mirror of https://gitee.com/openkylin/linux.git
crypto: drbg - use memzero_explicit() for clearing sensitive data
Compiler dead store optimization can sometimes remove final calls to memset() used to clear sensitive data at the end of a function. Replace trailing memset() calls with memzero_explicit() to preclude unwanted removal. Signed-off-by: Nickolaus Woodruff <nickolauswoodruff@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
parent
0653a7cf6f
commit
421d82f5b3
|
@ -98,6 +98,7 @@
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#include <crypto/drbg.h>
|
#include <crypto/drbg.h>
|
||||||
|
#include <linux/string.h>
|
||||||
|
|
||||||
/***************************************************************
|
/***************************************************************
|
||||||
* Backend cipher definitions available to DRBG
|
* Backend cipher definitions available to DRBG
|
||||||
|
@ -497,9 +498,9 @@ static int drbg_ctr_df(struct drbg_state *drbg,
|
||||||
ret = 0;
|
ret = 0;
|
||||||
|
|
||||||
out:
|
out:
|
||||||
memset(iv, 0, drbg_blocklen(drbg));
|
memzero_explicit(iv, drbg_blocklen(drbg));
|
||||||
memset(temp, 0, drbg_statelen(drbg));
|
memzero_explicit(temp, drbg_statelen(drbg));
|
||||||
memset(pad, 0, drbg_blocklen(drbg));
|
memzero_explicit(pad, drbg_blocklen(drbg));
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -573,9 +574,9 @@ static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
|
||||||
ret = 0;
|
ret = 0;
|
||||||
|
|
||||||
out:
|
out:
|
||||||
memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
|
memzero_explicit(temp, drbg_statelen(drbg) + drbg_blocklen(drbg));
|
||||||
if (2 != reseed)
|
if (2 != reseed)
|
||||||
memset(df_data, 0, drbg_statelen(drbg));
|
memzero_explicit(df_data, drbg_statelen(drbg));
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -633,7 +634,7 @@ static int drbg_ctr_generate(struct drbg_state *drbg,
|
||||||
len = ret;
|
len = ret;
|
||||||
|
|
||||||
out:
|
out:
|
||||||
memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
|
memzero_explicit(drbg->scratchpad, drbg_blocklen(drbg));
|
||||||
return len;
|
return len;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -871,7 +872,7 @@ static int drbg_hash_df(struct drbg_state *drbg,
|
||||||
}
|
}
|
||||||
|
|
||||||
out:
|
out:
|
||||||
memset(tmp, 0, drbg_blocklen(drbg));
|
memzero_explicit(tmp, drbg_blocklen(drbg));
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -915,7 +916,7 @@ static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
|
||||||
ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
|
ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
|
||||||
|
|
||||||
out:
|
out:
|
||||||
memset(drbg->scratchpad, 0, drbg_statelen(drbg));
|
memzero_explicit(drbg->scratchpad, drbg_statelen(drbg));
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -950,7 +951,7 @@ static int drbg_hash_process_addtl(struct drbg_state *drbg,
|
||||||
drbg->scratchpad, drbg_blocklen(drbg));
|
drbg->scratchpad, drbg_blocklen(drbg));
|
||||||
|
|
||||||
out:
|
out:
|
||||||
memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
|
memzero_explicit(drbg->scratchpad, drbg_blocklen(drbg));
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -997,7 +998,7 @@ static int drbg_hash_hashgen(struct drbg_state *drbg,
|
||||||
}
|
}
|
||||||
|
|
||||||
out:
|
out:
|
||||||
memset(drbg->scratchpad, 0,
|
memzero_explicit(drbg->scratchpad,
|
||||||
(drbg_statelen(drbg) + drbg_blocklen(drbg)));
|
(drbg_statelen(drbg) + drbg_blocklen(drbg)));
|
||||||
return len;
|
return len;
|
||||||
}
|
}
|
||||||
|
@ -1046,7 +1047,7 @@ static int drbg_hash_generate(struct drbg_state *drbg,
|
||||||
drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
|
drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
|
||||||
|
|
||||||
out:
|
out:
|
||||||
memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
|
memzero_explicit(drbg->scratchpad, drbg_blocklen(drbg));
|
||||||
return len;
|
return len;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue