lkml.org 
[lkml]   [2017]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] KEYS: encrypted: avoid encrypting/decrypting stack buffers
From
Date
On Sat, 2017-04-01 at 20:33 -0700, Eric Biggers wrote:
> On Sat, Apr 01, 2017 at 10:23:57PM -0400, Mimi Zohar wrote:
> > On Sat, 2017-04-01 at 12:17 -0700, Eric Biggers wrote:
> > > From: Eric Biggers <ebiggers@google.com>
> > >
> > > Since v4.9, the crypto API cannot (normally) be used to encrypt/decrypt
> > > stack buffers because the stack may be virtually mapped. Fix this for
> > > the padding buffers in encrypted-keys by using ZERO_PAGE for the
> > > encryption padding and by allocating a temporary heap buffer for the
> > > decryption padding.
> > >
> > > Tested with CONFIG_DEBUG_SG=y:
> > > keyctl new_session
> > > keyctl add user master "abcdefghijklmnop" @s
> > > keyid=$(keyctl add encrypted desc "new user:master 25" @s)
> > > datablob="$(keyctl pipe $keyid)"
> > > keyctl unlink $keyid
> > > keyid=$(keyctl add encrypted desc "load $datablob" @s)
> > > datablob2="$(keyctl pipe $keyid)"
> > > [ "$datablob" = "$datablob2" ] && echo "Success!"
> >
> > Have you created an encrypted key on a kernel without this patch and
> > attempted to load that key on a kernel with this patch?  Does it still
> > work?
> >
>
> Yes, a key exported from an unpatched kernel (with DEBUG_SG and DEBUG_VIRTUAL
> turned off so it doesn't crash) can be loaded on a patched kernel, then exported
> again. The exported data is identical.

This patch removes calculating the "padlen".  Will this change break
other use cases?

Mimi

\
 
 \ /
  Last update: 2017-04-03 17:56    [W:0.056 / U:0.776 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site