Skip to content

Commit f2ebdad

Browse files
holger-denglerAlexander Gordeev
holger-dengler
authored and
Alexander Gordeev
committed
s390/pkey: Wipe copies of protected- and secure-keys
Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling process. So wipe all copies of protected- or secure-keys from stack, even in case of an error. Reviewed-by: Harald Freudenberger <[email protected]> Reviewed-by: Ingo Franzki <[email protected]> Acked-by: Heiko Carstens <[email protected]> Signed-off-by: Holger Dengler <[email protected]> Signed-off-by: Alexander Gordeev <[email protected]>
1 parent d65d76a commit f2ebdad

File tree

1 file changed

+37
-43
lines changed

1 file changed

+37
-43
lines changed

‎drivers/s390/crypto/pkey_api.c‎

Lines changed: 37 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1359,10 +1359,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
13591359
rc = cca_genseckey(kgs.cardnr, kgs.domain,
13601360
kgs.keytype, kgs.seckey.seckey);
13611361
pr_debug("%s cca_genseckey()=%d\n", __func__, rc);
1362-
if (rc)
1363-
break;
1364-
if (copy_to_user(ugs, &kgs, sizeof(kgs)))
1365-
return -EFAULT;
1362+
if (!rc && copy_to_user(ugs, &kgs, sizeof(kgs)))
1363+
rc = -EFAULT;
1364+
memzero_explicit(&kgs, sizeof(kgs));
13661365
break;
13671366
}
13681367
case PKEY_CLR2SECK: {
@@ -1390,10 +1389,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
13901389
ksp.seckey.seckey, ksp.protkey.protkey,
13911390
&ksp.protkey.len, &ksp.protkey.type);
13921391
pr_debug("%s cca_sec2protkey()=%d\n", __func__, rc);
1393-
if (rc)
1394-
break;
1395-
if (copy_to_user(usp, &ksp, sizeof(ksp)))
1396-
return -EFAULT;
1392+
if (!rc && copy_to_user(usp, &ksp, sizeof(ksp)))
1393+
rc = -EFAULT;
1394+
memzero_explicit(&ksp, sizeof(ksp));
13971395
break;
13981396
}
13991397
case PKEY_CLR2PROTK: {
@@ -1437,10 +1435,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
14371435
rc = pkey_skey2pkey(ksp.seckey.seckey, ksp.protkey.protkey,
14381436
&ksp.protkey.len, &ksp.protkey.type);
14391437
pr_debug("%s pkey_skey2pkey()=%d\n", __func__, rc);
1440-
if (rc)
1441-
break;
1442-
if (copy_to_user(usp, &ksp, sizeof(ksp)))
1443-
return -EFAULT;
1438+
if (!rc && copy_to_user(usp, &ksp, sizeof(ksp)))
1439+
rc = -EFAULT;
1440+
memzero_explicit(&ksp, sizeof(ksp));
14441441
break;
14451442
}
14461443
case PKEY_VERIFYKEY: {
@@ -1452,10 +1449,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
14521449
rc = pkey_verifykey(&kvk.seckey, &kvk.cardnr, &kvk.domain,
14531450
&kvk.keysize, &kvk.attributes);
14541451
pr_debug("%s pkey_verifykey()=%d\n", __func__, rc);
1455-
if (rc)
1456-
break;
1457-
if (copy_to_user(uvk, &kvk, sizeof(kvk)))
1458-
return -EFAULT;
1452+
if (!rc && copy_to_user(uvk, &kvk, sizeof(kvk)))
1453+
rc = -EFAULT;
1454+
memzero_explicit(&kvk, sizeof(kvk));
14591455
break;
14601456
}
14611457
case PKEY_GENPROTK: {
@@ -1468,10 +1464,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
14681464
rc = pkey_genprotkey(kgp.keytype, kgp.protkey.protkey,
14691465
&kgp.protkey.len, &kgp.protkey.type);
14701466
pr_debug("%s pkey_genprotkey()=%d\n", __func__, rc);
1471-
if (rc)
1472-
break;
1473-
if (copy_to_user(ugp, &kgp, sizeof(kgp)))
1474-
return -EFAULT;
1467+
if (!rc && copy_to_user(ugp, &kgp, sizeof(kgp)))
1468+
rc = -EFAULT;
1469+
memzero_explicit(&kgp, sizeof(kgp));
14751470
break;
14761471
}
14771472
case PKEY_VERIFYPROTK: {
@@ -1483,6 +1478,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
14831478
rc = pkey_verifyprotkey(kvp.protkey.protkey,
14841479
kvp.protkey.len, kvp.protkey.type);
14851480
pr_debug("%s pkey_verifyprotkey()=%d\n", __func__, rc);
1481+
memzero_explicit(&kvp, sizeof(kvp));
14861482
break;
14871483
}
14881484
case PKEY_KBLOB2PROTK: {
@@ -1500,10 +1496,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
15001496
&ktp.protkey.len, &ktp.protkey.type);
15011497
pr_debug("%s pkey_keyblob2pkey()=%d\n", __func__, rc);
15021498
kfree_sensitive(kkey);
1503-
if (rc)
1504-
break;
1505-
if (copy_to_user(utp, &ktp, sizeof(ktp)))
1506-
return -EFAULT;
1499+
if (!rc && copy_to_user(utp, &ktp, sizeof(ktp)))
1500+
rc = -EFAULT;
1501+
memzero_explicit(&ktp, sizeof(ktp));
15071502
break;
15081503
}
15091504
case PKEY_GENSECK2: {
@@ -1529,23 +1524,23 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
15291524
pr_debug("%s pkey_genseckey2()=%d\n", __func__, rc);
15301525
kfree(apqns);
15311526
if (rc) {
1532-
kfree(kkey);
1527+
kfree_sensitive(kkey);
15331528
break;
15341529
}
15351530
if (kgs.key) {
15361531
if (kgs.keylen < klen) {
1537-
kfree(kkey);
1532+
kfree_sensitive(kkey);
15381533
return -EINVAL;
15391534
}
15401535
if (copy_to_user(kgs.key, kkey, klen)) {
1541-
kfree(kkey);
1536+
kfree_sensitive(kkey);
15421537
return -EFAULT;
15431538
}
15441539
}
15451540
kgs.keylen = klen;
15461541
if (copy_to_user(ugs, &kgs, sizeof(kgs)))
15471542
rc = -EFAULT;
1548-
kfree(kkey);
1543+
kfree_sensitive(kkey);
15491544
break;
15501545
}
15511546
case PKEY_CLR2SECK2: {
@@ -1574,18 +1569,18 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
15741569
pr_debug("%s pkey_clr2seckey2()=%d\n", __func__, rc);
15751570
kfree(apqns);
15761571
if (rc) {
1577-
kfree(kkey);
1572+
kfree_sensitive(kkey);
15781573
memzero_explicit(&kcs, sizeof(kcs));
15791574
break;
15801575
}
15811576
if (kcs.key) {
15821577
if (kcs.keylen < klen) {
1583-
kfree(kkey);
1578+
kfree_sensitive(kkey);
15841579
memzero_explicit(&kcs, sizeof(kcs));
15851580
return -EINVAL;
15861581
}
15871582
if (copy_to_user(kcs.key, kkey, klen)) {
1588-
kfree(kkey);
1583+
kfree_sensitive(kkey);
15891584
memzero_explicit(&kcs, sizeof(kcs));
15901585
return -EFAULT;
15911586
}
@@ -1594,7 +1589,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
15941589
if (copy_to_user(ucs, &kcs, sizeof(kcs)))
15951590
rc = -EFAULT;
15961591
memzero_explicit(&kcs, sizeof(kcs));
1597-
kfree(kkey);
1592+
kfree_sensitive(kkey);
15981593
break;
15991594
}
16001595
case PKEY_VERIFYKEY2: {
@@ -1611,7 +1606,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
16111606
&kvk.cardnr, &kvk.domain,
16121607
&kvk.type, &kvk.size, &kvk.flags);
16131608
pr_debug("%s pkey_verifykey2()=%d\n", __func__, rc);
1614-
kfree(kkey);
1609+
kfree_sensitive(kkey);
16151610
if (rc)
16161611
break;
16171612
if (copy_to_user(uvk, &kvk, sizeof(kvk)))
@@ -1642,10 +1637,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
16421637
pr_debug("%s pkey_keyblob2pkey2()=%d\n", __func__, rc);
16431638
kfree(apqns);
16441639
kfree_sensitive(kkey);
1645-
if (rc)
1646-
break;
1647-
if (copy_to_user(utp, &ktp, sizeof(ktp)))
1648-
return -EFAULT;
1640+
if (!rc && copy_to_user(utp, &ktp, sizeof(ktp)))
1641+
rc = -EFAULT;
1642+
memzero_explicit(&ktp, sizeof(ktp));
16491643
break;
16501644
}
16511645
case PKEY_APQNS4K: {
@@ -1673,7 +1667,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
16731667
rc = pkey_apqns4key(kkey, kak.keylen, kak.flags,
16741668
apqns, &nr_apqns);
16751669
pr_debug("%s pkey_apqns4key()=%d\n", __func__, rc);
1676-
kfree(kkey);
1670+
kfree_sensitive(kkey);
16771671
if (rc && rc != -ENOSPC) {
16781672
kfree(apqns);
16791673
break;
@@ -1759,7 +1753,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
17591753
protkey = kmalloc(protkeylen, GFP_KERNEL);
17601754
if (!protkey) {
17611755
kfree(apqns);
1762-
kfree(kkey);
1756+
kfree_sensitive(kkey);
17631757
return -ENOMEM;
17641758
}
17651759
rc = pkey_keyblob2pkey3(apqns, ktp.apqn_entries,
@@ -1769,20 +1763,20 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
17691763
kfree(apqns);
17701764
kfree_sensitive(kkey);
17711765
if (rc) {
1772-
kfree(protkey);
1766+
kfree_sensitive(protkey);
17731767
break;
17741768
}
17751769
if (ktp.pkey && ktp.pkeylen) {
17761770
if (protkeylen > ktp.pkeylen) {
1777-
kfree(protkey);
1771+
kfree_sensitive(protkey);
17781772
return -EINVAL;
17791773
}
17801774
if (copy_to_user(ktp.pkey, protkey, protkeylen)) {
1781-
kfree(protkey);
1775+
kfree_sensitive(protkey);
17821776
return -EFAULT;
17831777
}
17841778
}
1785-
kfree(protkey);
1779+
kfree_sensitive(protkey);
17861780
ktp.pkeylen = protkeylen;
17871781
if (copy_to_user(utp, &ktp, sizeof(ktp)))
17881782
return -EFAULT;

0 commit comments

Comments
 (0)