On Sat, 2017-04-01 at 20:33 -0700, Eric Biggers wrote: > On Sat, Apr 01, 2017 at 10:23:57PM -0400, Mimi Zohar wrote: > > On Sat, 2017-04-01 at 12:17 -0700, Eric Biggers wrote: > > > From: Eric Biggers <ebiggers@xxxxxxxxxx> > > > > > > Since v4.9, the crypto API cannot (normally) be used to encrypt/decrypt > > > stack buffers because the stack may be virtually mapped. Fix this for > > > the padding buffers in encrypted-keys by using ZERO_PAGE for the > > > encryption padding and by allocating a temporary heap buffer for the > > > decryption padding. > > > > > > Tested with CONFIG_DEBUG_SG=y: > > > keyctl new_session > > > keyctl add user master "abcdefghijklmnop" @s > > > keyid=$(keyctl add encrypted desc "new user:master 25" @s) > > > datablob="$(keyctl pipe $keyid)" > > > keyctl unlink $keyid > > > keyid=$(keyctl add encrypted desc "load $datablob" @s) > > > datablob2="$(keyctl pipe $keyid)" > > > [ "$datablob" = "$datablob2" ] && echo "Success!" > > > > Have you created an encrypted key on a kernel without this patch and > > attempted to load that key on a kernel with this patch? Does it still > > work? > > > > Yes, a key exported from an unpatched kernel (with DEBUG_SG and DEBUG_VIRTUAL > turned off so it doesn't crash) can be loaded on a patched kernel, then exported > again. The exported data is identical. This patch removes calculating the "padlen". Will this change break other use cases? Mimi