cifs: replace kfree() with kfree_sensitive() for sensitive data

Replace kfree with kfree_sensitive, or prepend memzero_explicit() in
other cases, when freeing sensitive material that could still be left
in memory.

Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Reported-by: kernel test robot <oliver.sang@intel.com>
Link: https://lore.kernel.org/r/202209201529.ec633796-oliver.sang@intel.com
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 46f5718754f948d8d5046b3112891aec15e8cce7..d848bc0aac274dcdfc0e4d6284106135d28bde81 100644 (file)
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
 unlock:
        cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
-       kfree(tiblob);
+       kfree_sensitive(tiblob);
 
        return rc;
 }
@@ -753,14 +753,14 @@ cifs_crypto_secmech_release(struct TCP_Server_Info *server)
                server->secmech.ccmaesdecrypt = NULL;
        }
 
-       kfree(server->secmech.sdesccmacaes);
+       kfree_sensitive(server->secmech.sdesccmacaes);
        server->secmech.sdesccmacaes = NULL;
-       kfree(server->secmech.sdeschmacsha256);
+       kfree_sensitive(server->secmech.sdeschmacsha256);
        server->secmech.sdeschmacsha256 = NULL;
-       kfree(server->secmech.sdeschmacmd5);
+       kfree_sensitive(server->secmech.sdeschmacmd5);
        server->secmech.sdeschmacmd5 = NULL;
-       kfree(server->secmech.sdescmd5);
+       kfree_sensitive(server->secmech.sdescmd5);
        server->secmech.sdescmd5 = NULL;
-       kfree(server->secmech.sdescsha512);
+       kfree_sensitive(server->secmech.sdescsha512);
        server->secmech.sdescsha512 = NULL;
 }

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 93e59b3b36c73cde308db3c0ba053dd173016585..40900aace416e2e387ff766a29b447d2d15169ff 100644 (file)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -311,7 +311,7 @@ cifs_abort_connection(struct TCP_Server_Info *server)
        }
        server->sequence_number = 0;
        server->session_estab = false;
-       kfree(server->session_key.response);
+       kfree_sensitive(server->session_key.response);
        server->session_key.response = NULL;
        server->session_key.len = 0;
        server->lstrp = jiffies;
@@ -1580,7 +1580,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
 
        cifs_crypto_secmech_release(server);
 
-       kfree(server->session_key.response);
+       kfree_sensitive(server->session_key.response);
        server->session_key.response = NULL;
        server->session_key.len = 0;
        kfree(server->hostname);
@@ -4135,7 +4135,7 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
                if (ses->auth_key.response) {
                        cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
                                 ses->auth_key.response);
-                       kfree(ses->auth_key.response);
+                       kfree_sensitive(ses->auth_key.response);
                        ses->auth_key.response = NULL;
                        ses->auth_key.len = 0;
                }

diff --git a/fs/cifs/fs_context.c b/fs/cifs/fs_context.c
index 0e13dec86b252736047b5017437b00e56dfe2803..45119597c7655b60150011145b13e00f12e4f270 100644 (file)
--- a/fs/cifs/fs_context.c
+++ b/fs/cifs/fs_context.c
@@ -791,6 +791,13 @@ do {                                                                       \
        cifs_sb->ctx->field = NULL;                                     \
 } while (0)
 
+#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)                    \
+do {                                                                   \
+       kfree_sensitive(ctx->field);                                    \
+       ctx->field = cifs_sb->ctx->field;                               \
+       cifs_sb->ctx->field = NULL;                                     \
+} while (0)
+
 static int smb3_reconfigure(struct fs_context *fc)
 {
        struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -811,7 +818,7 @@ static int smb3_reconfigure(struct fs_context *fc)
        STEAL_STRING(cifs_sb, ctx, UNC);
        STEAL_STRING(cifs_sb, ctx, source);
        STEAL_STRING(cifs_sb, ctx, username);
-       STEAL_STRING(cifs_sb, ctx, password);
+       STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
        STEAL_STRING(cifs_sb, ctx, domainname);
        STEAL_STRING(cifs_sb, ctx, nodename);
        STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1162,7 +1169,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
                }
                break;
        case Opt_pass:
-               kfree(ctx->password);
+               kfree_sensitive(ctx->password);
                ctx->password = NULL;
                if (strlen(param->string) == 0)
                        break;
@@ -1470,6 +1477,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
        return 0;
 
  cifs_parse_mount_err:
+       kfree_sensitive(ctx->password);
        return -EINVAL;
 }
 

diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 20a112c96bae5e12a19e2a595d559fb333b161c0..72bd1b2b323f671df54a7f37a401845ace497440 100644 (file)
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -1119,7 +1119,7 @@ cifs_alloc_hash(const char *name,
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
-       kfree(*sdesc);
+       kfree_sensitive(*sdesc);
        *sdesc = NULL;
        if (*shash)
                crypto_free_shash(*shash);

diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 3af3b05b6c740aa87d48a066d0049f81badf5e93..f1c3c6d9146c307627bf97aa415c835aa24c375c 100644 (file)
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -1213,6 +1213,12 @@ out_free_smb_buf:
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
+       int i;
+
+       /* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
+       for (i = 0; i < 3; i++)
+               if (sess_data->iov[i].iov_base)
+                       memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
        free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
        sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1374,7 +1380,7 @@ out:
        sess_data->result = rc;
        sess_data->func = NULL;
        sess_free_buffer(sess_data);
-       kfree(ses->auth_key.response);
+       kfree_sensitive(ses->auth_key.response);
        ses->auth_key.response = NULL;
 }
 
@@ -1513,7 +1519,7 @@ out:
        sess_data->result = rc;
        sess_data->func = NULL;
        sess_free_buffer(sess_data);
-       kfree(ses->auth_key.response);
+       kfree_sensitive(ses->auth_key.response);
        ses->auth_key.response = NULL;
 }
 
@@ -1648,7 +1654,7 @@ sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
        rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
-       kfree(ntlmsspblob);
+       kfree_sensitive(ntlmsspblob);
 out:
        sess_free_buffer(sess_data);
 
@@ -1658,9 +1664,9 @@ out:
        }
 
        /* Else error. Cleanup */
-       kfree(ses->auth_key.response);
+       kfree_sensitive(ses->auth_key.response);
        ses->auth_key.response = NULL;
-       kfree(ses->ntlmssp);
+       kfree_sensitive(ses->ntlmssp);
        ses->ntlmssp = NULL;
 
        sess_data->func = NULL;
@@ -1759,7 +1765,7 @@ sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
        }
 
 out_free_ntlmsspblob:
-       kfree(ntlmsspblob);
+       kfree_sensitive(ntlmsspblob);
 out:
        sess_free_buffer(sess_data);
 
@@ -1767,9 +1773,9 @@ out:
                rc = sess_establish_session(sess_data);
 
        /* Cleanup */
-       kfree(ses->auth_key.response);
+       kfree_sensitive(ses->auth_key.response);
        ses->auth_key.response = NULL;
-       kfree(ses->ntlmssp);
+       kfree_sensitive(ses->ntlmssp);
        ses->ntlmssp = NULL;
 
        sess_data->func = NULL;
@@ -1845,7 +1851,7 @@ int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
        rc = sess_data->result;
 
 out:
-       kfree(sess_data);
+       kfree_sensitive(sess_data);
        return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 10f9ef68e510c60dfa12e86c415fbfaf46567be5..9a686870e8b7955f60be3662a4b0c20fd2e6abc3 100644 (file)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -4423,11 +4423,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
        if (!rc && enc)
                memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
-       kfree(iv);
+       kfree_sensitive(iv);
 free_sg:
-       kfree(sg);
+       kfree_sensitive(sg);
 free_req:
-       kfree(req);
+       kfree_sensitive(req);
        return rc;
 }
 

diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 40fce33763072a63f24c0e8384e361d479d1a965..b3c4d2e54eaa3beec2f3473ec4663c5f015d94a9 100644 (file)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1345,6 +1345,13 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data)
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
+       int i;
+
+       /* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
+       for (i = 0; i < 2; i++)
+               if (sess_data->iov[i].iov_base)
+                       memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
+
        free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
        sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1477,6 +1484,8 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
 out_put_spnego_key:
        key_invalidate(spnego_key);
        key_put(spnego_key);
+       if (rc)
+               kfree_sensitive(ses->auth_key.response);
 out:
        sess_data->result = rc;
        sess_data->func = NULL;
@@ -1573,7 +1582,7 @@ SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data)
        }
 
 out:
-       kfree(ntlmssp_blob);
+       memzero_explicit(ntlmssp_blob, blob_length);
        SMB2_sess_free_buffer(sess_data);
        if (!rc) {
                sess_data->result = 0;
@@ -1581,7 +1590,7 @@ out:
                return;
        }
 out_err:
-       kfree(ses->ntlmssp);
+       kfree_sensitive(ses->ntlmssp);
        ses->ntlmssp = NULL;
        sess_data->result = rc;
        sess_data->func = NULL;
@@ -1657,9 +1666,9 @@ SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data)
        }
 #endif
 out:
-       kfree(ntlmssp_blob);
+       memzero_explicit(ntlmssp_blob, blob_length);
        SMB2_sess_free_buffer(sess_data);
-       kfree(ses->ntlmssp);
+       kfree_sensitive(ses->ntlmssp);
        ses->ntlmssp = NULL;
        sess_data->result = rc;
        sess_data->func = NULL;
@@ -1737,7 +1746,7 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
                cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
        rc = sess_data->result;
 out:
-       kfree(sess_data);
+       kfree_sensitive(sess_data);
        return rc;
 }