Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-19 Thread Kees Cook
On Thu, Jul 19, 2018 at 7:54 AM, Ard Biesheuvel wrote: > On 19 July 2018 at 12:13, Ard Biesheuvel wrote: >> >>> On 19 Jul 2018, at 12:09, Kees Cook wrote: >>> >>> On Wed, Jul 18, 2018 at 7:55 PM, Ard Biesheuvel >>> wrote: I have only build tested it, so if you make sure that it does not

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-19 Thread Ard Biesheuvel
On 19 July 2018 at 12:13, Ard Biesheuvel wrote: > >> On 19 Jul 2018, at 12:09, Kees Cook wrote: >> >> On Wed, Jul 18, 2018 at 7:55 PM, Ard Biesheuvel >> wrote: >>> I have only build tested it, so if you make sure that it does not break >>> anything, please go ahead. >> >> I can give it a spin;

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-18 Thread Ard Biesheuvel
> On 19 Jul 2018, at 12:09, Kees Cook wrote: > > On Wed, Jul 18, 2018 at 7:55 PM, Ard Biesheuvel > wrote: >> I have only build tested it, so if you make sure that it does not break >> anything, please go ahead. > > I can give it a spin; what's the best way? Is CONFIG_CRYPTO_MANAGER=y >

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-18 Thread Kees Cook
On Wed, Jul 18, 2018 at 7:55 PM, Ard Biesheuvel wrote: > I have only build tested it, so if you make sure that it does not break > anything, please go ahead. I can give it a spin; what's the best way? Is CONFIG_CRYPTO_MANAGER=y sufficient? -Kees -- Kees Cook Pixel Security -- dm-devel

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-18 Thread Ard Biesheuvel
> On 19 Jul 2018, at 11:51, Kees Cook wrote: > > On Wed, Jul 18, 2018 at 8:19 AM, Ard Biesheuvel > wrote: >> On 18 July 2018 at 23:50, Ard Biesheuvel wrote: On 18 July 2018 at 05:59, Arnd Bergmann wrote: > On Sun, Jul 15, 2018 at 6:28 AM, Kees Cook wrote: > > After my

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-18 Thread Kees Cook
On Wed, Jul 18, 2018 at 8:19 AM, Ard Biesheuvel wrote: > On 18 July 2018 at 23:50, Ard Biesheuvel wrote: >> On 18 July 2018 at 05:59, Arnd Bergmann wrote: >>> On Sun, Jul 15, 2018 at 6:28 AM, Kees Cook wrote: After my ahash to shash conversions, only ccm is left as an ahash

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-18 Thread Ard Biesheuvel
On 19 July 2018 at 00:33, Arnd Bergmann wrote: > On Wed, Jul 18, 2018 at 5:19 PM, Ard Biesheuvel > wrote: >> On 18 July 2018 at 23:50, Ard Biesheuvel wrote: >>> On 18 July 2018 at 05:59, Arnd Bergmann wrote: On Sun, Jul 15, 2018 at 6:28 AM, Kees Cook wrote: > > After my ahash to

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-18 Thread Arnd Bergmann
On Wed, Jul 18, 2018 at 5:19 PM, Ard Biesheuvel wrote: > On 18 July 2018 at 23:50, Ard Biesheuvel wrote: >> On 18 July 2018 at 05:59, Arnd Bergmann wrote: >>> On Sun, Jul 15, 2018 at 6:28 AM, Kees Cook wrote: After my ahash to shash conversions, only ccm is left as an ahash

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-18 Thread Ard Biesheuvel
On 18 July 2018 at 23:50, Ard Biesheuvel wrote: > On 18 July 2018 at 05:59, Arnd Bergmann wrote: >> On Sun, Jul 15, 2018 at 6:28 AM, Kees Cook wrote: >>> >>> After my ahash to shash conversions, only ccm is left as an ahash >>> user, since it actually uses sg. But with the hard-coded value

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-18 Thread Ard Biesheuvel
On 18 July 2018 at 05:59, Arnd Bergmann wrote: > On Sun, Jul 15, 2018 at 6:28 AM, Kees Cook wrote: >> >> After my ahash to shash conversions, only ccm is left as an ahash >> user, since it actually uses sg. But with the hard-coded value reduced >> to 376, this doesn't trip the frame warnings any

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-17 Thread Arnd Bergmann
On Sun, Jul 15, 2018 at 6:28 AM, Kees Cook wrote: > > After my ahash to shash conversions, only ccm is left as an ahash > user, since it actually uses sg. But with the hard-coded value reduced > to 376, this doesn't trip the frame warnings any more. :) > > I'll send an updated series soon. Maybe

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-16 Thread Arnd Bergmann
On Mon, Jul 16, 2018 at 5:39 AM, Kees Cook wrote: > On Sun, Jul 15, 2018 at 5:01 PM, Herbert Xu > wrote: >> On Sat, Jul 14, 2018 at 07:59:09PM -0700, Kees Cook wrote: >>> On Sat, Jul 14, 2018 at 7:44 PM, Herbert Xu >>> wrote: >>> > On Fri, Jul 13, 2018 at 08:07:10PM -0700, Kees Cook wrote:

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-15 Thread Kees Cook
On Sun, Jul 15, 2018 at 5:01 PM, Herbert Xu wrote: > On Sat, Jul 14, 2018 at 07:59:09PM -0700, Kees Cook wrote: >> On Sat, Jul 14, 2018 at 7:44 PM, Herbert Xu >> wrote: >> > On Fri, Jul 13, 2018 at 08:07:10PM -0700, Kees Cook wrote: >> >> >> >> On a plane today I started converting all these to

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-15 Thread Herbert Xu
On Sat, Jul 14, 2018 at 07:59:09PM -0700, Kees Cook wrote: > On Sat, Jul 14, 2018 at 7:44 PM, Herbert Xu > wrote: > > On Fri, Jul 13, 2018 at 08:07:10PM -0700, Kees Cook wrote: > >> > >> On a plane today I started converting all these to shash. IIUC, it > >> just looks like this (apologies for

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-14 Thread Kees Cook
On Fri, Jul 13, 2018 at 3:14 AM, Arnd Bergmann wrote: > On Fri, Jul 13, 2018 at 8:00 AM, Kees Cook wrote: >> On Thu, Jul 12, 2018 at 10:20 PM, Herbert Xu >> wrote: >>> On Thu, Jul 12, 2018 at 10:17:29PM -0700, Kees Cook wrote: What is the correct value to use for AHASH_REQUEST_ON_STACK?

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-14 Thread Kees Cook
On Sat, Jul 14, 2018 at 7:44 PM, Herbert Xu wrote: > On Fri, Jul 13, 2018 at 08:07:10PM -0700, Kees Cook wrote: >> >> On a plane today I started converting all these to shash. IIUC, it >> just looks like this (apologies for whitespace damage): > > Yes if it doesn't actually make use of SGs then

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-14 Thread Herbert Xu
On Fri, Jul 13, 2018 at 08:07:10PM -0700, Kees Cook wrote: > > On a plane today I started converting all these to shash. IIUC, it > just looks like this (apologies for whitespace damage): Yes if it doesn't actually make use of SGs then shash would be the way to go. However, for SG users ahash is

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-13 Thread Kees Cook
On Thu, Jul 12, 2018 at 11:22 PM, Herbert Xu wrote: > On Thu, Jul 12, 2018 at 11:16:28PM -0700, Kees Cook wrote: >> >> Is this correct? It seems like you did the bulk of >> AHASH_REQUEST_ON_STACK conversions in 2016. Can shash grow an sg >> interface? > > shash does not need to grow an sg

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-13 Thread Arnd Bergmann
On Fri, Jul 13, 2018 at 8:00 AM, Kees Cook wrote: > On Thu, Jul 12, 2018 at 10:20 PM, Herbert Xu > wrote: >> On Thu, Jul 12, 2018 at 10:17:29PM -0700, Kees Cook wrote: >>> What is the correct value to use for AHASH_REQUEST_ON_STACK? >> >> As I said to arrive at a fixed value you should examine

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-13 Thread Herbert Xu
On Thu, Jul 12, 2018 at 11:16:28PM -0700, Kees Cook wrote: > > Is this correct? It seems like you did the bulk of > AHASH_REQUEST_ON_STACK conversions in 2016. Can shash grow an sg > interface? shash does not need to grow an sg interface. All users of AHASH_REQUEST_ON_STACK set the

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-13 Thread Kees Cook
On Thu, Jul 12, 2018 at 5:40 PM, Herbert Xu wrote: > On Thu, Jul 12, 2018 at 06:02:26PM +0200, Arnd Bergmann wrote: >> >> Looking through some of the drivers, I found this interesting one: > > As I said before these patches are fundamentally broken. Users > of AHASH_REQUEST_ON_STACK can only use

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-13 Thread Kees Cook
On Thu, Jul 12, 2018 at 10:20 PM, Herbert Xu wrote: > On Thu, Jul 12, 2018 at 10:17:29PM -0700, Kees Cook wrote: >> >> Then why does the instrumented tcrypt output show the huge size? Is >> tcrypt doing something incorrectly? > > tcrypt doesn't even use AHASH_REQUEST_ON_STACK so I don't

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-12 Thread Herbert Xu
On Thu, Jul 12, 2018 at 10:17:29PM -0700, Kees Cook wrote: > > Then why does the instrumented tcrypt output show the huge size? Is > tcrypt doing something incorrectly? tcrypt doesn't even use AHASH_REQUEST_ON_STACK so I don't understand your point. > What is the correct value to use for

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-12 Thread Kees Cook
On Thu, Jul 12, 2018 at 8:44 PM, Herbert Xu wrote: > On Thu, Jul 12, 2018 at 08:33:24PM -0700, Kees Cook wrote: >> On Thu, Jul 12, 2018 at 5:40 PM, Herbert Xu >> wrote: >> > On Thu, Jul 12, 2018 at 06:02:26PM +0200, Arnd Bergmann wrote: >> >> >> >> Looking through some of the drivers, I found

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-12 Thread Herbert Xu
On Thu, Jul 12, 2018 at 08:33:24PM -0700, Kees Cook wrote: > On Thu, Jul 12, 2018 at 5:40 PM, Herbert Xu > wrote: > > On Thu, Jul 12, 2018 at 06:02:26PM +0200, Arnd Bergmann wrote: > >> > >> Looking through some of the drivers, I found this interesting one: > > > > As I said before these patches

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-12 Thread Kees Cook
On Thu, Jul 12, 2018 at 5:40 PM, Herbert Xu wrote: > On Thu, Jul 12, 2018 at 06:02:26PM +0200, Arnd Bergmann wrote: >> >> Looking through some of the drivers, I found this interesting one: > > As I said before these patches are fundamentally broken. Users > of AHASH_REQUEST_ON_STACK can only use

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-12 Thread Herbert Xu
On Thu, Jul 12, 2018 at 06:02:26PM +0200, Arnd Bergmann wrote: > > Looking through some of the drivers, I found this interesting one: As I said before these patches are fundamentally broken. Users of AHASH_REQUEST_ON_STACK can only use sync algorithm providers and therefore drivers are

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-12 Thread Arnd Bergmann
On Thu, Jul 12, 2018 at 10:17 PM, Kees Cook wrote: > On Thu, Jul 12, 2018 at 9:02 AM, Arnd Bergmann wrote: >> On Wed, Jul 11, 2018 at 10:36 PM, Kees Cook wrote: >>> Several uses of AHASH_REQUEST_ON_STACK() will trigger FRAME_WARN warnings >>> (when less than 2048) once the VLA is no longer

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-12 Thread Kees Cook
On Thu, Jul 12, 2018 at 9:02 AM, Arnd Bergmann wrote: > On Wed, Jul 11, 2018 at 10:36 PM, Kees Cook wrote: >> Several uses of AHASH_REQUEST_ON_STACK() will trigger FRAME_WARN warnings >> (when less than 2048) once the VLA is no longer hidden from the check: >> >>

Re: [dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-12 Thread Arnd Bergmann
On Wed, Jul 11, 2018 at 10:36 PM, Kees Cook wrote: > Several uses of AHASH_REQUEST_ON_STACK() will trigger FRAME_WARN warnings > (when less than 2048) once the VLA is no longer hidden from the check: > > drivers/block/drbd/drbd_worker.c:325:1: warning: the frame size of 1112 bytes > is larger

[dm-devel] [PATCH v4 11/14] treewide: Prepare to remove VLA usage for AHASH_REQUEST_ON_STACK

2018-07-11 Thread Kees Cook
Several uses of AHASH_REQUEST_ON_STACK() will trigger FRAME_WARN warnings (when less than 2048) once the VLA is no longer hidden from the check: drivers/block/drbd/drbd_worker.c:325:1: warning: the frame size of 1112 bytes is larger than 1024 bytes [-Wframe-larger-than=]