Messages in this thread Patch in this message | | | Date | Wed, 18 Mar 2015 09:53:45 +0000 | From | mancha <> | Subject | [BUG/PATCH] kernel RNG and its secrets |
| |
Hi.
The kernel RNG introduced memzero_explicit in d4c5efdb9777 to protect memory cleansing against things like dead store optimization:
void memzero_explicit(void *s, size_t count) { memset(s, 0, count); OPTIMIZER_HIDE_VAR(s); }
OPTIMIZER_HIDE_VAR, introduced in fe8c8a126806 to protect crypto_memneq against timing analysis, is defined when using gcc as:
#define OPTIMIZER_HIDE_VAR(var) __asm__ ("" : "=r" (var) : "0" (var))
My tests with gcc 4.8.2 on x86 find it insufficient to prevent gcc from optimizing out memset (i.e. secrets remain in memory).
Two things that do work:
__asm__ __volatile__ ("" : "=r" (var) : "0" (var))
and
__asm__ __volatile__("": : :"memory")
The first is OPTIMIZER_HIDE_VAR plus a volatile qualifier and the second is barrier() [as defined when using gcc].
I propose memzero_explicit use barrier().
--- a/lib/string.c +++ b/lib/string.c @@ -616,7 +616,7 @@ EXPORT_SYMBOL(memset); void memzero_explicit(void *s, size_t count) { memset(s, 0, count); - OPTIMIZER_HIDE_VAR(s); + barrier(); } EXPORT_SYMBOL(memzero_explicit); For any attribution deemed necessary, please use "mancha security". Please CC me on replies. --mancha
PS CC'ing Herbert Xu in case this impacts crypto_memneq. [unhandled content-type:application/pgp-signature] | |