1. 09 Nov, 2018 1 commit
    • Eric Biggers's avatar
      crypto: user - clean up report structure copying · 37db69e0
      Eric Biggers authored
      There have been a pretty ridiculous number of issues with initializing
      the report structures that are copied to userspace by NETLINK_CRYPTO.
      Commit 4473710d ("crypto: user - Prepare for CRYPTO_MAX_ALG_NAME
      expansion") replaced some strncpy()s with strlcpy()s, thereby
      introducing information leaks.  Later two other people tried to replace
      other strncpy()s with strlcpy() too, which would have introduced even
      more information leaks:
      
          - https://lore.kernel.org/patchwork/patch/954991/
          - https://patchwork.kernel.org/patch/10434351/
      
      Commit cac5818c ("crypto: user - Implement a generic crypto
      statistics") also uses the buggy strlcpy() approach and therefore leaks
      uninitialized memory to userspace.  A fix was proposed, but it was
      originally incomplete.
      
      Seeing as how apparently no one can get this right with the current
      approach, change all the reporting functions to:
      
      - Start by memsetting the report structure to 0.  This guarantees it's
        always initialized, regardless of what happens later.
      - Initialize all strings using strscpy().  This is safe after the
        memset, ensures null termination of long strings, avoids unnecessary
        work, and avoids the -Wstringop-truncation warnings from gcc.
      - Use sizeof(var) instead of sizeof(type).  This is more robust against
        copy+paste errors.
      
      For simplicity, also reuse the -EMSGSIZE return value from nla_put().
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarHerbert Xu <herbert@gondor.apana.org.au>
      37db69e0
  2. 06 Jan, 2018 1 commit
  3. 03 Aug, 2017 3 commits
  4. 24 Apr, 2017 1 commit
  5. 12 Jan, 2017 1 commit
    • Gideon Israel Dsouza's avatar
      crypto: Replaced gcc specific attributes with macros from compiler.h · d8c34b94
      Gideon Israel Dsouza authored
      Continuing from this commit: 52f5684c
      ("kernel: use macros from compiler.h instead of __attribute__((...))")
      
      I submitted 4 total patches. They are part of task I've taken up to
      increase compiler portability in the kernel. I've cleaned up the
      subsystems under /kernel /mm /block and /security, this patch targets
      /crypto.
      
      There is <linux/compiler.h> which provides macros for various gcc specific
      constructs. Eg: __weak for __attribute__((weak)). I've cleaned all
      instances of gcc specific attributes with the right macros for the crypto
      subsystem.
      
      I had to make one additional change into compiler-gcc.h for the case when
      one wants to use this: __attribute__((aligned) and not specify an alignment
      factor. From the gcc docs, this will result in the largest alignment for
      that data type on the target machine so I've named the macro
      __aligned_largest. Please advise if another name is more appropriate.
      Signed-off-by: 's avatarGideon Israel Dsouza <gidisrael@gmail.com>
      Signed-off-by: 's avatarHerbert Xu <herbert@gondor.apana.org.au>
      d8c34b94
  6. 25 Oct, 2016 1 commit