From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7EE99C2BA17 for ; Mon, 6 Apr 2020 16:00:52 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 3E48C24909 for ; Mon, 6 Apr 2020 16:00:52 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ML1sUtKS" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3E48C24909 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id CE6518E003F; Mon, 6 Apr 2020 12:00:51 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C95CB8E000D; Mon, 6 Apr 2020 12:00:51 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B85568E003F; Mon, 6 Apr 2020 12:00:51 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0164.hostedemail.com [216.40.44.164]) by kanga.kvack.org (Postfix) with ESMTP id A04018E000D for ; Mon, 6 Apr 2020 12:00:51 -0400 (EDT) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 4A3A2801C768 for ; Mon, 6 Apr 2020 16:00:51 +0000 (UTC) X-FDA: 76677893502.05.sky66_7bcf54bc66d0d X-HE-Tag: sky66_7bcf54bc66d0d X-Filterd-Recvd-Size: 4395 Received: from us-smtp-delivery-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) by imf11.hostedemail.com (Postfix) with ESMTP for ; Mon, 6 Apr 2020 16:00:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1586188850; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Q6kZ7ASO5bOsyaLXnJ3Ux1/QL48SgEahPH8hNJMUrGo=; b=ML1sUtKSuN4ueAWHpTbaKxDBbLRNBuNwV3780jA73VBXRZJOTAaWmUnMQ1wncZxxQkaiWr 4slDzvxi6FL6u5HHugAGT4Iz1738CmZEyivk8RQKTHsTmvk3l6mmmIMi0UHprTrkqZwQGK LRElMbl8WrqSiRVklEEEXIL/ooaSq9U= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-27-IZyOAiQXMpmCLJhwlRYpoA-1; Mon, 06 Apr 2020 12:00:48 -0400 X-MC-Unique: IZyOAiQXMpmCLJhwlRYpoA-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 118828017F3; Mon, 6 Apr 2020 16:00:46 +0000 (UTC) Received: from warthog.procyon.org.uk (ovpn-112-224.rdu2.redhat.com [10.10.112.224]) by smtp.corp.redhat.com (Postfix) with ESMTP id DE3A5118F46; Mon, 6 Apr 2020 16:00:40 +0000 (UTC) Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: References: <20200406023700.1367-1-longman@redhat.com> To: Joe Perches Cc: dhowells@redhat.com, Waiman Long , Andrew Morton , Jarkko Sakkinen , James Morris , "Serge E. Hallyn" , linux-mm@kvack.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, Linus Torvalds Subject: Re: [PATCH] mm: Add kvfree_sensitive() for freeing sensitive data objects MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <319764.1586188840.1@warthog.procyon.org.uk> Date: Mon, 06 Apr 2020 17:00:40 +0100 Message-ID: <319765.1586188840@warthog.procyon.org.uk> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Joe Perches wrote: > > This patch introduces a new kvfree_sensitive() for freeing those > > sensitive data objects allocated by kvmalloc(). The relevnat places > > where kvfree_sensitive() can be used are modified to use it. > > Why isn't this called kvzfree like the existing kzfree? To quote Linus: We have a function for clearing sensitive information: it's called "memclear_explicit()", and it's about forced (explicit) clearing even if the data might look dead afterwards. The other problem with that function is the name: "__kvzfree()" is not a useful name for this function. We use the "__" format for internal low-level helpers, and it generally means that it does *less* than the full function. This does more, not less, and "__" is not following any sane naming model. So the name should probably be something like "kvfree_sensitive()" or similar. Or maybe it could go even further, and talk about _why_ it's sensitive, and call it "kvfree_cleartext()" or something like that. Because the clearing is really not what even matters. It might choose other patterns to overwrite things with, but it might do other things too, like putting special barriers for data leakage (or flags to tell return-to-user-mode to do so). And yes, kzfree() isn't a good name either, and had that same memset(), but at least it doesn't do the dual-underscore mistake. Including some kzfree()/crypto people explicitly - I hope we can get away from this incorrect and actively wrong pattern of thinking that "sensitive data should be memset(), and then we should add a random 'z' in the name somewhere to 'document' that". David