* [PATCH] nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
@ 2026-02-01 3:08 Daniel Hodges
2026-02-02 6:58 ` Christoph Hellwig
2026-02-02 16:10 ` Keith Busch
0 siblings, 2 replies; 3+ messages in thread
From: Daniel Hodges @ 2026-02-01 3:08 UTC (permalink / raw)
To: kbusch, axboe, hch, sagi; +Cc: linux-nvme, linux-kernel, Daniel Hodges
The DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) contain
authentication key material for NVMe-oF. Use kfree_sensitive() instead
of kfree() in nvmf_free_options() to ensure secrets are zeroed before
the memory is freed, preventing recovery from freed pages.
Signed-off-by: Daniel Hodges <hodgesd@meta.com>
---
drivers/nvme/host/fabrics.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 55a8afd2efd5..d37cb140d832 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -1283,22 +1283,22 @@ void nvmf_free_options(struct nvmf_ctrl_options *opts)
{
nvmf_host_put(opts->host);
key_put(opts->keyring);
key_put(opts->tls_key);
kfree(opts->transport);
kfree(opts->traddr);
kfree(opts->trsvcid);
kfree(opts->subsysnqn);
kfree(opts->host_traddr);
kfree(opts->host_iface);
- kfree(opts->dhchap_secret);
- kfree(opts->dhchap_ctrl_secret);
+ kfree_sensitive(opts->dhchap_secret);
+ kfree_sensitive(opts->dhchap_ctrl_secret);
kfree(opts);
}
EXPORT_SYMBOL_GPL(nvmf_free_options);
#define NVMF_REQUIRED_OPTS (NVMF_OPT_TRANSPORT | NVMF_OPT_NQN)
#define NVMF_ALLOWED_OPTS (NVMF_OPT_QUEUE_SIZE | NVMF_OPT_NR_IO_QUEUES | \
NVMF_OPT_KATO | NVMF_OPT_HOSTNQN | \
NVMF_OPT_HOST_ID | NVMF_OPT_DUP_CONNECT |\
NVMF_OPT_DISABLE_SQFLOW | NVMF_OPT_DISCOVERY |\
NVMF_OPT_FAIL_FAST_TMO | NVMF_OPT_DHCHAP_SECRET |\
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
2026-02-01 3:08 [PATCH] nvme-fabrics: use kfree_sensitive() for DHCHAP secrets Daniel Hodges
@ 2026-02-02 6:58 ` Christoph Hellwig
2026-02-02 16:10 ` Keith Busch
1 sibling, 0 replies; 3+ messages in thread
From: Christoph Hellwig @ 2026-02-02 6:58 UTC (permalink / raw)
To: Daniel Hodges; +Cc: kbusch, axboe, hch, sagi, linux-nvme, linux-kernel
On Sat, Jan 31, 2026 at 07:08:40PM -0800, Daniel Hodges wrote:
> The DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) contain
> authentication key material for NVMe-oF. Use kfree_sensitive() instead
> of kfree() in nvmf_free_options() to ensure secrets are zeroed before
> the memory is freed, preventing recovery from freed pages.
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
2026-02-01 3:08 [PATCH] nvme-fabrics: use kfree_sensitive() for DHCHAP secrets Daniel Hodges
2026-02-02 6:58 ` Christoph Hellwig
@ 2026-02-02 16:10 ` Keith Busch
1 sibling, 0 replies; 3+ messages in thread
From: Keith Busch @ 2026-02-02 16:10 UTC (permalink / raw)
To: Daniel Hodges; +Cc: axboe, hch, sagi, linux-nvme, linux-kernel
On Sat, Jan 31, 2026 at 07:08:40PM -0800, Daniel Hodges wrote:
> The DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) contain
> authentication key material for NVMe-oF. Use kfree_sensitive() instead
> of kfree() in nvmf_free_options() to ensure secrets are zeroed before
> the memory is freed, preventing recovery from freed pages.
Thanks, applied to nvme-7.0.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-02-02 16:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-01 3:08 [PATCH] nvme-fabrics: use kfree_sensitive() for DHCHAP secrets Daniel Hodges
2026-02-02 6:58 ` Christoph Hellwig
2026-02-02 16:10 ` Keith Busch
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox