From patchwork Thu Mar 8 21:57:02 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10269277 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id D57AC6037E for ; Thu, 8 Mar 2018 21:57:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C202029AAC for ; Thu, 8 Mar 2018 21:57:06 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B679229AAF; Thu, 8 Mar 2018 21:57:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2A31429AAC for ; Thu, 8 Mar 2018 21:57:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750867AbeCHV5F (ORCPT ); Thu, 8 Mar 2018 16:57:05 -0500 Received: from mail-pl0-f65.google.com ([209.85.160.65]:44181 "EHLO mail-pl0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750787AbeCHV5E (ORCPT ); Thu, 8 Mar 2018 16:57:04 -0500 Received: by mail-pl0-f65.google.com with SMTP id 9-v6so4083833ple.11 for ; Thu, 08 Mar 2018 13:57:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition; bh=w0U19uYN3nSjPLiSqmXDBEuAMXFjl13Cwv1eIZMdKfw=; b=NszixnG1n5PuN2kUsDTc3ZJOZESPLh5ric/7jUQwozrxoliDEIiJ9b2wGqkz+Teddq AqILmc8sRpgPd6aNjR0Z6AWhGBofuzOOTQp+GAtWvFGLdsmEYCEGgizEOnbIlRpvpK+K BG+p1H3d/s1ANzmTQK+ZMZ5TTUv3f+0qW1s28= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=w0U19uYN3nSjPLiSqmXDBEuAMXFjl13Cwv1eIZMdKfw=; b=pN73DoWB2ZJyPMGfc+orlR3/8pfTqtVbFJPoBzylj0aLKA0Ufa5qPx3rHDz7/mdPl5 7AO2BWolCUvUmd9ng+I6RuVeZojY0jclcYOwKCTT+NazFdwOnvRPoehZ8OScsIgaahST hGemJ3VNKYLqW4dpt1XLSd67Wy5gi4DGm8lQuWuUfAGhWD4sp4Uop/WJNqcoM7Bg1KMD NDL0JDz8GS/aOxSDv31dEXF/VvnZqLrChA9NgXAYUtgDVx6BGMxLMexoDgmpqu7/ZBk3 tQ8ChCJ2L8Op0mdb+1ICIDEWrL8a656MPvEJ998we9K2V9f0uce5LVjS5uJLpQz9RKCz YAQQ== X-Gm-Message-State: APf1xPDqjkD95wYNslWcaEa6opm9oDwCN+JAhST5s37WTFkzKgrfrQvA 4VkAwzsJH/QwgtPtWPaWrx/F6Q== X-Google-Smtp-Source: AG47ELs576DaZbuZqmMVzprghQnPYbQI3q8Q0FS8vr/dulSEmswA89s+U9FVfljRGE4pkLPkOF7eGw== X-Received: by 2002:a17:902:e85:: with SMTP id 5-v6mr25180132plx.420.1520546224051; Thu, 08 Mar 2018 13:57:04 -0800 (PST) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id b123sm41408031pfb.179.2018.03.08.13.57.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Mar 2018 13:57:03 -0800 (PST) Date: Thu, 8 Mar 2018 13:57:02 -0800 From: Kees Cook To: Herbert Xu Cc: Tudor Ambarus , "David S. Miller" , linux-crypto@vger.kernel.org, kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org Subject: [PATCH v2] crypto/ecc: Remove stack VLA usage Message-ID: <20180308215702.GA9902@beast> MIME-Version: 1.0 Content-Disposition: inline Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On the quest to remove all VLAs from the kernel[1], this switches to a pair of kmalloc regions instead of using the stack. This also moves the get_random_bytes() after all allocations (and drops the needless "nbytes" variable). [1] https://lkml.org/lkml/2018/3/7/621 Signed-off-by: Kees Cook Reviewed-by: Tudor Ambarus --- crypto/ecc.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/crypto/ecc.c b/crypto/ecc.c index 18f32f2a5e1c..9c066b5ac12d 100644 --- a/crypto/ecc.c +++ b/crypto/ecc.c @@ -1025,9 +1025,7 @@ int crypto_ecdh_shared_secret(unsigned int curve_id, unsigned int ndigits, { int ret = 0; struct ecc_point *product, *pk; - u64 priv[ndigits]; - u64 rand_z[ndigits]; - unsigned int nbytes; + u64 *priv, *rand_z; const struct ecc_curve *curve = ecc_get_curve(curve_id); if (!private_key || !public_key || !curve) { @@ -1035,14 +1033,22 @@ int crypto_ecdh_shared_secret(unsigned int curve_id, unsigned int ndigits, goto out; } - nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT; + priv = kmalloc_array(ndigits, sizeof(*priv), GFP_KERNEL); + if (!priv) { + ret = -ENOMEM; + goto out; + } - get_random_bytes(rand_z, nbytes); + rand_z = kmalloc_array(ndigits, sizeof(*rand_z), GFP_KERNEL); + if (!rand_z) { + ret = -ENOMEM; + goto kfree_out; + } pk = ecc_alloc_point(ndigits); if (!pk) { ret = -ENOMEM; - goto out; + goto kfree_out; } product = ecc_alloc_point(ndigits); @@ -1051,6 +1057,8 @@ int crypto_ecdh_shared_secret(unsigned int curve_id, unsigned int ndigits, goto err_alloc_product; } + get_random_bytes(rand_z, ndigits << ECC_DIGITS_TO_BYTES_SHIFT); + ecc_swap_digits(public_key, pk->x, ndigits); ecc_swap_digits(&public_key[ndigits], pk->y, ndigits); ecc_swap_digits(private_key, priv, ndigits); @@ -1065,6 +1073,9 @@ int crypto_ecdh_shared_secret(unsigned int curve_id, unsigned int ndigits, ecc_free_point(product); err_alloc_product: ecc_free_point(pk); +kfree_out: + kzfree(priv); + kzfree(rand_z); out: return ret; }