1. 26 Nov, 2014 1 commit
  2. 17 Oct, 2014 1 commit
    • Daniel Borkmann's avatar
      crypto: memzero_explicit - make sure to clear out sensitive data · 7185ad26
      Daniel Borkmann authored
      Recently, in commit 13aa93c70e71 ("random: add and use memzero_explicit()
      for clearing data"), we have found that GCC may optimize some memset()
      cases away when it detects a stack variable is not being used anymore
      and going out of scope. This can happen, for example, in cases when we
      are clearing out sensitive information such as keying material or any
      e.g. intermediate results from crypto computations, etc.
      
      With the help of Coccinelle, we can figure out and fix such occurences
      in the crypto subsytem as well. Julia Lawall provided the following
      Coccinelle program:
      
        @@
        type T;
        identifier x;
        @@
      
        T x;
        ... when exists
            when any
        -memset
        +memzero_explicit
           (&x,
        -0,
           ...)
        ... when != x
            when strict
      
        @@
        type T;
        identifier x;
        @@
      
        T x[...];
        ... when exists
            when any
        -memset
        +memzero_explicit
           (x,
        -0,
           ...)
        ... when != x
            when strict
      
      Therefore, make use of the drop-in replacement memzero_explicit() for
      exactly such cases instead of using memset().
      Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
      Cc: Julia Lawall <julia.lawall@lip6.fr>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Theodore Ts'o <tytso@mit.edu>
      Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      7185ad26
  3. 15 Oct, 2012 1 commit
  4. 06 Sep, 2012 1 commit
  5. 31 Oct, 2011 1 commit
  6. 31 Mar, 2011 1 commit
  7. 18 Mar, 2010 1 commit
  8. 02 Sep, 2009 1 commit