Re: [PATCH v2 1/1] s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()

[Holger Dengler <dengler@linux.ibm.com>]

On 7/29/26 16:01, Harald Freudenberger wrote:
> The helper function _ip_cprb_helper() uses internal buffer memory for
> building and processing CPRBs. After use this buffer was never
> scrubbed which could lead to leaving for example clear key material in
> memory which could be exposed via tricky reuse of this same memory.
> 
> Extent the _ip_cprb_helper() function with another parameter 'scrub'

typo: Extend

> used to steer scrubbing of this buffer. So now the caller has the
> opportunity to decide if scrubbing is needed or not.
> 
> Extent the clear key to secure key token import process in function

typo: Extend

> cca_clr2cipherkey() to tell the helper function from above to scrub
> the cprb buffer when the clear key value is part of the request data.
> 
> Add explicit scrubbing on return from function cca_clr2cipherkey() for
> the random EXOR buffer and the cprb buffer.
> 
> Overall this cleans the internal used buffer in case of clear key
> import to prevent sensitive data to get exposed.
> 
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
> Cc: stable@vger.kernel.org

Reviewed-by: Holger Dengler <dengler@linux.ibm.com>

-- 
Mit freundlichen Grüßen / Kind regards
Holger Dengler