[PATCH v9 00/15] fix insecure use of memset bugs

[Stephen Hemminger]

There is an issue where calls to bzero (memset(), etc) can be
eliminated due to an optimizing compiler eliminating the call to
bzero() (or memset(), etc) because the arguments to the call are not
subsequently used by the function. The compiler can interpret this as
"no side effects", and eliminate the call.

The origin source of issue to being brought to light with a
security focus' is here: http://cwe.mitre.org/data/definitions/14.html

The issue was discovered in DPDK while looking at PVS Studio
blog about bugs:

https://pvs-studio.com/en/blog/posts/cpp/1183/

In DPDK there are three types of anti-patterns:
   1. trying to clear a key or sensitive data but using memset
   2. being overly paranoid and always calling memset
   3. unnecessary arrays (cut and paste?) that are memset


v9 - drop the standalone test for explicit zero
     because testing that code is not optimized away requires some non-portable
     hacks using altstack and/or glibc setcontext hooks. Not worth the hassle
     doing this and maintaining, just trust that libc works as expected.

Stephen Hemminger (15):
  eal: introduce new secure memory zero
  app/test: remove unused variable
  eal: add new secure free function
  app/test: use unit test runner for malloc tests
  app/test: add test for rte_free_sensitive
  common/cnxk: remove unused variable
  crypto/qat: force zero of keys
  crypto/qat: fix size calculation for memset
  crypto/qat: use secure free for keys
  bus/uacce: remove memset before free
  compress/octeontx: remove unnecessary memset
  test: remove unneeded memset
  net/ntnic: check result of malloc
  net/ntnic: remove unnecessary memset
  devtools/cocci: add script to find problematic memset

 app/test/test_cmdline_cirbuf.c                |   4 -
 app/test/test_malloc.c                        | 194 ++++++++++--------
 devtools/cocci/memset_free.cocci              |   9 +
 drivers/bus/uacce/uacce.c                     |   1 -
 drivers/common/cnxk/roc_npc_utils.c           |   4 -
 drivers/compress/octeontx/otx_zip.c           |   1 -
 drivers/compress/octeontx/otx_zip_pmd.c       |   2 -
 drivers/crypto/qat/qat_asym.c                 |   5 +-
 drivers/crypto/qat/qat_sym_session.c          |  51 ++---
 drivers/net/ntnic/nthw/core/nthw_hif.c        |   5 +-
 drivers/net/ntnic/nthw/core/nthw_iic.c        |   5 +-
 drivers/net/ntnic/nthw/core/nthw_pcie3.c      |   5 +-
 drivers/net/ntnic/nthw/core/nthw_rpf.c        |   5 +-
 drivers/net/ntnic/nthw/core/nthw_sdc.c        |   5 +-
 drivers/net/ntnic/nthw/core/nthw_si5340.c     |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_cat.c    |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_csu.c    |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_flm.c    |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_hfu.c    |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_hsh.c    |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_info.c   |   5 +-
 .../net/ntnic/nthw/flow_filter/flow_nthw_km.c |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_pdb.c    |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_qsl.c    |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_rpp_lr.c |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_slc_lr.c |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_tx_cpy.c |   1 -
 .../ntnic/nthw/flow_filter/flow_nthw_tx_ins.c |   5 +-
 .../ntnic/nthw/flow_filter/flow_nthw_tx_rpl.c |   5 +-
 .../net/ntnic/nthw/model/nthw_fpga_model.c    |   1 -
 drivers/net/ntnic/nthw/nthw_rac.c             |   4 +-
 lib/eal/common/eal_common_string_fns.c        |  14 ++
 lib/eal/common/rte_malloc.c                   |  30 ++-
 lib/eal/include/rte_malloc.h                  |  23 +++
 lib/eal/include/rte_string_fns.h              |  18 ++
 lib/eal/version.map                           |   4 +
 36 files changed, 251 insertions(+), 210 deletions(-)
 create mode 100644 devtools/cocci/memset_free.cocci

-- 
2.47.2