diff options
| author | Eric Biggers <ebiggers@google.com> | 2017-06-08 14:49:04 +0100 |
|---|---|---|
| committer | James Morris <james.l.morris@oracle.com> | 2017-06-09 13:29:48 +1000 |
| commit | 6966c74932b328b3d6df92b11b083bfbcd067986 (patch) | |
| tree | 0ce4998b3543b9dbbf884a929b580dc3bb698443 /security | |
| parent | 57070c850a03ee0cea654fc22cb8032fc3139d39 (diff) | |
| download | linux-stable-6966c74932b328b3d6df92b11b083bfbcd067986.tar.gz linux-stable-6966c74932b328b3d6df92b11b083bfbcd067986.tar.bz2 linux-stable-6966c74932b328b3d6df92b11b083bfbcd067986.zip | |
KEYS: user_defined: sanitize key payloads
Zero the payloads of user and logon keys before freeing them. This
prevents sensitive key material from being kept around in the slab
caches after a key is released.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/keys/user_defined.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c index 26605134f17a..3d8c68eba516 100644 --- a/security/keys/user_defined.c +++ b/security/keys/user_defined.c @@ -86,10 +86,18 @@ EXPORT_SYMBOL_GPL(user_preparse); */ void user_free_preparse(struct key_preparsed_payload *prep) { - kfree(prep->payload.data[0]); + kzfree(prep->payload.data[0]); } EXPORT_SYMBOL_GPL(user_free_preparse); +static void user_free_payload_rcu(struct rcu_head *head) +{ + struct user_key_payload *payload; + + payload = container_of(head, struct user_key_payload, rcu); + kzfree(payload); +} + /* * update a user defined key * - the key's semaphore is write-locked @@ -112,7 +120,7 @@ int user_update(struct key *key, struct key_preparsed_payload *prep) prep->payload.data[0] = NULL; if (zap) - kfree_rcu(zap, rcu); + call_rcu(&zap->rcu, user_free_payload_rcu); return ret; } EXPORT_SYMBOL_GPL(user_update); @@ -130,7 +138,7 @@ void user_revoke(struct key *key) if (upayload) { rcu_assign_keypointer(key, NULL); - kfree_rcu(upayload, rcu); + call_rcu(&upayload->rcu, user_free_payload_rcu); } } @@ -143,7 +151,7 @@ void user_destroy(struct key *key) { struct user_key_payload *upayload = key->payload.data[0]; - kfree(upayload); + kzfree(upayload); } EXPORT_SYMBOL_GPL(user_destroy); |