* [PATCH] crypto: sun4i-ss: erase key after use
@ 2019-09-15 18:35 Corentin Labbe
2019-09-15 20:16 ` Eric Biggers
2019-09-16 8:30 ` Sasha Levin
0 siblings, 2 replies; 3+ messages in thread
From: Corentin Labbe @ 2019-09-15 18:35 UTC (permalink / raw)
To: davem, herbert, mripard, wens
Cc: linux-kernel, stable, linux-sunxi, Corentin Labbe, linux-crypto,
linux-arm-kernel
When a TFM is unregistered, the sun4i-ss driver does not clean the key used,
leaking it in memory.
This patch adds this absent key cleaning.
Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
Cc: <stable@vger.kernel.org> # 4.3+
Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
---
drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
index fa4b1b47822e..60d99370a4ec 100644
--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
@@ -503,6 +503,8 @@ int sun4i_ss_cipher_init(struct crypto_tfm *tfm)
void sun4i_ss_cipher_exit(struct crypto_tfm *tfm)
{
struct sun4i_tfm_ctx *op = crypto_tfm_ctx(tfm);
+
+ memzero_explicit(op->key, op->keylen);
crypto_free_sync_skcipher(op->fallback_tfm);
}
--
2.21.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] crypto: sun4i-ss: erase key after use
2019-09-15 18:35 [PATCH] crypto: sun4i-ss: erase key after use Corentin Labbe
@ 2019-09-15 20:16 ` Eric Biggers
2019-09-16 8:30 ` Sasha Levin
1 sibling, 0 replies; 3+ messages in thread
From: Eric Biggers @ 2019-09-15 20:16 UTC (permalink / raw)
To: Corentin Labbe
Cc: herbert, linux-sunxi, linux-kernel, mripard, wens, linux-crypto,
stable, davem, linux-arm-kernel
On Sun, Sep 15, 2019 at 08:35:36PM +0200, Corentin Labbe wrote:
> When a TFM is unregistered, the sun4i-ss driver does not clean the key used,
> leaking it in memory.
> This patch adds this absent key cleaning.
>
> Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
> Cc: <stable@vger.kernel.org> # 4.3+
> Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
> ---
> drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
> index fa4b1b47822e..60d99370a4ec 100644
> --- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
> +++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
> @@ -503,6 +503,8 @@ int sun4i_ss_cipher_init(struct crypto_tfm *tfm)
> void sun4i_ss_cipher_exit(struct crypto_tfm *tfm)
> {
> struct sun4i_tfm_ctx *op = crypto_tfm_ctx(tfm);
> +
> + memzero_explicit(op->key, op->keylen);
> crypto_free_sync_skcipher(op->fallback_tfm);
> }
>
> --
> 2.21.0
>
It's already zeroed by the kzfree() in crypto_destroy_tfm().
- Eric
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] crypto: sun4i-ss: erase key after use
2019-09-15 18:35 [PATCH] crypto: sun4i-ss: erase key after use Corentin Labbe
2019-09-15 20:16 ` Eric Biggers
@ 2019-09-16 8:30 ` Sasha Levin
1 sibling, 0 replies; 3+ messages in thread
From: Sasha Levin @ 2019-09-16 8:30 UTC (permalink / raw)
To: Sasha Levin, Corentin Labbe, davem, herbert
Cc: stable, linux-crypto, linux-arm-kernel
Hi,
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag,
fixing commit: 6298e948215f crypto: sunxi-ss - Add Allwinner Security System crypto accelerator.
The bot has tested the following trees: v5.2.14, v4.19.72, v4.14.143, v4.9.192, v4.4.192.
v5.2.14: Build OK!
v4.19.72: Failed to apply! Possible dependencies:
0ae1f46c55f8 ("crypto: sun4i-ss - fallback when length is not multiple of blocksize")
v4.14.143: Failed to apply! Possible dependencies:
0ae1f46c55f8 ("crypto: sun4i-ss - fallback when length is not multiple of blocksize")
249c8d98ea33 ("crypto: crypto4xx - move and refactor dynamic_contents helpers")
2c95e6d97892 ("crypto: skcipher - remove useless setting of type flags")
333eb3edda38 ("crypto: crypto4xx - fix type mismatch compiler error")
40e3b847bff7 ("crypto: crypto4xx - replace crypto4xx_dev's scatter_buffer_size with constant")
453e3090b9c3 ("crypto: crypto4xx - fix dynamic_sa_ctl's sa_contents declaration")
4865b122d4af ("crypto: crypto4xx - use the correct LE32 format for IV and key defs")
5c727f92ea5e ("crypto: crypto4xx - refactor crypto4xx_copy_pkt_to_dst()")
81065f66dd99 ("crypto: crypto4xx - remove unused definitions and write-only variables")
886c251fd4ca ("crypto: crypto4xx - remove extern statement before function declaration")
8ef8d195430c ("crypto: crypto4xx - add backlog queue support")
9e0a0b3a192a ("crypto: crypto4xx - pointer arithmetic overhaul")
a0aae821ba3d ("crypto: crypto4xx - prepare for AEAD support")
a8d79d7bfb14 ("crypto: crypto4xx - performance optimizations")
cd4dcd6da7a2 ("crypto: crypto4xx - overhaul crypto4xx_build_pd()")
ce05ffe10457 ("crypto: crypto4xx - convert to skcipher")
f2a13e7cba9e ("crypto: crypto4xx - enable AES RFC3686, ECB, CFB and OFB offloads")
v4.9.192: Failed to apply! Possible dependencies:
0ae1f46c55f8 ("crypto: sun4i-ss - fallback when length is not multiple of blocksize")
249c8d98ea33 ("crypto: crypto4xx - move and refactor dynamic_contents helpers")
2c95e6d97892 ("crypto: skcipher - remove useless setting of type flags")
317cbacf720c ("crypto: sun4i-ss - move from ablkcipher to skcipher API")
333eb3edda38 ("crypto: crypto4xx - fix type mismatch compiler error")
40e3b847bff7 ("crypto: crypto4xx - replace crypto4xx_dev's scatter_buffer_size with constant")
453e3090b9c3 ("crypto: crypto4xx - fix dynamic_sa_ctl's sa_contents declaration")
4865b122d4af ("crypto: crypto4xx - use the correct LE32 format for IV and key defs")
5c727f92ea5e ("crypto: crypto4xx - refactor crypto4xx_copy_pkt_to_dst()")
81065f66dd99 ("crypto: crypto4xx - remove unused definitions and write-only variables")
886c251fd4ca ("crypto: crypto4xx - remove extern statement before function declaration")
8ef8d195430c ("crypto: crypto4xx - add backlog queue support")
9e0a0b3a192a ("crypto: crypto4xx - pointer arithmetic overhaul")
a0aae821ba3d ("crypto: crypto4xx - prepare for AEAD support")
a595e60a70c0 ("crypto: sun4i-ss - remove conditional checks against 0")
a8d79d7bfb14 ("crypto: crypto4xx - performance optimizations")
cd4dcd6da7a2 ("crypto: crypto4xx - overhaul crypto4xx_build_pd()")
ce05ffe10457 ("crypto: crypto4xx - convert to skcipher")
f2a13e7cba9e ("crypto: crypto4xx - enable AES RFC3686, ECB, CFB and OFB offloads")
v4.4.192: Failed to apply! Possible dependencies:
0ae1f46c55f8 ("crypto: sun4i-ss - fallback when length is not multiple of blocksize")
249c8d98ea33 ("crypto: crypto4xx - move and refactor dynamic_contents helpers")
2c95e6d97892 ("crypto: skcipher - remove useless setting of type flags")
317cbacf720c ("crypto: sun4i-ss - move from ablkcipher to skcipher API")
333eb3edda38 ("crypto: crypto4xx - fix type mismatch compiler error")
40e3b847bff7 ("crypto: crypto4xx - replace crypto4xx_dev's scatter_buffer_size with constant")
453e3090b9c3 ("crypto: crypto4xx - fix dynamic_sa_ctl's sa_contents declaration")
477d9b2e591b ("crypto: sun4i-ss - unify update/final function")
4865b122d4af ("crypto: crypto4xx - use the correct LE32 format for IV and key defs")
5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
81065f66dd99 ("crypto: crypto4xx - remove unused definitions and write-only variables")
886c251fd4ca ("crypto: crypto4xx - remove extern statement before function declaration")
9e0a0b3a192a ("crypto: crypto4xx - pointer arithmetic overhaul")
a0aae821ba3d ("crypto: crypto4xx - prepare for AEAD support")
a595e60a70c0 ("crypto: sun4i-ss - remove conditional checks against 0")
a8d79d7bfb14 ("crypto: crypto4xx - performance optimizations")
b6ff2fdd429c ("crypto: sun4i-ss - fix indentation of two crypto alg")
bfb2892018ca ("crypto: sunxi - don't print confusing data")
cd4dcd6da7a2 ("crypto: crypto4xx - overhaul crypto4xx_build_pd()")
ce05ffe10457 ("crypto: crypto4xx - convert to skcipher")
ea1a67414318 ("crypto: sun4i-ss - fix a few signed warning")
f2a13e7cba9e ("crypto: crypto4xx - enable AES RFC3686, ECB, CFB and OFB offloads")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks,
Sasha
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-09-16 8:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-09-15 18:35 [PATCH] crypto: sun4i-ss: erase key after use Corentin Labbe
2019-09-15 20:16 ` Eric Biggers
2019-09-16 8:30 ` Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).