Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751716AbcLMWp3 (ORCPT ); Tue, 13 Dec 2016 17:45:29 -0500 Received: from frisell.zx2c4.com ([192.95.5.64]:39393 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751567AbcLMWp2 (ORCPT ); Tue, 13 Dec 2016 17:45:28 -0500 MIME-Version: 1.0 In-Reply-To: <20161213083948.GA8994@zzz> References: <20161212221832.10653-1-Jason@zx2c4.com> <20161213083948.GA8994@zzz> From: "Jason A. Donenfeld" Date: Tue, 13 Dec 2016 23:43:06 +0100 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH v3] siphash: add cryptographically secure hashtable function To: Eric Biggers Cc: Linus Torvalds , "kernel-hardening@lists.openwall.com" , LKML , Linux Crypto Mailing List , George Spelvin , Scott Bauer , Andi Kleen , Andy Lutomirski , Greg KH , Jean-Philippe Aumasson , "Daniel J . Bernstein" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 768 Lines: 16 Hi Eric, On Tue, Dec 13, 2016 at 9:39 AM, Eric Biggers wrote: > Hmm, I don't think you can really do load_unaligned_zeropad() without first > checking for 'left != 0'. The fixup section for load_unaligned_zeropad() > assumes that rounding the pointer down to a word boundary will produce an > address from which an 'unsigned long' can be loaded. But if 'left = 0' and we > happen to be on a page boundary with the next page unmapped, then this will not > be true and the second load will still fault. Excellent point. I haven't been able to trigger this in my experiments, but it doesn't look like there's much to prevent this from happening. I'll submit a v4 with this as fixed, since there hasn't been any other code quality issues. Jason