Re: [PATCH v5 2/2] KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
From: Paul Moore <paul@paul-moore.com>
Date: 2023-02-10 17:33:13
Also in:
keyrings, linux-crypto, linux-integrity, lkml, stable
On Thu, Feb 9, 2023 at 10:56 PM Jarkko Sakkinen [off-list ref] wrote:
On Thu, Feb 09, 2023 at 05:46:32PM -0500, Paul Moore wrote:quoted
On Thu, Feb 9, 2023 at 1:53 PM Eric Biggers [off-list ref] wrote:quoted
On Thu, Feb 09, 2023 at 11:49:19AM +0100, Roberto Sassu wrote:quoted
On Fri, 2023-01-27 at 09:27 +0100, Roberto Sassu wrote:quoted
On Thu, 2022-12-29 at 14:39 -0800, Eric Biggers wrote:quoted
On Tue, Dec 27, 2022 at 03:27:40PM +0100, Roberto Sassu wrote:quoted
From: Roberto Sassu <roberto.sassu@huawei.com> Commit ac4e97abce9b8 ("scatterlist: sg_set_buf() argument must be in linear mapping") checks that both the signature and the digest reside in the linear mapping area. However, more recently commit ba14a194a434c ("fork: Add generic vmalloced stack support") made it possible to move the stack in the vmalloc area, which is not contiguous, and thus not suitable for sg_set_buf() which needs adjacent pages. Always make a copy of the signature and digest in the same buffer used to store the key and its parameters, and pass them to sg_init_one(). Prefer it to conditionally doing the copy if necessary, to keep the code simple. The buffer allocated with kmalloc() is in the linear mapping area. Cc: stable@vger.kernel.org # 4.9.x Fixes: ba14a194a434 ("fork: Add generic vmalloced stack support") Link: https://lore.kernel.org/linux-integrity/Y4pIpxbjBdajymBJ@sol.localdomain/ (local) Suggested-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> --- crypto/asymmetric_keys/public_key.c | 38 ++++++++++++++++------------- 1 file changed, 21 insertions(+), 17 deletions(-)Reviewed-by: Eric Biggers <redacted>Hi David could you please take this patch in your repo, if it is ok?Kindly ask your support here. Has this patch been queued somewhere? Wasn't able to find it, also it is not in linux-next.The maintainer of asymmetric_keys (David Howells) is ignoring this patch, so you'll need to find someone else to apply it. Herbert Xu, the maintainer of the crypto subsystem, might be willing to apply it. Or maybe Jarkko Sakkinen, who is a co-maintainer of the keyrings subsystem (but not asymmetric_keys, for some reason; should that change?).It is problematic that David isn't replying to this. I have no idea if it will work, but I just reached out to him to see if I can draw his attention back to this ...See my response to Eric.
Thanks Jarkko. -- paul-moore.com