[PATCH] crypto: drbg: use memzero_explicit() for clearing sensitive data

[Nickolaus Woodruff]

Compiler dead store optimization can sometimes remove final calls
to memset() used to clear sensitive data at the end of a function.
Replace trailing memset() calls with memzero_explicit() to
preclude unwanted removal.

Signed-off-by: Nickolaus Woodruff <nickolauswoodr...@gmail.com>
---
 crypto/drbg.c         | 22 +++++++++++-----------
 include/crypto/drbg.h |  1 +
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/crypto/drbg.c b/crypto/drbg.c
index 54cfd48..c6258ca 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -522,9 +522,9 @@ static int drbg_ctr_df(struct drbg_state *drbg,
        ret = 0;
 
 out:
-       memset(iv, 0, drbg_blocklen(drbg));
-       memset(temp, 0, drbg_statelen(drbg));
-       memset(pad, 0, drbg_blocklen(drbg));
+       memzero_explicit(iv, drbg_blocklen(drbg));
+       memzero_explicit(temp, drbg_statelen(drbg));
+       memzero_explicit(pad, drbg_blocklen(drbg));
        return ret;
 }
 
@@ -599,9 +599,9 @@ static int drbg_ctr_update(struct drbg_state *drbg, struct 
list_head *seed,
        ret = 0;
 
 out:
-       memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
+       memzero_explicit(temp, drbg_statelen(drbg) + drbg_blocklen(drbg));
        if (2 != reseed)
-               memset(df_data, 0, drbg_statelen(drbg));
+               memzero_explicit(df_data, drbg_statelen(drbg));
        return ret;
 }
 
@@ -660,7 +660,7 @@ static int drbg_ctr_generate(struct drbg_state *drbg,
                len = ret;
 
 out:
-       memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
+       memzero_explicit(drbg->scratchpad, drbg_blocklen(drbg));
        return len;
 }
 
@@ -848,7 +848,7 @@ static int drbg_hash_df(struct drbg_state *drbg,
        }
 
 out:
-       memset(tmp, 0, drbg_blocklen(drbg));
+       memzero_explicit(tmp, drbg_blocklen(drbg));
        return ret;
 }
 
@@ -892,7 +892,7 @@ static int drbg_hash_update(struct drbg_state *drbg, struct 
list_head *seed,
        ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
 
 out:
-       memset(drbg->scratchpad, 0, drbg_statelen(drbg));
+       memzero_explicit(drbg->scratchpad, drbg_statelen(drbg));
        return ret;
 }
 
@@ -927,7 +927,7 @@ static int drbg_hash_process_addtl(struct drbg_state *drbg,
                     drbg->scratchpad, drbg_blocklen(drbg));
 
 out:
-       memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
+       memzero_explicit(drbg->scratchpad, drbg_blocklen(drbg));
        return ret;
 }
 
@@ -975,7 +975,7 @@ static int drbg_hash_hashgen(struct drbg_state *drbg,
        }
 
 out:
-       memset(drbg->scratchpad, 0,
+       memzero_explicit(drbg->scratchpad,
               (drbg_statelen(drbg) + drbg_blocklen(drbg)));
        return len;
 }
@@ -1024,7 +1024,7 @@ static int drbg_hash_generate(struct drbg_state *drbg,
        drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
 
 out:
-       memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
+       memzero_explicit(drbg->scratchpad, drbg_blocklen(drbg));
        return len;
 }
 
diff --git a/include/crypto/drbg.h b/include/crypto/drbg.h
index 5186f75..13471a2 100644
--- a/include/crypto/drbg.h
+++ b/include/crypto/drbg.h
@@ -45,6 +45,7 @@
 #include <crypto/hash.h>
 #include <linux/module.h>
 #include <linux/crypto.h>
+#include <linux/string.h>
 #include <linux/slab.h>
 #include <crypto/internal/rng.h>
 #include <crypto/rng.h>
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html