dh key: get rid of stack allocated array for zeroes

We're interested in getting rid of all of the stack allocated arrays in
the kernel: https://lkml.org/lkml/2018/3/7/621

This case is interesting, since we really just need an array of bytes that
are zero. The loop already ensures that if the array isn't exactly the
right size that enough zero bytes will be copied in. So, instead of
choosing this value to be the size of the hash, let's just choose it to be
32, since that is a common size, is not too big, and will not result in too
many extra iterations of the loop.

v2: split out from other patch, just hardcode array size instead of
    dynamically allocating something the right size
v3: fix typo of 256 -> 32

Signed-off-by: Tycho Andersen <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
CC: David Howells <[email protected]>
CC: James Morris <[email protected]>
CC: "Serge E. Hallyn" <[email protected]>
CC: Eric Biggers <[email protected]>
Signed-off-by: James Morris <[email protected]>

diff --git a/security/keys/dh.c b/security/keys/dh.c
index 9fecaea6c298eb5b6fb7a33e2d9a1e599529d849..f7403821db7f0aafdec4a2e9a6804b1b8c2a599b 100644 (file)
--- a/security/keys/dh.c
+++ b/security/keys/dh.c
@@ -162,8 +162,8 @@ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
                        goto err;
 
                if (zlen && h) {
-                       u8 tmpbuffer[h];
-                       size_t chunk = min_t(size_t, zlen, h);
+                       u8 tmpbuffer[32];
+                       size_t chunk = min_t(size_t, zlen, sizeof(tmpbuffer));
                        memset(tmpbuffer, 0, chunk);
 
                        do {
@@ -173,7 +173,7 @@ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
                                        goto err;
 
                                zlen -= chunk;
-                               chunk = min_t(size_t, zlen, h);
+                               chunk = min_t(size_t, zlen, sizeof(tmpbuffer));
                        } while (zlen);
                }