From 586c31f3bf04c290dc0a0de7fc91d20aa9a5ee53 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Thu, 7 Feb 2013 00:55:37 +0000 Subject: net: sctp: sctp_auth_key_put: use kzfree instead of kfree For sensitive data like keying material, it is common practice to zero out keys before returning the memory back to the allocator. Thus, use kzfree instead of kfree. Signed-off-by: Daniel Borkmann Acked-by: Neil Horman Acked-by: Vlad Yasevich Signed-off-by: David S. Miller --- net/sctp/auth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net/sctp/auth.c') diff --git a/net/sctp/auth.c b/net/sctp/auth.c index 159b9bc5d633..d8420ae614dc 100644 --- a/net/sctp/auth.c +++ b/net/sctp/auth.c @@ -71,7 +71,7 @@ void sctp_auth_key_put(struct sctp_auth_bytes *key) return; if (atomic_dec_and_test(&key->refcnt)) { - kfree(key); + kzfree(key); SCTP_DBG_OBJCNT_DEC(keys); } } -- cgit v1.2.3 From 241448c2b84ff02a46ce88199e05fdeb55bad449 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Thu, 7 Feb 2013 01:41:39 +0000 Subject: net: sctp: sctp_auth_make_key_vector: remove duplicate ntohs calls Instead of calling 3 times ntohs(random->param_hdr.length), 2 times ntohs(hmacs->param_hdr.length), and 3 times ntohs(chunks->param_hdr.length) within the same function, we only call each once and store it in a variable. Signed-off-by: Daniel Borkmann Acked-by: Neil Horman Acked-by: Vlad Yasevich Signed-off-by: David S. Miller --- net/sctp/auth.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) (limited to 'net/sctp/auth.c') diff --git a/net/sctp/auth.c b/net/sctp/auth.c index 159b9bc5d633..94a12de58691 100644 --- a/net/sctp/auth.c +++ b/net/sctp/auth.c @@ -200,10 +200,14 @@ static struct sctp_auth_bytes *sctp_auth_make_key_vector( struct sctp_auth_bytes *new; __u32 len; __u32 offset = 0; + __u16 random_len, hmacs_len, chunks_len = 0; - len = ntohs(random->param_hdr.length) + ntohs(hmacs->param_hdr.length); - if (chunks) - len += ntohs(chunks->param_hdr.length); + random_len = ntohs(random->param_hdr.length); + hmacs_len = ntohs(hmacs->param_hdr.length); + if (chunks) + chunks_len = ntohs(chunks->param_hdr.length); + + len = random_len + hmacs_len + chunks_len; new = kmalloc(sizeof(struct sctp_auth_bytes) + len, gfp); if (!new) @@ -211,16 +215,15 @@ static struct sctp_auth_bytes *sctp_auth_make_key_vector( new->len = len; - memcpy(new->data, random, ntohs(random->param_hdr.length)); - offset += ntohs(random->param_hdr.length); + memcpy(new->data, random, random_len); + offset += random_len; if (chunks) { - memcpy(new->data + offset, chunks, - ntohs(chunks->param_hdr.length)); - offset += ntohs(chunks->param_hdr.length); + memcpy(new->data + offset, chunks, chunks_len); + offset += chunks_len; } - memcpy(new->data + offset, hmacs, ntohs(hmacs->param_hdr.length)); + memcpy(new->data + offset, hmacs, hmacs_len); return new; } -- cgit v1.2.3 From 03536e23acd3706c0ec93d01dc8bef44dab1a860 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Thu, 7 Feb 2013 23:22:58 +0000 Subject: net: sctp: sctp_auth_make_key_vector: use sctp_auth_create_key In sctp_auth_make_key_vector, we allocate a temporary sctp_auth_bytes structure with kmalloc instead of the sctp_auth_create_key allocator. Change this to sctp_auth_create_key as it is the case everywhere else, so that we also can properly free it via sctp_auth_key_put. This makes it easier for future code changes in the structure and allocator itself, since a single API is consistently used for this purpose. Also, by using sctp_auth_create_key we're doing sanity checks over the arguments. Signed-off-by: Daniel Borkmann Acked-by: Vlad Yasevich Signed-off-by: David S. Miller --- net/sctp/auth.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'net/sctp/auth.c') diff --git a/net/sctp/auth.c b/net/sctp/auth.c index 94a12de58691..5ec7509bb2c9 100644 --- a/net/sctp/auth.c +++ b/net/sctp/auth.c @@ -209,12 +209,10 @@ static struct sctp_auth_bytes *sctp_auth_make_key_vector( len = random_len + hmacs_len + chunks_len; - new = kmalloc(sizeof(struct sctp_auth_bytes) + len, gfp); + new = sctp_auth_create_key(len, gfp); if (!new) return NULL; - new->len = len; - memcpy(new->data, random, random_len); offset += random_len; @@ -353,8 +351,8 @@ static struct sctp_auth_bytes *sctp_auth_asoc_create_secret( secret = sctp_auth_asoc_set_secret(ep_key, first_vector, last_vector, gfp); out: - kfree(local_key_vector); - kfree(peer_key_vector); + sctp_auth_key_put(local_key_vector); + sctp_auth_key_put(peer_key_vector); return secret; } -- cgit v1.2.3