From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from mail-pf0-f194.google.com ([209.85.192.194]:33698 "EHLO
        mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1750753AbdDBDdw (ORCPT
        <rfc822;stable@vger.kernel.org>); Sat, 1 Apr 2017 23:33:52 -0400
Date: Sat, 1 Apr 2017 20:33:49 -0700
From: Eric Biggers <ebiggers3@gmail.com>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: keyrings@vger.kernel.org, David Howells <dhowells@redhat.com>,
        Andy Lutomirski <luto@kernel.org>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        Eric Biggers <ebiggers@google.com>,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH] KEYS: encrypted: avoid encrypting/decrypting stack
 buffers
Message-ID: <20170402033349.GA5346@zzz>
References: <20170401191709.25170-1-ebiggers3@gmail.com>
 <1491099837.3499.163.camel@linux.vnet.ibm.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <1491099837.3499.163.camel@linux.vnet.ibm.com>
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Sat, Apr 01, 2017 at 10:23:57PM -0400, Mimi Zohar wrote:
> On Sat, 2017-04-01 at 12:17 -0700, Eric Biggers wrote:
> > From: Eric Biggers <ebiggers@google.com>
> > 
> > Since v4.9, the crypto API cannot (normally) be used to encrypt/decrypt
> > stack buffers because the stack may be virtually mapped.  Fix this for
> > the padding buffers in encrypted-keys by using ZERO_PAGE for the
> > encryption padding and by allocating a temporary heap buffer for the
> > decryption padding.
> > 
> > Tested with CONFIG_DEBUG_SG=y:
> > 	keyctl new_session
> > 	keyctl add user master "abcdefghijklmnop" @s
> > 	keyid=$(keyctl add encrypted desc "new user:master 25" @s)
> > 	datablob="$(keyctl pipe $keyid)"
> > 	keyctl unlink $keyid
> > 	keyid=$(keyctl add encrypted desc "load $datablob" @s)
> > 	datablob2="$(keyctl pipe $keyid)"
> > 	[ "$datablob" = "$datablob2" ] && echo "Success!"
> 
> Have you created an encrypted key on a kernel without this patch and
> attempted to load that key on a kernel with this patch? �Does it still
> work?
> 

Yes, a key exported from an unpatched kernel (with DEBUG_SG and DEBUG_VIRTUAL
turned off so it doesn't crash) can be loaded on a patched kernel, then exported
again.  The exported data is identical.

Eric