mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-06 16:49:22 +00:00
Code Issues Releases Wiki Activity

dh key: get rid of stack allocated array

Browse source 
We're interested in getting rid of all of the stack allocated arrays in the
kernel: https://lkml.org/lkml/2018/3/7/621

This particular vla is used as a temporary output buffer in case there is
too much hash output for the destination buffer. Instead, let's just
allocate a buffer that's big enough initially, but only copy back to
userspace the amount that was originally asked for.

v2: allocate enough in the original output buffer vs creating a temporary
    output buffer

Signed-off-by: Tycho Andersen <tycho@tycho.ws>
Reviewed-by: Kees Cook <keescook@chromium.org>
CC: David Howells <dhowells@redhat.com>
CC: James Morris <jmorris@namei.org>
CC: "Serge E. Hallyn" <serge@hallyn.com>
CC: Eric Biggers <ebiggers3@gmail.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
This commit is contained in:
Tycho Andersen 2018-04-24 14:26:38 -06:00 committed by James Morris
parent a964f39561
commit 383203eff7
1 changed files with 10 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
security/keys/dh.c
View file

@ -183,24 +183,13 @@ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
goto err; goto err;
} }
if (dlen < h) { err = crypto_shash_final(desc, dst);
u8 tmpbuffer[h]; if (err)
goto err;
err = crypto_shash_final(desc, tmpbuffer); dlen -= h;
if (err) dst += h;
goto err; counter = cpu_to_be32(be32_to_cpu(counter) + 1);
memcpy(dst, tmpbuffer, dlen);
memzero_explicit(tmpbuffer, h);
return 0;
} else {
err = crypto_shash_final(desc, dst);
if (err)
goto err;
dlen -= h;
dst += h;
counter = cpu_to_be32(be32_to_cpu(counter) + 1);
}
} }
return 0; return 0;
@ -216,14 +205,16 @@ static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
{ {
uint8_t *outbuf = NULL; uint8_t *outbuf = NULL;
int ret; int ret;
size_t outbuf_len = round_up(buflen,
crypto_shash_digestsize(sdesc->shash.tfm));
outbuf = kmalloc(buflen, GFP_KERNEL); outbuf = kmalloc(outbuf_len, GFP_KERNEL);
if (!outbuf) { if (!outbuf) {
ret = -ENOMEM; ret = -ENOMEM;
goto err; goto err;
} }
ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, buflen, lzero); ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, outbuf_len, lzero);
if (ret) if (ret)
goto err; goto err;