From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4211C433E0 for ; Thu, 14 May 2020 11:00:52 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A7B7420727 for ; Thu, 14 May 2020 11:00:52 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="d6iEM7il" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A7B7420727 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 23E4590013F; Thu, 14 May 2020 07:00:52 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1C8288E0005; Thu, 14 May 2020 07:00:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 08F4890013F; Thu, 14 May 2020 07:00:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0145.hostedemail.com [216.40.44.145]) by kanga.kvack.org (Postfix) with ESMTP id E1E778E0005 for ; Thu, 14 May 2020 07:00:51 -0400 (EDT) Received: from smtpin26.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 9DD55181AC9CB for ; Thu, 14 May 2020 11:00:51 +0000 (UTC) X-FDA: 76815031902.26.music29_775ead67e12f X-HE-Tag: music29_775ead67e12f X-Filterd-Recvd-Size: 6203 Received: from mail-pl1-f193.google.com (mail-pl1-f193.google.com [209.85.214.193]) by imf12.hostedemail.com (Postfix) with ESMTP for ; Thu, 14 May 2020 11:00:51 +0000 (UTC) Received: by mail-pl1-f193.google.com with SMTP id u15so1045394plm.2 for ; Thu, 14 May 2020 04:00:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=nCYPouTEVyWrjV4/wzLJ8vCaI1yhsCtPiVNPnd+kwzY=; b=d6iEM7ilJpB0RC/oDT2/jP0WB8ov8gQwbG6gKgnKwMaZ3zXfKVUwX34q0+kx7GEuNE gN/yYPZX1Px1GaWlo0R/OoJithp9aagA7F6+fuxJB/Oa0oqRdX39+6haVgesVb3iKQ7K 095Uq60lc0ZnqC95QDpvfggj3K31e6LAJKP4N2laHhCjqpUSfY+CH5wbdbiEEaUoo08W 8g4SDDwQuCYYLJXk95qx/eJQsX3gxs9H9ZzbUq5rIi6nFAC73Hue/j/VFicam4JEb8Tt FdXkyHhA+lZ6m5YsY/Iuo48OmoIx6TsD/Kzu+oTy/fMry9r5wY1CsvYBYh/ldQltFgOu SDYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=nCYPouTEVyWrjV4/wzLJ8vCaI1yhsCtPiVNPnd+kwzY=; b=hxn6rhQfloE3y6ww+TgbT/2i26JJutLYxFPZLvJzzGaFudVsMUVsWuPlccHy4VegcY fhR4dOL3l92uy1hIPmQSZGBHo9eqNGaKocnNdEtenpwzBRiB6hUNj8GT6BzUqncyyI+D 84ZxSgJ3AGhGbKUB+JA7UTXLmGJ86kTJEEWRT+HntZfBApIoWS1WrZgE1U6lcAizFles T3R8yd7JcVWP6EFrxNK6ML9C2kIOFlE6R2fa7jLhSMqoJivhYitFDJOJCh08BkTIcbIj 3SARJlVjmbAM0KKp6YN7nSfwS5jHnJ2YzcWoTFEFLc/Twq37B7MGR83/SKgxV+QtTPBS az5g== X-Gm-Message-State: AOAM531gEH775+TDpCMnwJwE5vwqVjd57g7AQU8tmCrlpgpmEKMVlS1l L1CAtC4Ff5tvexMYGR8+HhM= X-Google-Smtp-Source: ABdhPJwJCqf2FDczWBK+N+5lUukXOnTYsn/cActeavqnFJs7IEpwz/686zyZKMuQew8MweFQuzXfPw== X-Received: by 2002:a17:90a:6301:: with SMTP id e1mr1489251pjj.183.1589454049998; Thu, 14 May 2020 04:00:49 -0700 (PDT) Received: from [192.168.68.125] ([210.185.116.244]) by smtp.gmail.com with ESMTPSA id i10sm2105025pfa.166.2020.05.14.04.00.42 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 14 May 2020 04:00:47 -0700 (PDT) Subject: Re: [PATCH v3] mm: Add kvfree_sensitive() for freeing sensitive data objects To: Waiman Long , Andrew Morton , David Howells , Jarkko Sakkinen , James Morris , "Serge E. Hallyn" Cc: linux-mm@kvack.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, Linus Torvalds , Joe Perches , Matthew Wilcox , David Rientjes References: <20200407200318.11711-1-longman@redhat.com> From: Balbir Singh Message-ID: <1158ff38-c65d-379f-8ae7-6f507d9fc8dd@gmail.com> Date: Thu, 14 May 2020 21:00:40 +1000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 MIME-Version: 1.0 In-Reply-To: <20200407200318.11711-1-longman@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 8/4/20 6:03 am, Waiman Long wrote: > For kvmalloc'ed data object that contains sensitive information like > cryptographic key, we need to make sure that the buffer is always > cleared before freeing it. Using memset() alone for buffer clearing may > not provide certainty as the compiler may compile it away. To be sure, > the special memzero_explicit() has to be used. > > This patch introduces a new kvfree_sensitive() for freeing those > sensitive data objects allocated by kvmalloc(). The relevnat places > where kvfree_sensitive() can be used are modified to use it. > > Fixes: 4f0882491a14 ("KEYS: Avoid false positive ENOMEM error on key read") > Suggested-by: Linus Torvalds > Signed-off-by: Waiman Long > --- > include/linux/mm.h | 1 + > mm/util.c | 18 ++++++++++++++++++ > security/keys/internal.h | 11 ----------- > security/keys/keyctl.c | 16 +++++----------- > 4 files changed, 24 insertions(+), 22 deletions(-) > > [v3: Fix kerneldoc errors] > > diff --git a/include/linux/mm.h b/include/linux/mm.h > index 7dd5c4ccbf85..9b3130b20f42 100644 > --- a/include/linux/mm.h > +++ b/include/linux/mm.h > @@ -757,6 +757,7 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags) > } > > extern void kvfree(const void *addr); > +extern void kvfree_sensitive(const void *addr, size_t len); > > static inline int compound_mapcount(struct page *page) > { > diff --git a/mm/util.c b/mm/util.c > index 988d11e6c17c..dc1c877d5481 100644 > --- a/mm/util.c > +++ b/mm/util.c > @@ -604,6 +604,24 @@ void kvfree(const void *addr) > } > EXPORT_SYMBOL(kvfree); > > +/** > + * kvfree_sensitive - Free a data object containing sensitive information. > + * @addr: address of the data object to be freed. > + * @len: length of the data object. > + * > + * Use the special memzero_explicit() function to clear the content of a > + * kvmalloc'ed object containing sensitive data to make sure that the > + * compiler won't optimize out the data clearing. > + */ > +void kvfree_sensitive(const void *addr, size_t len) > +{ > + if (likely(!ZERO_OR_NULL_PTR(addr))) { > + memzero_explicit((void *)addr, len); > + kvfree(addr); > + } > +} > +EXPORT_SYMBOL(kvfree_sensitive); > + I wonder if the right thing to do is also to disable pre-emption, just so that the thread does not linger on with sensitive data. void kvfree_sensitive(const void *addr, size_t len) { preempt_disable(); if (likely(!ZERO_OR_NULL_PTR(addr))) { memzero_explicit((void *)addr, len); kvfree(addr); } preempt_enable(); } EXPORT_SYMBOL(kvfree_sensitive); Balbir Singh.