Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH 2/5] crypto: hisilicon/sec - add ahash alg features for
 Kunpeng920
To:     Herbert Xu <herbert@gondor.apana.org.au>,
        <wangzhou1@hisilicon.com>, <linux-crypto@vger.kernel.org>
References: <1628847626-24383-1-git-send-email-yekai13@huawei.com>
 <1628847626-24383-3-git-send-email-yekai13@huawei.com>
 <20210821072557.GA31491@gondor.apana.org.au>
 <bac4d0b8-0dd1-ddeb-8d78-0c20a2d5ecdc@huawei.com>
 <20210827083652.GD21571@gondor.apana.org.au>
From:   "yekai(A)" <yekai13@huawei.com>
Message-ID: <337a3bac-86d4-c66e-9d6a-d4aa6685f83d@huawei.com>
Date:   Sat, 28 Aug 2021 11:16:47 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.7.1
MIME-Version: 1.0
In-Reply-To: <20210827083652.GD21571@gondor.apana.org.au>
Content-Type: text/plain; charset="windows-1252"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 2021/8/27 16:36, Herbert Xu wrote:
> On Sat, Aug 21, 2021 at 05:07:00PM +0800, yekai(A) wrote:
>>
>>
>> On 2021/8/21 15:25, Herbert Xu wrote:
>>> On Fri, Aug 13, 2021 at 05:40:23PM +0800, Kai Ye wrote:
>>>>
>>>> +static int sec_ahash_import(struct ahash_request *req, const void *in)
>>>> +{
>>>> +	/*
>>>> +	 * Import partial state of the transformation. This function loads the
>>>> +	 * entire state of the ongoing transformation from a provided block of
>>>> +	 * data so the transformation can continue from this point onward.
>>>> +	 */
>>>> +	struct sec_req *sreq = ahash_request_ctx(req);
>>>> +
>>>> +	memcpy(sreq, in, sizeof(struct sec_req));
>>>> +	return 0;
>>>> +}
>>>
>>> Please explain how this works given that you've got pointers in
>>> struct sec_req?
>>>
>>> Thanks,
>>>
>> We have set the sec_req size by use the "crypto_ahash_set_reqsize" in ahash
>> tfm init process. The crypto will allocate memory for the sec_req by
>> "__ctx[]". And we can got the pointers by use ahash_request. like
>>
>> void *temp = ahash_request_ctx(req);
>> struct sec_req *sreq = (struct sec_req)temp;
>>
>> The value of halg.statesize is sizeof(struct sec_req), so the user can get
>> the statesize.
>
> The data you get from the import could be random garbage.  Please
> explain how you avoid dereferencing random pointers in your code
> through the import path.
>
> Thanks,
>

I refered to other people's plans. Modify the value of halg.statesize
is sizeof(struct sec_req) + sizeof(u32), So user can allocate an extra 
sizeof(u32) memory. The driver will write a tag number to the addr in 
the export process, then the driver will check the pointers by the tag 
number through the import path.
I think this plan can avoid random pointers.

Thanks
Kai