Hi David,
On Wed, Nov 08, 2017 at 12:50:17PM +0000, David Howells wrote:
Eric Biggers ebiggers3@gmail.com wrote:
On a non-preemptible kernel, if KEYCTL_DH_COMPUTE is called with the largest permitted inputs (16384 bits), the kernel spends 10+ seconds doing modular exponentiation in mpi_powm() without rescheduling. If all threads do it, it locks up the system. Moreover, it can cause rcu_sched-stall warnings.
Do you want this to go in immediately, or I should I push it to James for the next merge window?
David
This probably should be grouped with my series "crypto: dh - input validation fixes", as this is also a fix for Diffie-Hellman. I was actually expecting Herbert Xu to take these patches, as Diffie-Hellman is now part of the crypto API (crypto/dh.c); none of the patches actually touch security/keys/. If you'd like to maintain the Diffie-Hellman implementation(s) you should get yourself added to MAINTAINERS for the relevant files.
As for the criticality of the fixes, the code is new in v4.12, so I doubt many people have CONFIG_KEY_DH_OPERATIONS=y enabled yet. syzbot doesn't actually have it enabled either (we should turn it on); I just happened to find these bugs by running syzkaller myself. So it may not be particularly critical to take these fixes immediately. However, at least the fix for the double free bug ("crypto: dh - Fix double free of ctx->p") shouldn't wait for too long...
Eric