Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

wusb: Remove VLA usage of skcipher

In the quest to remove all stack VLA usage from the kernel[1], this
replaces struct crypto_skcipher and SKCIPHER_REQUEST_ON_STACK() usage
with struct crypto_sync_skcipher and SYNC_SKCIPHER_REQUEST_ON_STACK(),
which uses a fixed stack size.

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
Cc: Johan Hovold <johan@kernel.org>
Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Cc: linux-usb@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

authored by

Kees Cook and committed by
Herbert Xu
d2841f22 69d826fa

+8 -8
+8 -8
drivers/usb/wusbcore/crypto.c
··· 189 189 * NOTE: blen is not aligned to a block size, we'll pad zeros, that's 190 190 * what sg[4] is for. Maybe there is a smarter way to do this. 191 191 */ 192 - static int wusb_ccm_mac(struct crypto_skcipher *tfm_cbc, 192 + static int wusb_ccm_mac(struct crypto_sync_skcipher *tfm_cbc, 193 193 struct crypto_cipher *tfm_aes, 194 194 struct wusb_mac_scratch *scratch, 195 195 void *mic, ··· 198 198 size_t blen) 199 199 { 200 200 int result = 0; 201 - SKCIPHER_REQUEST_ON_STACK(req, tfm_cbc); 201 + SYNC_SKCIPHER_REQUEST_ON_STACK(req, tfm_cbc); 202 202 struct scatterlist sg[4], sg_dst; 203 203 void *dst_buf; 204 204 size_t dst_size; ··· 224 224 if (!dst_buf) 225 225 goto error_dst_buf; 226 226 227 - iv = kzalloc(crypto_skcipher_ivsize(tfm_cbc), GFP_KERNEL); 227 + iv = kzalloc(crypto_sync_skcipher_ivsize(tfm_cbc), GFP_KERNEL); 228 228 if (!iv) 229 229 goto error_iv; 230 230 ··· 251 251 sg_set_page(&sg[3], ZERO_PAGE(0), zero_padding, 0); 252 252 sg_init_one(&sg_dst, dst_buf, dst_size); 253 253 254 - skcipher_request_set_tfm(req, tfm_cbc); 254 + skcipher_request_set_sync_tfm(req, tfm_cbc); 255 255 skcipher_request_set_callback(req, 0, NULL, NULL); 256 256 skcipher_request_set_crypt(req, sg, &sg_dst, dst_size, iv); 257 257 result = crypto_skcipher_encrypt(req); ··· 298 298 { 299 299 ssize_t result, bytes = 0, bitr; 300 300 struct aes_ccm_nonce n = *_n; 301 - struct crypto_skcipher *tfm_cbc; 301 + struct crypto_sync_skcipher *tfm_cbc; 302 302 struct crypto_cipher *tfm_aes; 303 303 struct wusb_mac_scratch *scratch; 304 304 u64 sfn = 0; 305 305 __le64 sfn_le; 306 306 307 - tfm_cbc = crypto_alloc_skcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC); 307 + tfm_cbc = crypto_alloc_sync_skcipher("cbc(aes)", 0, 0); 308 308 if (IS_ERR(tfm_cbc)) { 309 309 result = PTR_ERR(tfm_cbc); 310 310 printk(KERN_ERR "E: can't load CBC(AES): %d\n", (int)result); 311 311 goto error_alloc_cbc; 312 312 } 313 - result = crypto_skcipher_setkey(tfm_cbc, key, 16); 313 + result = crypto_sync_skcipher_setkey(tfm_cbc, key, 16); 314 314 if (result < 0) { 315 315 printk(KERN_ERR "E: can't set CBC key: %d\n", (int)result); 316 316 goto error_setkey_cbc; ··· 351 351 crypto_free_cipher(tfm_aes); 352 352 error_alloc_aes: 353 353 error_setkey_cbc: 354 - crypto_free_skcipher(tfm_cbc); 354 + crypto_free_sync_skcipher(tfm_cbc); 355 355 error_alloc_cbc: 356 356 return result; 357 357 }