Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752404AbcLNFFS (ORCPT ); Wed, 14 Dec 2016 00:05:18 -0500 Received: from helcar.hengli.com.au ([209.40.204.226]:37543 "EHLO helcar.apana.org.au" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750698AbcLNFFP (ORCPT ); Wed, 14 Dec 2016 00:05:15 -0500 Date: Wed, 14 Dec 2016 13:04:04 +0800 From: Herbert Xu To: Andy Lutomirski Cc: Andy Lutomirski , "linux-kernel@vger.kernel.org" , USB list , David Howells , keyrings@vger.kernel.org, Eric Biggers , linux-crypto@vger.kernel.org, Stephan Mueller Subject: Re: [PATCH v2] keys/encrypted: Fix two crypto-on-the-stack bugs Message-ID: <20161214050404.GC9592@gondor.apana.org.au> References: <627e948e37314c13a67c90917386c814c56b8e20.1481683609.git.luto@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 941 Lines: 23 On Tue, Dec 13, 2016 at 06:53:03PM -0800, Andy Lutomirski wrote: > On Tue, Dec 13, 2016 at 6:48 PM, Andy Lutomirski wrote: > > The driver put a constant buffer of all zeros on the stack and > > pointed a scatterlist entry at it in two places. This doesn't work > > with virtual stacks. Use ZERO_PAGE instead. > > Wait a second... > > > - sg_set_buf(&sg_out[1], pad, sizeof pad); > > + sg_set_buf(&sg_out[1], empty_zero_page, 16); > > My fix here is obviously bogus (I meant to use ZERO_PAGE(0)), but what > exactly is the code trying to do? The old code makes no sense. It's > setting the *output* buffer to zeroed padding. It's decrypting so I presume it just needs to the extra space for the padding and the result will be thrown away. Cheers, -- Email: Herbert Xu Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt