On 5/16/20 8:27 PM, Balbir Singh wrote:
On 14/5/20 10:00 pm, Matthew Wilcox wrote:
On Thu, May 14, 2020 at 09:00:40PM +1000, Balbir Singh wrote:
I wonder if the right thing to do is also to disable pre-emption, just so that the thread does not linger on with sensitive data.
void kvfree_sensitive(const void *addr, size_t len)
{
preempt_disable();
if (likely(!ZERO_OR_NULL_PTR(addr))) {
memzero_explicit((void *)addr, len);
kvfree(addr);
}
preempt_enable();
}
EXPORT_SYMBOL(kvfree_sensitive);
If it's _that_ sensitive then the caller should have disabled preemption.
Because preemption could otherwise have occurred immediately before
kvfree_sensitive() was called.
May be, but the callers of the API have to be explictly aware of the contract.
I don't disagree with you on what you've said, but I was referring to the
intent of freeing sensitive data vs the turn around time for doing so.
We can't disable preemption like that. The vfree() call may potentially
sleep. It could be a mess to keep track of the preemption state to make
that works.
The purpose of this API is to make sure that a newly allocated memory
block won't contain secret left behind from another task. There is no
guarantee on how long the freeing process will take.
Cheers,
Longman
