From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linutronix.de (146.0.238.70:993) by crypto-ml.lab.linutronix.de with IMAP4-SSL for ; 24 Feb 2019 15:13:03 -0000 Received: from mga02.intel.com ([134.134.136.20]) by Galois.linutronix.de with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1gxvNz-0001RU-K2 for speck@linutronix.de; Sun, 24 Feb 2019 16:08:12 +0100 From: Andi Kleen Subject: [MODERATED] [PATCH v6 17/43] MDSv6 Date: Sun, 24 Feb 2019 07:07:23 -0800 Message-Id: <1b68758ce8fb90ccdb63c1d3e7198e3d0e2356b0.1551019522.git.ak@linux.intel.com> In-Reply-To: References: In-Reply-To: References: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 To: speck@linutronix.de Cc: Andi Kleen List-ID: Assume that any code using these functions is sensitive and shouldn't leak any data. This handles clearing for key and cryptographic data used in the kernel. It also schedules a clear after each get_random_bytes, which while being slightly overkill, may protect some hash table key secrets. Suggested-by: Linus Torvalds Signed-off-by: Andi Kleen --- lib/string.c | 6 ++++++ mm/slab_common.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/lib/string.c b/lib/string.c index 38e4ca08e757..9ce59dd86541 100644 --- a/lib/string.c +++ b/lib/string.c @@ -28,6 +28,7 @@ #include #include #include +#include #include #include @@ -715,12 +716,17 @@ EXPORT_SYMBOL(memset); * necessary, memzero_explicit() should be used instead in * order to prevent the compiler from optimising away zeroing. * + * As a side effect this may also trigger extra cleaning + * of CPU state before the next kernel exit to avoid + * side channels. + * * memzero_explicit() doesn't need an arch-specific version as * it just invokes the one of memset() implicitly. */ void memzero_explicit(void *s, size_t count) { memset(s, 0, count); + lazy_clear_cpu(); barrier_data(s); } EXPORT_SYMBOL(memzero_explicit); diff --git a/mm/slab_common.c b/mm/slab_common.c index 81732d05e74a..7b5e2e1318a2 100644 --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -1576,6 +1576,9 @@ EXPORT_SYMBOL(krealloc); * Note: this function zeroes the whole allocated buffer which can be a good * deal bigger than the requested buffer size passed to kmalloc(). So be * careful when using this function in performance sensitive code. + * + * As a side effect this may also clear CPU state later before the + * next kernel exit to avoid side channels. */ void kzfree(const void *p) { @@ -1585,7 +1588,7 @@ void kzfree(const void *p) if (unlikely(ZERO_OR_NULL_PTR(mem))) return; ks = ksize(mem); - memset(mem, 0, ks); + memzero_explicit(mem, ks); kfree(mem); } EXPORT_SYMBOL(kzfree); -- 2.17.2