From: Eric Biggers Subject: Re: [kernel-hardening] Re: Remaining crypto API regressions with CONFIG_VMAP_STACK Date: Fri, 9 Dec 2016 22:03:16 -0800 Message-ID: <20161210060316.GC6846@zzz> References: <20161209230851.GB64048@google.com> <20161210053208.GA27951@gondor.apana.org.au> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Andy Lutomirski , linux-crypto@vger.kernel.org, "linux-kernel@vger.kernel.org" , "linux-mm@kvack.org" , Andrew Lutomirski , Stephan Mueller To: kernel-hardening@lists.openwall.com Return-path: Received: from mail-pg0-f68.google.com ([74.125.83.68]:35953 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750939AbcLJGDT (ORCPT ); Sat, 10 Dec 2016 01:03:19 -0500 Content-Disposition: inline In-Reply-To: <20161210053208.GA27951@gondor.apana.org.au> Sender: linux-crypto-owner@vger.kernel.org List-ID: On Sat, Dec 10, 2016 at 01:32:08PM +0800, Herbert Xu wrote: > On Fri, Dec 09, 2016 at 09:25:38PM -0800, Andy Lutomirski wrote: > > > > > The following crypto drivers initialize a scatterlist to point into an > > > ablkcipher_request, which may have been allocated on the stack with > > > SKCIPHER_REQUEST_ON_STACK(): > > > > > > drivers/crypto/ccp/ccp-crypto-aes-xts.c:162 > > > drivers/crypto/ccp/ccp-crypto-aes.c:94 > > > > These are real, and I wish I'd known about them sooner. > > Are you sure? Any instance of *_ON_STACK must only be used with > sync algorithms and most drivers under drivers/crypto declare > themselves as async. > Why exactly is that? Obviously, it wouldn't work if you returned from the stack frame before the request completed, but does anything stop someone from using an *_ON_STACK() request and then waiting for the request to complete before returning from the stack frame? Eric