On Thu, Jul 12, 2018 at 8:44 PM, Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> wrote: > On Thu, Jul 12, 2018 at 08:33:24PM -0700, Kees Cook wrote: >> On Thu, Jul 12, 2018 at 5:40 PM, Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> wrote: >> > On Thu, Jul 12, 2018 at 06:02:26PM +0200, Arnd Bergmann wrote: >> >> >> >> Looking through some of the drivers, I found this interesting one: >> > >> > As I said before these patches are fundamentally broken. Users >> > of AHASH_REQUEST_ON_STACK can only use sync algorithm providers >> > and therefore drivers are irrelevant. >> >> I don't understand what this means. Can you give an example of what >> you want to see happen that will accomplish the VLA removals? > > Any algorithm that is async must be ignored when you're calculating > the maximum on-stack size of the request. For example, sha512-mb > is marked as async and therefore must not be used in conjunction > with AHASH_REQUEST_ON_STACK. Then why does the instrumented tcrypt output show the huge size? Is tcrypt doing something incorrectly? What is the correct value to use for AHASH_REQUEST_ON_STACK? -Kees -- Kees Cook Pixel Security
