Re: [PATCH] KEYS: encrypted: avoid encrypting/decrypting stack buffers

2017-04-03 Thread Eric Biggers
On Mon, Apr 03, 2017 at 11:55:42AM -0400, Mimi Zohar wrote: > > This patch removes calculating the "padlen".  Will this change break > other use cases? > No, the number of bytes being encrypted is still 'encrypted_datalen' which is passed to skcipher_request_set_crypt(). It's okay if the input

Re: [PATCH] KEYS: encrypted: avoid encrypting/decrypting stack buffers

2017-04-03 Thread Mimi Zohar
On Sat, 2017-04-01 at 20:33 -0700, Eric Biggers wrote: > On Sat, Apr 01, 2017 at 10:23:57PM -0400, Mimi Zohar wrote: > > On Sat, 2017-04-01 at 12:17 -0700, Eric Biggers wrote: > > > From: Eric Biggers > > > > > > Since v4.9, the crypto API cannot (normally) be used to encrypt/decrypt > > > stack

Re: [PATCH] KEYS: encrypted: avoid encrypting/decrypting stack buffers

2017-04-03 Thread David Howells
Pulled.

Re: [PATCH] KEYS: encrypted: avoid encrypting/decrypting stack buffers

2017-04-01 Thread Eric Biggers
On Sat, Apr 01, 2017 at 10:23:57PM -0400, Mimi Zohar wrote: > On Sat, 2017-04-01 at 12:17 -0700, Eric Biggers wrote: > > From: Eric Biggers > > > > Since v4.9, the crypto API cannot (normally) be used to encrypt/decrypt > > stack buffers because the stack may be virtually mapped. Fix this for >

Re: [PATCH] KEYS: encrypted: avoid encrypting/decrypting stack buffers

2017-04-01 Thread Mimi Zohar
Hi Eric, On Sat, 2017-04-01 at 12:17 -0700, Eric Biggers wrote: > From: Eric Biggers > > Since v4.9, the crypto API cannot (normally) be used to encrypt/decrypt > stack buffers because the stack may be virtually mapped. Fix this for > the padding buffers in encrypted-keys by using ZERO_PAGE for

[PATCH] KEYS: encrypted: avoid encrypting/decrypting stack buffers

2017-04-01 Thread Eric Biggers
From: Eric Biggers Since v4.9, the crypto API cannot (normally) be used to encrypt/decrypt stack buffers because the stack may be virtually mapped. Fix this for the padding buffers in encrypted-keys by using ZERO_PAGE for the encryption padding and by allocating a temporary heap buffer for the d