Archive-Team
/
zfs
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 103 Wiki Activity
OpenZFS on Linux and FreeBSD
8,407 Commits 42 Branches 132 Tags 226 MiB
C 70.3%
Shell 19.1%
Assembly 5.1%
M4 2.4%
Python 1.8%
Other 1.3%
Go to file
Richard Yao d634d20d1b
icp: Prevent compilers from optimizing away memset() in gcm_clear_ctx() 
The recently merged f58e513f74 was
intended to zero sensitive data before exit from encryption
functions to harden the code against theoretical information
leaks. Unfortunately, the method by which it did that is
optimized away by the compiler, so some information still leaks. This
was confirmed by counting function calls in disassembly.

After studying how the OpenBSD, FreeBSD and Linux kernels handle this,
and looking at our disassembly, I decided on a two-factor approach to
protect us from compiler dead store elimination passes.

The first factor is to stop trying to inline gcm_clear_ctx(). GCC does
not actually inline it in the first place, and testing suggests that
dead store elimination passes appear to become more powerful in a bad
way when inlining is forced, so we recognize that and move
gcm_clear_ctx() to a C file.

The second factor is to implement an explicit_memset() function based on
the technique used by `secure_zero_memory()` in FreeBSD's blake2
implementation, which coincidentally is functionally identical to the
one used by Linux. The source for this appears to be a LLVM bug:

https://llvm.org/bugs/show_bug.cgi?id=15495

Unlike both FreeBSD and Linux, we explicitly avoid the inline keyword,
based on my observations that GCC's dead store elimination pass becomes
more powerful when inlining is forced, under the assumption that it will
be equally powerful when the compiler does decide to inline function
calls.

Disassembly of GCC's output confirms that all 6 memset() calls are
executed with this patch applied.

Reviewed-by: Attila Fülöp <attila@fueloep.org>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu>
Closes #14544
 		2023-02-28 17:28:50 -08:00
.github Workaround GitHub Action failure 2023-02-27 09:19:25 -08:00
cmd Improve error message of zfs redact 2023-02-21 17:30:05 -08:00
config Linux: use filemap_range_has_page() 2023-02-14 11:04:34 -08:00
contrib Fix github build failures because of vdevprops.7 2023-02-28 14:02:48 -08:00
etc etc/systemd/zfs-mount-generator: avoid strndupa 2023-01-10 13:40:31 -08:00
include Linux: Assert mutex is held in mutex_exit() 2023-02-28 17:27:20 -08:00
lib Use .section .rodata instead of .rodata on FreeBSD 2023-02-24 16:45:48 -08:00
man Add vdevprops.7 to the Makefile 2023-02-27 16:38:09 -08:00
module icp: Prevent compilers from optimizing away memset() in gcm_clear_ctx() 2023-02-28 17:28:50 -08:00
rpm rpm: Use libtirpc-devel and /usr/lib on SUSE 2023-02-09 11:57:50 -08:00
scripts Add native-deb* targets to build native Debian packages 2022-12-13 17:33:05 -08:00
tests ZTS: Minor fixes 2023-02-23 17:10:46 -08:00
udev Replace dead opensolaris.org license link 2022-07-11 14:16:13 -07:00
.editorconfig Add an .editorconfig; document git whitespace settings 2020-01-27 13:32:52 -08:00
.gitignore autoconf: use include directives instead of recursing down cmd 2022-05-10 10:18:38 -07:00
.gitmodules .gitmodules: link to openzfs github repository 2021-04-12 09:37:23 -07:00
AUTHORS zfs_rename: support RENAME_* flags 2022-10-28 09:49:20 -07:00
CODE_OF_CONDUCT.md Documentation corrections 2022-12-22 11:34:28 -08:00
COPYRIGHT Fix typos 2020-06-09 21:24:09 -07:00
LICENSE Update build system and packaging 2018-05-29 16:00:33 -07:00
META Update META to 6.1 kernel 2023-01-10 15:53:33 -08:00
Makefile.am Process `script` directory for all configs 2022-10-27 16:45:14 -07:00
NEWS Fix NEWS file 2020-08-26 21:44:41 -07:00
NOTICE Update build system and packaging 2018-05-29 16:00:33 -07:00
README.md README: Update OpenZFS website url 2022-01-06 16:25:01 -08:00
RELEASES.md Add RELEASES.md file 2021-04-02 16:33:40 -07:00
TEST Remove CI builder customization from TEST 2020-03-16 10:46:03 -07:00
autogen.sh Ubuntu 22.04 integration: ShellCheck 2022-11-18 11:24:48 -08:00
configure.ac Add native-deb* targets to build native Debian packages 2022-12-13 17:33:05 -08:00
copy-builtin copy-builtin: add hooks with sed/>> 2022-05-10 10:17:43 -07:00
zfs.release.in Move zfs.release generation to configure step 2012-07-12 12:22:51 -07:00

README.md

img

OpenZFS is an advanced file system and volume manager which was originally developed for Solaris and is now maintained by the OpenZFS community. This repository contains the code for running OpenZFS on Linux and FreeBSD.

codecov coverity

Official Resources

Installation

Full documentation for installing OpenZFS on your favorite operating system can be found at the Getting Started Page.

Contribute & Develop

We have a separate document with contribution guidelines.

We have a Code of Conduct.

Release

OpenZFS is released under a CDDL license. For more details see the NOTICE, LICENSE and COPYRIGHT files; UCRL-CODE-235197

Supported Kernels

  • The META file contains the officially recognized supported Linux kernel versions.
  • Supported FreeBSD versions are any supported branches and releases starting from 12.2-RELEASE.