Commit 54424d38 authored by Kees Cook's avatar Kees Cook Committed by David S. Miller

rxrpc: Reuse SKCIPHER_REQUEST_ON_STACK buffer

The use of SKCIPHER_REQUEST_ON_STACK() will trigger FRAME_WARN warnings
(when less than 2048) once the VLA is no longer hidden from the check:

net/rxrpc/rxkad.c:398:1: warning: the frame size of 1152 bytes is larger than 1024 bytes [-Wframe-larger-than=]
net/rxrpc/rxkad.c:242:1: warning: the frame size of 1152 bytes is larger than 1024 bytes [-Wframe-larger-than=]

This passes the initial SKCIPHER_REQUEST_ON_STACK allocation to the leaf
functions for reuse. Two requests allocated on the stack is not needed
when only one is used at a time.
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5ca8a25c
...@@ -146,10 +146,10 @@ static int rxkad_prime_packet_security(struct rxrpc_connection *conn) ...@@ -146,10 +146,10 @@ static int rxkad_prime_packet_security(struct rxrpc_connection *conn)
static int rxkad_secure_packet_auth(const struct rxrpc_call *call, static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
struct sk_buff *skb, struct sk_buff *skb,
u32 data_size, u32 data_size,
void *sechdr) void *sechdr,
struct skcipher_request *req)
{ {
struct rxrpc_skb_priv *sp = rxrpc_skb(skb); struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
struct rxkad_level1_hdr hdr; struct rxkad_level1_hdr hdr;
struct rxrpc_crypt iv; struct rxrpc_crypt iv;
struct scatterlist sg; struct scatterlist sg;
...@@ -183,12 +183,12 @@ static int rxkad_secure_packet_auth(const struct rxrpc_call *call, ...@@ -183,12 +183,12 @@ static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call, static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
struct sk_buff *skb, struct sk_buff *skb,
u32 data_size, u32 data_size,
void *sechdr) void *sechdr,
struct skcipher_request *req)
{ {
const struct rxrpc_key_token *token; const struct rxrpc_key_token *token;
struct rxkad_level2_hdr rxkhdr; struct rxkad_level2_hdr rxkhdr;
struct rxrpc_skb_priv *sp; struct rxrpc_skb_priv *sp;
SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
struct rxrpc_crypt iv; struct rxrpc_crypt iv;
struct scatterlist sg[16]; struct scatterlist sg[16];
struct sk_buff *trailer; struct sk_buff *trailer;
...@@ -296,11 +296,12 @@ static int rxkad_secure_packet(struct rxrpc_call *call, ...@@ -296,11 +296,12 @@ static int rxkad_secure_packet(struct rxrpc_call *call,
ret = 0; ret = 0;
break; break;
case RXRPC_SECURITY_AUTH: case RXRPC_SECURITY_AUTH:
ret = rxkad_secure_packet_auth(call, skb, data_size, sechdr); ret = rxkad_secure_packet_auth(call, skb, data_size, sechdr,
req);
break; break;
case RXRPC_SECURITY_ENCRYPT: case RXRPC_SECURITY_ENCRYPT:
ret = rxkad_secure_packet_encrypt(call, skb, data_size, ret = rxkad_secure_packet_encrypt(call, skb, data_size,
sechdr); sechdr, req);
break; break;
default: default:
ret = -EPERM; ret = -EPERM;
...@@ -316,10 +317,10 @@ static int rxkad_secure_packet(struct rxrpc_call *call, ...@@ -316,10 +317,10 @@ static int rxkad_secure_packet(struct rxrpc_call *call,
*/ */
static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb, static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
unsigned int offset, unsigned int len, unsigned int offset, unsigned int len,
rxrpc_seq_t seq) rxrpc_seq_t seq,
struct skcipher_request *req)
{ {
struct rxkad_level1_hdr sechdr; struct rxkad_level1_hdr sechdr;
SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
struct rxrpc_crypt iv; struct rxrpc_crypt iv;
struct scatterlist sg[16]; struct scatterlist sg[16];
struct sk_buff *trailer; struct sk_buff *trailer;
...@@ -402,11 +403,11 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb, ...@@ -402,11 +403,11 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
*/ */
static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb, static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
unsigned int offset, unsigned int len, unsigned int offset, unsigned int len,
rxrpc_seq_t seq) rxrpc_seq_t seq,
struct skcipher_request *req)
{ {
const struct rxrpc_key_token *token; const struct rxrpc_key_token *token;
struct rxkad_level2_hdr sechdr; struct rxkad_level2_hdr sechdr;
SKCIPHER_REQUEST_ON_STACK(req, call->conn->cipher);
struct rxrpc_crypt iv; struct rxrpc_crypt iv;
struct scatterlist _sg[4], *sg; struct scatterlist _sg[4], *sg;
struct sk_buff *trailer; struct sk_buff *trailer;
...@@ -549,9 +550,9 @@ static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb, ...@@ -549,9 +550,9 @@ static int rxkad_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
case RXRPC_SECURITY_PLAIN: case RXRPC_SECURITY_PLAIN:
return 0; return 0;
case RXRPC_SECURITY_AUTH: case RXRPC_SECURITY_AUTH:
return rxkad_verify_packet_1(call, skb, offset, len, seq); return rxkad_verify_packet_1(call, skb, offset, len, seq, req);
case RXRPC_SECURITY_ENCRYPT: case RXRPC_SECURITY_ENCRYPT:
return rxkad_verify_packet_2(call, skb, offset, len, seq); return rxkad_verify_packet_2(call, skb, offset, len, seq, req);
default: default:
return -ENOANO; return -ENOANO;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment