From: Greg Kroah-Hartman Date: Sat, 8 Nov 2014 01:34:25 +0000 (-0800) Subject: 3.17-stable patches X-Git-Tag: v3.10.60~64 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3c280e1649d2dfd6001c5e30c82a5907e45fec60;p=thirdparty%2Fkernel%2Fstable-queue.git 3.17-stable patches added patches: random-add-and-use-memzero_explicit-for-clearing-data.patch --- diff --git a/queue-3.17/random-add-and-use-memzero_explicit-for-clearing-data.patch b/queue-3.17/random-add-and-use-memzero_explicit-for-clearing-data.patch new file mode 100644 index 00000000000..3b8bae2ab32 --- /dev/null +++ b/queue-3.17/random-add-and-use-memzero_explicit-for-clearing-data.patch @@ -0,0 +1,118 @@ +From d4c5efdb97773f59a2b711754ca0953f24516739 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Tue, 26 Aug 2014 23:16:35 -0400 +Subject: random: add and use memzero_explicit() for clearing data + +From: Daniel Borkmann + +commit d4c5efdb97773f59a2b711754ca0953f24516739 upstream. + +zatimend has reported that in his environment (3.16/gcc4.8.3/corei7) +memset() calls which clear out sensitive data in extract_{buf,entropy, +entropy_user}() in random driver are being optimized away by gcc. + +Add a helper memzero_explicit() (similarly as explicit_bzero() variants) +that can be used in such cases where a variable with sensitive data is +being cleared out in the end. Other use cases might also be in crypto +code. [ I have put this into lib/string.c though, as it's always built-in +and doesn't need any dependencies then. ] + +Fixes kernel bugzilla: 82041 + +Reported-by: zatimend@hotmail.co.uk +Signed-off-by: Daniel Borkmann +Acked-by: Hannes Frederic Sowa +Cc: Alexey Dobriyan +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/random.c | 8 ++++---- + include/linux/string.h | 5 +++-- + lib/string.c | 16 ++++++++++++++++ + 3 files changed, 23 insertions(+), 6 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1106,7 +1106,7 @@ static void extract_buf(struct entropy_s + __mix_pool_bytes(r, hash.w, sizeof(hash.w)); + spin_unlock_irqrestore(&r->lock, flags); + +- memset(workspace, 0, sizeof(workspace)); ++ memzero_explicit(workspace, sizeof(workspace)); + + /* + * In case the hash function has some recognizable output +@@ -1118,7 +1118,7 @@ static void extract_buf(struct entropy_s + hash.w[2] ^= rol32(hash.w[2], 16); + + memcpy(out, &hash, EXTRACT_SIZE); +- memset(&hash, 0, sizeof(hash)); ++ memzero_explicit(&hash, sizeof(hash)); + } + + /* +@@ -1175,7 +1175,7 @@ static ssize_t extract_entropy(struct en + } + + /* Wipe data just returned from memory */ +- memset(tmp, 0, sizeof(tmp)); ++ memzero_explicit(tmp, sizeof(tmp)); + + return ret; + } +@@ -1218,7 +1218,7 @@ static ssize_t extract_entropy_user(stru + } + + /* Wipe data just returned from memory */ +- memset(tmp, 0, sizeof(tmp)); ++ memzero_explicit(tmp, sizeof(tmp)); + + return ret; + } +--- a/include/linux/string.h ++++ b/include/linux/string.h +@@ -132,7 +132,7 @@ int bprintf(u32 *bin_buf, size_t size, c + #endif + + extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos, +- const void *from, size_t available); ++ const void *from, size_t available); + + /** + * strstarts - does @str start with @prefix? +@@ -144,7 +144,8 @@ static inline bool strstarts(const char + return strncmp(str, prefix, strlen(prefix)) == 0; + } + +-extern size_t memweight(const void *ptr, size_t bytes); ++size_t memweight(const void *ptr, size_t bytes); ++void memzero_explicit(void *s, size_t count); + + /** + * kbasename - return the last part of a pathname. +--- a/lib/string.c ++++ b/lib/string.c +@@ -604,6 +604,22 @@ void *memset(void *s, int c, size_t coun + EXPORT_SYMBOL(memset); + #endif + ++/** ++ * memzero_explicit - Fill a region of memory (e.g. sensitive ++ * keying data) with 0s. ++ * @s: Pointer to the start of the area. ++ * @count: The size of the area. ++ * ++ * memzero_explicit() doesn't need an arch-specific version as ++ * it just invokes the one of memset() implicitly. ++ */ ++void memzero_explicit(void *s, size_t count) ++{ ++ memset(s, 0, count); ++ OPTIMIZER_HIDE_VAR(s); ++} ++EXPORT_SYMBOL(memzero_explicit); ++ + #ifndef __HAVE_ARCH_MEMCPY + /** + * memcpy - Copy one area of memory to another diff --git a/queue-3.17/series b/queue-3.17/series index 27a2dc6289e..d95cc7bdcec 100644 --- a/queue-3.17/series +++ b/queue-3.17/series @@ -67,3 +67,4 @@ rbd-rbd-workqueues-need-a-resque-worker.patch libceph-ceph-msgr-workqueue-needs-a-resque-worker.patch sched-use-dl_bw_of-under-rcu-read-lock.patch um-ubd-fix-for-processes-stuck-in-d-state-forever.patch +random-add-and-use-memzero_explicit-for-clearing-data.patch