dm crypt: make wipe message also wipe tfm key
The "wipe key" message is used to wipe a volume key from memory temporarily, for example when suspending to RAM. There are two instances of the key in memory (inside crypto tfm) but only one got wiped. This patch wipes them both. Cc: stable@kernel.org Signed-off-by: Milan Broz <mbroz@redhat.com> Signed-off-by: Alasdair G Kergon <agk@redhat.com>
This commit is contained in:
parent
8e87b9b81b
commit
0b4309581b
|
@ -934,14 +934,14 @@ static int crypt_set_key(struct crypt_config *cc, char *key)
|
||||||
|
|
||||||
set_bit(DM_CRYPT_KEY_VALID, &cc->flags);
|
set_bit(DM_CRYPT_KEY_VALID, &cc->flags);
|
||||||
|
|
||||||
return 0;
|
return crypto_ablkcipher_setkey(cc->tfm, cc->key, cc->key_size);
|
||||||
}
|
}
|
||||||
|
|
||||||
static int crypt_wipe_key(struct crypt_config *cc)
|
static int crypt_wipe_key(struct crypt_config *cc)
|
||||||
{
|
{
|
||||||
clear_bit(DM_CRYPT_KEY_VALID, &cc->flags);
|
clear_bit(DM_CRYPT_KEY_VALID, &cc->flags);
|
||||||
memset(&cc->key, 0, cc->key_size * sizeof(u8));
|
memset(&cc->key, 0, cc->key_size * sizeof(u8));
|
||||||
return 0;
|
return crypto_ablkcipher_setkey(cc->tfm, cc->key, cc->key_size);
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -983,11 +983,6 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (crypt_set_key(cc, argv[1])) {
|
|
||||||
ti->error = "Error decoding key";
|
|
||||||
goto bad_cipher;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Compatibility mode for old dm-crypt cipher strings */
|
/* Compatibility mode for old dm-crypt cipher strings */
|
||||||
if (!chainmode || (strcmp(chainmode, "plain") == 0 && !ivmode)) {
|
if (!chainmode || (strcmp(chainmode, "plain") == 0 && !ivmode)) {
|
||||||
chainmode = "cbc";
|
chainmode = "cbc";
|
||||||
|
@ -1015,6 +1010,11 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
|
||||||
strcpy(cc->chainmode, chainmode);
|
strcpy(cc->chainmode, chainmode);
|
||||||
cc->tfm = tfm;
|
cc->tfm = tfm;
|
||||||
|
|
||||||
|
if (crypt_set_key(cc, argv[1]) < 0) {
|
||||||
|
ti->error = "Error decoding and setting key";
|
||||||
|
goto bad_ivmode;
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Choose ivmode. Valid modes: "plain", "essiv:<esshash>", "benbi".
|
* Choose ivmode. Valid modes: "plain", "essiv:<esshash>", "benbi".
|
||||||
* See comments at iv code
|
* See comments at iv code
|
||||||
|
@ -1085,11 +1085,6 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
|
||||||
goto bad_bs;
|
goto bad_bs;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (crypto_ablkcipher_setkey(tfm, cc->key, key_size) < 0) {
|
|
||||||
ti->error = "Error setting key";
|
|
||||||
goto bad_device;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (sscanf(argv[2], "%llu", &tmpll) != 1) {
|
if (sscanf(argv[2], "%llu", &tmpll) != 1) {
|
||||||
ti->error = "Invalid iv_offset sector";
|
ti->error = "Invalid iv_offset sector";
|
||||||
goto bad_device;
|
goto bad_device;
|
||||||
|
|
Loading…
Reference in New Issue