From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:38026 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752248AbdEPKw7 (ORCPT ); Tue, 16 May 2017 06:52:59 -0400 Subject: Patch "dm crypt: rewrite (wipe) key in crypto layer using random data" has been added to the 4.10-stable tree To: okozina@redhat.com, gregkh@linuxfoundation.org, snitzer@redhat.com Cc: , From: Date: Tue, 16 May 2017 12:52:44 +0200 Message-ID: <14949319641074@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled dm crypt: rewrite (wipe) key in crypto layer using random data to the 4.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: dm-crypt-rewrite-wipe-key-in-crypto-layer-using-random-data.patch and it can be found in the queue-4.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From c82feeec9a014b72c4ffea36648cfb6f81cc1b73 Mon Sep 17 00:00:00 2001 From: Ondrej Kozina Date: Mon, 24 Apr 2017 14:21:53 +0200 Subject: dm crypt: rewrite (wipe) key in crypto layer using random data From: Ondrej Kozina commit c82feeec9a014b72c4ffea36648cfb6f81cc1b73 upstream. The message "key wipe" used to wipe real key stored in crypto layer by rewriting it with zeroes. Since commit 28856a9 ("crypto: xts - consolidate sanity check for keys") this no longer works in FIPS mode for XTS. While running in FIPS mode the crypto key part has to differ from the tweak key. Fixes: 28856a9 ("crypto: xts - consolidate sanity check for keys") Signed-off-by: Ondrej Kozina Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman --- drivers/md/dm-crypt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -1649,12 +1649,16 @@ out: static int crypt_wipe_key(struct crypt_config *cc) { + int r; + clear_bit(DM_CRYPT_KEY_VALID, &cc->flags); - memset(&cc->key, 0, cc->key_size * sizeof(u8)); + get_random_bytes(&cc->key, cc->key_size); kzfree(cc->key_string); cc->key_string = NULL; + r = crypt_setkey(cc); + memset(&cc->key, 0, cc->key_size * sizeof(u8)); - return crypt_setkey(cc); + return r; } static void crypt_dtr(struct dm_target *ti) Patches currently in stable-queue which might be from okozina@redhat.com are queue-4.10/dm-crypt-rewrite-wipe-key-in-crypto-layer-using-random-data.patch