From: Milan Broz <mbroz@redhat.com>

Add DM_SECURE_DATA_FLAG which userspace can use to control
that all allocated buffers for dm-ioctl are wiped
immediatelly after use.

The user buffer is wipes as well (we do not want to keep
and return sensitive data back to userspace if flag is set).

Wiping is useful mainly for cryptsetup to control that key
is present in memory only on defined places and only
for time needed.

(For crypt, key can be present in table during load ot table
status, wait and message command).

Signed-off-by: Milan Broz <mbroz@redhat.com>

---
drivers/md/dm-ioctl.c    |   10 ++++++++++
 drivers/md/dm-ioctl.c    |   13 +++++++++++++
 include/linux/dm-ioctl.h |   12 +++++++++---
 2 files changed, 22 insertions(+), 3 deletions(-)

Index: linux-2.6.38-rc4/drivers/md/dm-ioctl.c
===================================================================
--- linux-2.6.38-rc4.orig/drivers/md/dm-ioctl.c
+++ linux-2.6.38-rc4/drivers/md/dm-ioctl.c
@@ -1518,10 +1518,17 @@ static int copy_params(struct dm_ioctl _
 	if (copy_from_user(dmi, user, tmp.data_size))
 		goto bad;
 
+	/* Wipe the user buffer so we do not return it to userspace */
+	if ((tmp.flags & DM_SECURE_DATA_FLAG) &&
+	    clear_user(user, tmp.data_size))
+		goto bad;
+
 	*param = dmi;
 	return 0;
 
 bad:
+	if (tmp.flags & DM_SECURE_DATA_FLAG)
+		memset(dmi, 0, tmp.data_size);
 	vfree(dmi);
 	return -EFAULT;
 }
@@ -1531,6 +1538,7 @@ static int validate_params(uint cmd, str
 	/* Always clear this flag */
 	param->flags &= ~DM_BUFFER_FULL_FLAG;
 	param->flags &= ~DM_UEVENT_GENERATED_FLAG;
+	param->flags &= ~DM_SECURE_DATA_FLAG;
 
 	/* Ignores parameters */
 	if (cmd == DM_REMOVE_ALL_CMD ||
@@ -1558,6 +1566,7 @@ static int validate_params(uint cmd, str
 static int ctl_ioctl(uint command, struct dm_ioctl __user *user)
 {
 	int r = 0;
+	int wipe_buffer;
 	unsigned int cmd;
 	struct dm_ioctl *uninitialized_var(param);
 	ioctl_fn fn = NULL;
@@ -1603,6 +1612,7 @@ static int ctl_ioctl(uint command, struc
 	 */
 	r = copy_params(user, &param);
 	input_param_size = param->data_size;
+	wipe_buffer = param->flags & DM_SECURE_DATA_FLAG;
 
 	current->flags &= ~PF_MEMALLOC;
 
@@ -1623,6 +1633,9 @@ static int ctl_ioctl(uint command, struc
 		r = -EFAULT;
 
 out:
+	if (wipe_buffer)
+		memset(param, 0, input_param_size);
+
 	vfree(param);
 	return r;
 }
Index: linux-2.6.38-rc4/include/linux/dm-ioctl.h
===================================================================
--- linux-2.6.38-rc4.orig/include/linux/dm-ioctl.h
+++ linux-2.6.38-rc4/include/linux/dm-ioctl.h
@@ -267,9 +267,9 @@ enum {
 #define DM_DEV_SET_GEOMETRY	_IOWR(DM_IOCTL, DM_DEV_SET_GEOMETRY_CMD, struct dm_ioctl)
 
 #define DM_VERSION_MAJOR	4
-#define DM_VERSION_MINOR	19
-#define DM_VERSION_PATCHLEVEL	1
-#define DM_VERSION_EXTRA	"-ioctl (2011-01-07)"
+#define DM_VERSION_MINOR	20
+#define DM_VERSION_PATCHLEVEL	0
+#define DM_VERSION_EXTRA	"-ioctl (2011-02-02)"
 
 /* Status bits */
 #define DM_READONLY_FLAG	(1 << 0) /* In/Out */
@@ -328,4 +328,10 @@ enum {
  */
 #define DM_UUID_FLAG			(1 << 14) /* In */
 
+/*
+ * If set, all buffers are wiped after use. Use when sending
+ * or requesting sensitive data such as an encryption key.
+ */
+#define DM_SECURE_DATA_FLAG		(1 << 15) /* In */
+
 #endif				/* _LINUX_DM_IOCTL_H */