
> functions for reuse. Two requests allocated on the stack is not needed
> when only one is used at a time.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> Acked-by: Arnd Bergmann <arnd@arndb.de>
David (Howells), what do you think of this? Can this go via your tree
or maybe via netdev?
I'd love your Ack or Review. :)
Thanks,
-Kees
> ---
> net/rxrpc/rxkad.c | 25 +++++++++++++------------
> 1 file changed, 13 insertions(+), 12 deletions(-)
>
> diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
> index 278ac0807a60..6393391fac86 100644
> --- a/net/rxrpc/rxkad.c
> +++ b/net/rxrpc/rxkad.c
> @@ -146,10 +146,10 @@ static int rxkad_prime_packet_security(struct rxrpc_connection *conn)
> static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
> struct sk_buff *skb,
> u32 data_size,
> - void *sechdr)
> + void *sechdr,
> + struct skcipher_request *req)
> {
> struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
> - SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
> struct rxkad_level1_hdr hdr;
> struct rxrpc_crypt iv;
> struct scatterlist sg;
> @@ -183,12 +183,12 @@ static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
> static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
> struct sk_buff *skb,
> u32 data_size,
> - void *sechdr)
> + void *sechdr,
> + struct skcipher_request *req)
> {
> const struct rxrpc_key_token *token;
> struct rxkad_level2_hdr rxkhdr;
> struct rxrpc_skb_priv *sp;
> - SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
> struct rxrpc_crypt iv;
> struct scatterlist sg[16];
> struct sk_buff *trailer;
> @@ -296,11 +296,12 @@ static int rxkad_secure_packet(struct rxrpc_call *call,
> ret = 0;
> break;
> case RXRPC_SECURITY_AUTH:
> - ret = rxkad_secure_packet_auth(call, skb, data_size, sechdr);
> + ret = rxkad_secure_packet_auth(call, skb, data_size, sechdr,
> + req);
> break;
> case RXRPC_SECURITY_ENCRYPT:
> ret = rxkad_secure_packet_encrypt(call, skb, data_size,
> - sechdr);
> + sechdr, req);
> break;
> default:
> ret = -EPERM;
> @@ -316,10 +317,10 @@ static int rxkad_secure_packet(struct rxrpc_call *call,
> */
> static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
> unsigned int offset, unsigned int len,
> - rxrpc_seq_t seq)
> + rxrpc_seq_t seq,
> + struct skcipher_request *req)
> {
> struct rxkad_level1_hdr sechdr;
> - SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
> struct rxrpc_crypt iv;
> struct scatterlist sg[16];
> struct sk_buff *trailer;
> @@ -402,11 +403,11 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
> */
> static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
> unsigned int offset, unsigned int len,
> - rxrpc_seq_t seq)
> + rxrpc_seq_t seq,
> + struct skcipher_request *req)
> {
> const struct rxrpc_key_token *token;
> struct rxkad_level2_hdr sechdr;
> - SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
> struct rxrpc_crypt iv;
> struct scatterlist _sg[4], *sg;
> struct sk_buff *trailer;
> @@ -549,9 +550,9 @@ static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
> case RXRPC_SECURITY_PLAIN:
> return 0;
> case RXRPC_SECURITY_AUTH:
> - return rxkad_verify_packet_1(call, skb, offset, len, seq);
> + return rxkad_verify_packet_1(call, skb, offset, len, seq, req);
> case RXRPC_SECURITY_ENCRYPT:
> - return rxkad_verify_packet_2(call, skb, offset, len, seq);
> + return rxkad_verify_packet_2(call, skb, offset, len, seq, req);
> default:
> return -ENOANO;
> }
> --
> 2.17.1
>
--
Kees Cook
Pixel Security
next prev parent reply other threads:[~2018-08-03 1:39 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-24 16:49 [PATCH v6 00/18] crypto: Remove VLA usage Kees Cook
[not found] ` <20180724164936.37477-1-keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
2018-07-24 16:49 ` [PATCH v6 01/18] crypto: xcbc: " Kees Cook
2018-07-24 16:49 ` [PATCH v6 02/18] crypto: cbc: " Kees Cook
2018-07-24 16:49 ` [PATCH v6 14/18] staging: rtl8192u: ieee80211: Convert from ahash to shash Kees Cook
2018-07-24 16:49 ` [PATCH v6 03/18] crypto: hash: Remove VLA usage Kees Cook
2018-07-24 16:49 ` [PATCH v6 04/18] dm: Remove VLA usage from hashes Kees Cook
2018-07-24 16:49 ` [PATCH v6 05/18] crypto alg: Introduce generic max blocksize and alignmask Kees Cook
2018-07-24 16:49 ` [PATCH v6 06/18] crypto: qat: Remove VLA usage Kees Cook
2018-07-24 16:49 ` [PATCH v6 07/18] crypto: shash: Remove VLA usage in unaligned hashing Kees Cook
2018-07-24 16:49 ` [PATCH v6 08/18] crypto: skcipher: Remove VLA usage for SKCIPHER_REQUEST_ON_STACK Kees Cook
2018-07-24 16:49 ` [PATCH v6 09/18] ppp: mppe: Remove VLA usage Kees Cook
2018-07-24 16:49 ` [PATCH v6 10/18] x86/power/64: " Kees Cook
2018-07-25 11:32 ` Rafael J. Wysocki
[not found] ` <CAJZ5v0gVDotjufLKUW0YuQu2vA4fmU_gqia=ZA4DocW4XHxx0w-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-07-25 18:01 ` Kees Cook
2018-08-06 10:28 ` Rafael J. Wysocki
2018-07-24 16:49 ` [PATCH v6 11/18] dm crypt: Convert essiv from ahash to shash Kees Cook
2018-07-24 16:49 ` [PATCH v6 12/18] drbd: Convert " Kees Cook
2018-07-24 16:49 ` [PATCH v6 13/18] wireless/lib80211: " Kees Cook
2018-07-25 7:24 ` Johannes Berg
2018-07-25 8:05 ` Kalle Valo
2018-07-24 16:49 ` [PATCH v6 15/18] staging: rtl8192e: ieee80211: " Kees Cook
2018-07-24 16:49 ` [PATCH v6 16/18] rxrpc: Reuse SKCIPHER_REQUEST_ON_STACK buffer Kees Cook
2018-08-02 23:46 ` Kees Cook [this message]
2018-08-03 9:14 ` David Howells
2018-07-24 16:49 ` [PATCH v6 17/18] crypto: ccm: Remove VLA usage Kees Cook
2018-07-24 16:57 ` Ard Biesheuvel
2018-07-24 17:51 ` Kees Cook
2018-07-24 16:49 ` [PATCH v6 18/18] crypto: Remove AHASH_REQUEST_ON_STACK Kees Cook
2018-07-24 17:31 ` Joe Perches
[not found] ` <1bdc706ae86039c4ffcff39698251424d54af116.camel-6d6DIl74uiNBDgjK7y7TUQ@public.gmane.org>
2018-07-24 17:53 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAGXu5jLVNnUXkyzGdee3zvLHw5zMaDhEGm4c4YLqU=L8q9TshA@mail.gmail.com' \
--to=keescook@chromium.org \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=ebiggers@google.com \
--cc=gustavo@embeddedor.com \
--cc=herbert@gondor.apana.org.au \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).