mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Andy Lutomirski <luto@kernel.org>
To: linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
	sfrench@samba.org
Cc: Eric Biggers <ebiggers3@gmail.com>,
	linux-crypto@vger.kernel.org,
	Herbert Xu <herbert@gondor.apana.org.au>,
	Stephan Mueller <smueller@chronox.de>,
	linux-cifs@vger.kernel.org, Andy Lutomirski <luto@kernel.org>
Subject: [PATCH] cifs: Fix smbencrypt() to stop pointing a scatterlist at the stack
Date: Mon, 12 Dec 2016 12:54:37 -0800	[thread overview]
Message-ID: <308cdb484648f98f6f0ad9feefd8acb2fe003aaf.1481575835.git.luto@kernel.org> (raw)
In-Reply-To: <8c273c9c41f51b34bb3115086f1d776895580637.1481575835.git.luto@kernel.org>

smbencrypt() points a scatterlist to the stack, which is breaks if
CONFIG_VMAP_STACK=y.

Fix it by switching to crypto_cipher_encrypt_one().  The new code
should be considerably faster as an added benefit.

This code is nearly identical to some code that Eric Biggers
suggested.

Cc: stable@vger.kernel.org # 4.9 only
Reported-by: Eric Biggers <ebiggers3@gmail.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---

Compile-tested only.

fs/cifs/smbencrypt.c | 40 ++++++++--------------------------------
 1 file changed, 8 insertions(+), 32 deletions(-)

diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 699b7868108f..c12bffefa3c9 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -23,7 +23,7 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
-#include <crypto/skcipher.h>
+#include <linux/crypto.h>
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/fs.h>
@@ -69,46 +69,22 @@ str_to_key(unsigned char *str, unsigned char *key)
 static int
 smbhash(unsigned char *out, const unsigned char *in, unsigned char *key)
 {
-	int rc;
 	unsigned char key2[8];
-	struct crypto_skcipher *tfm_des;
-	struct scatterlist sgin, sgout;
-	struct skcipher_request *req;
+	struct crypto_cipher *tfm_des;
 
 	str_to_key(key, key2);
 
-	tfm_des = crypto_alloc_skcipher("ecb(des)", 0, CRYPTO_ALG_ASYNC);
+	tfm_des = crypto_alloc_cipher("des", 0, 0);
 	if (IS_ERR(tfm_des)) {
-		rc = PTR_ERR(tfm_des);
-		cifs_dbg(VFS, "could not allocate des crypto API\n");
-		goto smbhash_err;
-	}
-
-	req = skcipher_request_alloc(tfm_des, GFP_KERNEL);
-	if (!req) {
-		rc = -ENOMEM;
 		cifs_dbg(VFS, "could not allocate des crypto API\n");
-		goto smbhash_free_skcipher;
+		return PTR_ERR(tfm_des);
 	}
 
-	crypto_skcipher_setkey(tfm_des, key2, 8);
-
-	sg_init_one(&sgin, in, 8);
-	sg_init_one(&sgout, out, 8);
+	crypto_cipher_setkey(tfm_des, key2, 8);
+	crypto_cipher_encrypt_one(tfm_des, out, in);
+	crypto_free_cipher(tfm_des);
 
-	skcipher_request_set_callback(req, 0, NULL, NULL);
-	skcipher_request_set_crypt(req, &sgin, &sgout, 8, NULL);
-
-	rc = crypto_skcipher_encrypt(req);
-	if (rc)
-		cifs_dbg(VFS, "could not encrypt crypt key rc: %d\n", rc);
-
-	skcipher_request_free(req);
-
-smbhash_free_skcipher:
-	crypto_free_skcipher(tfm_des);
-smbhash_err:
-	return rc;
+	return 0;
 }
 
 static int
-- 
2.9.3

  parent reply	other threads:[~2016-12-12 20:54 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-12-12 20:52 [PATCH] wusbcore: Fix one more crypto-on-the-stack bug Andy Lutomirski
2016-12-12 20:53 ` [PATCH] keys/encrypted: Fix two crypto-on-the-stack bugs Andy Lutomirski
2016-12-13 12:20   ` David Laight
2016-12-13 16:40     ` Andy Lutomirski
2016-12-14 16:58       ` Joerg Roedel
2016-12-13 16:45     ` David Howells
2016-12-13 17:02       ` Andy Lutomirski
2016-12-13 20:02       ` David Howells
2016-12-12 20:54 ` Andy Lutomirski [this message]
2016-12-13 11:40   ` [PATCH] cifs: Fix smbencrypt() to stop pointing a scatterlist at the stack Sergei Shtylyov
2016-12-13 13:07   ` Jeff Layton
2016-12-14  8:19     ` Steve French
2016-12-12 20:55 ` [PATCH] crypto: Make a few drivers depend on !VMAP_STACK Andy Lutomirski
2016-12-13  3:42   ` Herbert Xu
2016-12-12 20:55 ` [PATCH] orinoco: Use shash instead of ahash for MIC calculations Andy Lutomirski
2016-12-13  7:54   ` Eric Biggers
2016-12-13 11:35   ` Kalle Valo
2016-12-13 16:41     ` Andy Lutomirski
2016-12-13 17:03       ` Kalle Valo
2016-12-30 11:34   ` Kalle Valo
2016-12-30 12:02     ` Kalle Valo
2016-12-30 12:15       ` Kalle Valo
2016-12-12 21:44 ` [PATCH] wusbcore: Fix one more crypto-on-the-stack bug Greg KH
2016-12-12 23:57   ` Andy Lutomirski
2016-12-12 22:28 ` [PATCH] keys/encrypted: Fix two crypto-on-the-stack bugs David Howells
2016-12-13  0:32   ` Andy Lutomirski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=308cdb484648f98f6f0ad9feefd8acb2fe003aaf.1481575835.git.luto@kernel.org \
    --to=luto@kernel.org \
    --cc=ebiggers3@gmail.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-cifs@vger.kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=sfrench@samba.org \
    --cc=smueller@chronox.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®