From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1036728AbdDUIcA (ORCPT ); Fri, 21 Apr 2017 04:32:00 -0400 Received: from mail-oi0-f65.google.com ([209.85.218.65]:32819 "EHLO mail-oi0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1035971AbdDUIbz (ORCPT ); Fri, 21 Apr 2017 04:31:55 -0400 From: Eric Biggers To: keyrings@vger.kernel.org Cc: linux-security-module@vger.kernel.org, David Howells , linux-kernel@vger.kernel.org, Eric Biggers Subject: [PATCH 1/5] KEYS: sanitize add_key() and keyctl() key payloads Date: Fri, 21 Apr 2017 01:30:33 -0700 Message-Id: <20170421083037.12746-2-ebiggers3@gmail.com> X-Mailer: git-send-email 2.12.2 In-Reply-To: <20170421083037.12746-1-ebiggers3@gmail.com> References: <20170421083037.12746-1-ebiggers3@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Biggers Before returning from add_key() or one of the keyctl() commands that takes in a key payload, zero the temporary buffer that was allocated to hold the key payload copied from userspace. This may contain sensitive key material that should not be kept around in the slab caches. This must not be applied before the patch "KEYS: fix dereferencing NULL payload with nonzero length". Signed-off-by: Eric Biggers --- security/keys/keyctl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c index 10fcea154c0f..d2852621e358 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c @@ -137,6 +137,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type, key_ref_put(keyring_ref); error3: + memzero_explicit(payload, plen); kvfree(payload); error2: kfree(description); @@ -347,7 +348,7 @@ long keyctl_update_key(key_serial_t id, key_ref_put(key_ref); error2: - kfree(payload); + kzfree(payload); error: return ret; } @@ -1098,6 +1099,7 @@ long keyctl_instantiate_key_common(key_serial_t id, keyctl_change_reqkey_auth(NULL); error2: + memzero_explicit(payload, plen); kvfree(payload); error: return ret; -- 2.12.2