| Message ID | 2491424.h8JBGRc3Yx@tachyon.chronox.de (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Herbert Xu |
| Headers | show |
Hi Stephan, On 11/11/2014 05:37 AM, Stephan Mueller wrote: > Zeroize the buffer holding the message digest calculated for the > consumer before the buffer is released by the hash AF_ALG interface > handler. > > Signed-off-by: Stephan Mueller <smueller@chronox.de> > --- > crypto/algif_hash.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c > index 8502462..f75db4c 100644 > --- a/crypto/algif_hash.c > +++ b/crypto/algif_hash.c > @@ -258,6 +258,8 @@ static void hash_sock_destruct(struct sock *sk) > struct alg_sock *ask = alg_sk(sk); > struct hash_ctx *ctx = ask->private; > > + memzero_explicit(ctx->result, > + crypto_ahash_digestsize(crypto_ahash_reqtfm(&ctx->req))); > sock_kfree_s(sk, ctx->result, Perhaps something like this (alternatively kzfree() would work, too) ... static void __sock_kfree_s(struct sock *sk, void *mem, int size, bool clear_mem) { if (WARN_ON_ONCE(!mem)) return; if (clear_mem) memzero_explicit(mem, size); kfree(mem); atomic_sub(size, &sk->sk_omem_alloc); } void sock_kfree_s(struct sock *sk, void *mem, int size) { __sock_kfree_s(sk, mem, size, false); } EXPORT_SYMBOL(sock_kfree_s); void sock_kzfree_s(struct sock *sk, void *mem, int size) { __sock_kfree_s(sk, mem, size, true); } EXPORT_SYMBOL(sock_kzfree_s); ... so you could then just use it as drop-in in various places: sock_kzfree_s(sk, ctx->result, ...); > crypto_ahash_digestsize(crypto_ahash_reqtfm(&ctx->req))); > sock_kfree_s(sk, ctx, ctx->len); > Thanks, Daniel -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c index 8502462..f75db4c 100644 --- a/crypto/algif_hash.c +++ b/crypto/algif_hash.c @@ -258,6 +258,8 @@ static void hash_sock_destruct(struct sock *sk) struct alg_sock *ask = alg_sk(sk); struct hash_ctx *ctx = ask->private; + memzero_explicit(ctx->result, + crypto_ahash_digestsize(crypto_ahash_reqtfm(&ctx->req))); sock_kfree_s(sk, ctx->result, crypto_ahash_digestsize(crypto_ahash_reqtfm(&ctx->req))); sock_kfree_s(sk, ctx, ctx->len);
Zeroize the buffer holding the message digest calculated for the consumer before the buffer is released by the hash AF_ALG interface handler. Signed-off-by: Stephan Mueller <smueller@chronox.de> --- crypto/algif_hash.c | 2 ++ 1 file changed, 2 insertions(+)