From patchwork Sat Jan 14 18:27:37 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Dobriyan X-Patchwork-Id: 136092 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 079E4B6F67 for ; Sun, 15 Jan 2012 05:27:57 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756435Ab2ANS1r (ORCPT ); Sat, 14 Jan 2012 13:27:47 -0500 Received: from mail-bk0-f46.google.com ([209.85.214.46]:44730 "EHLO mail-bk0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756128Ab2ANS1o (ORCPT ); Sat, 14 Jan 2012 13:27:44 -0500 Received: by bkuw12 with SMTP id w12so698283bku.19 for ; Sat, 14 Jan 2012 10:27:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=2vbH6zrMgODUrYtf+0CRl2JUzrYa3p8o0P6I0qV4Wo0=; b=NRtighGKelhge+ccylwnfi77w8Sg6tGAMZSMJ7gTcYHOirLA9Bd11VH+M8oHgLHSHH djvVsW7ancOMCcbSR3EhENRscfXsS9hfMicLJdC6woqzs1hMUFTdXJI9nSmsOzxNZZPr uuOnBFTqPPM5GqOk2CfoXxiw95YJctqXa4FfM= Received: by 10.205.134.139 with SMTP id ic11mr2376430bkc.114.1326565663394; Sat, 14 Jan 2012 10:27:43 -0800 (PST) Received: from p183.telecom.by (vulture2-nat-44.telecom.by. [213.184.224.44]) by mx.google.com with ESMTPS id iu2sm26734566bkb.0.2012.01.14.10.27.40 (version=TLSv1/SSLv3 cipher=OTHER); Sat, 14 Jan 2012 10:27:42 -0800 (PST) Date: Sat, 14 Jan 2012 21:27:37 +0300 From: Alexey Dobriyan To: Herbert Xu Cc: linux-crypto@vger.kernel.org, netdev@vger.kernel.org, ken@codelabs.ch, Steffen Klassert , Eric Dumazet , security@kernel.org Subject: [PATCH 1/3] sha512: make it work, undo percpu message schedule Message-ID: <20120114182737.GB4207@p183.telecom.by> References: <20120111000040.GA3801@p183.telecom.by> <20120111003611.GA12257@gondor.apana.org.au> <20120112235514.GA5065@p183.telecom.by> <20120113070813.GA20068@gondor.apana.org.au> <1326450942.2272.20.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC> <1326451301.2272.23.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC> <1326452246.2272.31.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC> <1326458053.3826.4.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC> <20120114182024.GA4207@p183.telecom.by> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20120114182024.GA4207@p183.telecom.by> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org commit f9e2bca6c22d75a289a349f869701214d63b5060 aka "crypto: sha512 - Move message schedule W[80] to static percpu area" created global message schedule area. If sha512_update will ever be entered twice, hash will be silently calculated incorrectly. Probably the easiest way to notice incorrect hashes being calculated is to run 2 ping floods over AH with hmac(sha512): #!/usr/sbin/setkey -f flush; spdflush; add IP1 IP2 ah 25 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025; add IP2 IP1 ah 52 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052; spdadd IP1 IP2 any -P out ipsec ah/transport//require; spdadd IP2 IP1 any -P in ipsec ah/transport//require; XfrmInStateProtoError will start ticking with -EBADMSG being returned from ah_input(). This never happens with, say, hmac(sha1). With patch applied (on BOTH sides), XfrmInStateProtoError does not tick with multiple bidirectional ping flood streams like it doesn't tick with SHA-1. After this patch sha512_transform() will start using ~750 bytes of stack on x86_64. This is OK for simple loads, for something more heavy, stack reduction will be done separatedly. Signed-off-by: Alexey Dobriyan Cc: stable@vger.kernel.org --- crypto/sha512_generic.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/crypto/sha512_generic.c +++ b/crypto/sha512_generic.c @@ -21,8 +21,6 @@ #include #include -static DEFINE_PER_CPU(u64[80], msg_schedule); - static inline u64 Ch(u64 x, u64 y, u64 z) { return z ^ (x & (y ^ z)); @@ -89,7 +87,7 @@ sha512_transform(u64 *state, const u8 *input) u64 a, b, c, d, e, f, g, h, t1, t2; int i; - u64 *W = get_cpu_var(msg_schedule); + u64 W[80]; /* load the input */ for (i = 0; i < 16; i++) @@ -128,8 +126,6 @@ sha512_transform(u64 *state, const u8 *input) /* erase our data */ a = b = c = d = e = f = g = h = t1 = t2 = 0; - memset(W, 0, sizeof(__get_cpu_var(msg_schedule))); - put_cpu_var(msg_schedule); } static int