mm: add kvfree_sensitive() for freeing sensitive data objects

For kvmalloc'ed data object that contains sensitive information like cryptographic keys, we need to make sure that the buffer is always cleared before freeing it. Using memset() alone for buffer clearing may not provide certainty as the compiler may compile it away. To be sure, the special memzero_explicit() has to be used. This patch introduces a new kvfree_sensitive() for freeing those sensitive data objects allocated by kvmalloc(). The relevant places where kvfree_sensitive() can be used are modified to use it.

Waiman Long committed 6 years ago

Commit d4eaa281 parent 090e77e4 files · +24 −22Browse files

Unified · Split

4 files

include/linux/mm.h +1 −0
mm/util.c +18 −0
security/keys/internal.h +0 −11
security/keys/keyctl.c +5 −11

include/linux/mm.h+1−0

@@ -776,6 +776,7 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags) · 775 unmodified lines
776	}	776	}
777		777
778	extern void kvfree(const void *addr);	778	extern void kvfree(const void *addr);
		779	extern void kvfree_sensitive(const void *addr, size_t len);
779		780
780	/*	781	/*
781	* Mapcount of compound page as a whole, does not include mapped sub-pages.	782	* Mapcount of compound page as a whole, does not include mapped sub-pages.

mm/util.c+18−0

@@ -604,6 +604,24 @@ void kvfree(const void *addr) · 603 unmodified lines
604	}	604	}
605	EXPORT_SYMBOL(kvfree);	605	EXPORT_SYMBOL(kvfree);
606		606
		607	/**
		608	* kvfree_sensitive - Free a data object containing sensitive information.
		609	* @addr: address of the data object to be freed.
		610	* @len: length of the data object.
		611	*
		612	* Use the special memzero_explicit() function to clear the content of a
		613	* kvmalloc'ed object containing sensitive data to make sure that the
		614	* compiler won't optimize out the data clearing.
		615	*/
		616	void kvfree_sensitive(const void *addr, size_t len)
		617	{
		618	if (likely(!ZERO_OR_NULL_PTR(addr))) {
		619	memzero_explicit((void *)addr, len);
		620	kvfree(addr);
		621	}
		622	}
		623	EXPORT_SYMBOL(kvfree_sensitive);
		624
607	static inline void __page_rmapping(struct page page)	625	static inline void __page_rmapping(struct page page)
608	{	626	{
609	unsigned long mapping;	627	unsigned long mapping;

security/keys/internal.h+0−11

@@ -350,15 +350,4 @@ static inline void key_check(const struct key *key) · 349 unmodified lines
350	#define key_check(key) do {} while(0)	350	#define key_check(key) do {} while(0)
351		351
352	#endif	352	#endif
353
354	/*
355	* Helper function to clear and free a kvmalloc'ed memory object.
356	*/
357	static inline void __kvzfree(const void *addr, size_t len)
358	{
359	if (addr) {
360	memset((void *)addr, 0, len);
361	kvfree(addr);
362	}
363	}
364	#endif /* _INTERNAL_H */	353	#endif /* _INTERNAL_H */

security/keys/keyctl.c+5−11

 	key_ref_put(keyring_ref);
  error3:
-	if (payload) {
+	kvfree_sensitive(payload, plen);
-		memzero_explicit(payload, plen);
-		kvfree(payload);
-	}
  error2:
 	kfree(description);
  error:
 	key_ref_put(key_ref);
 error2:
-	__kvzfree(payload, plen);
+	kvfree_sensitive(payload, plen);
 error:
 	return ret;
 }
 		 */
 		if (ret > key_data_len) {
 			if (unlikely(key_data))
-				__kvzfree(key_data, key_data_len);
+				kvfree_sensitive(key_data, key_data_len);
 			key_data_len = ret;
 			continue;	/* Allocate buffer */
 		}
 			ret = -EFAULT;
 		break;
 	}
-	__kvzfree(key_data, key_data_len);
+	kvfree_sensitive(key_data, key_data_len);
 key_put_out:
 	key_put(key);
 		keyctl_change_reqkey_auth(NULL);
 error2:
-	if (payload) {
+	kvfree_sensitive(payload, plen);
-		memzero_explicit(payload, plen);
-		kvfree(payload);
-	}
 error:
 	return ret;
 }