github actions: Use reusable workflow for upstream commit checking

[bmastbergen]

Simplifies the workflow to use the reusable workflow defined in main branch. This reduces duplication and makes the workflow easier to maintain across multiple branches.

The workflow now references ctrliq/kernel-src-tree/.github/workflows/upstream-commit-check.yml@main which contains the full workflow implementation.

[github-actions]

ERROR: Failed to clone vulns repo: Cloning into '../vulns'...
fatal: unable to access 'https://git.kernel.org/pub/scm/linux/security/vulns.git/': The requested URL returned error: 502

[github-actions]

🔍 Upstream Linux Kernel Commit Check

• ⚠️ PR commit 049e1e615816 (net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull) does not reference a CVE but
  upstream commit 43ffe6caccc7 is associated with CVE-2023-53104

This is an automated message from the kernel commit checker workflow.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 11f7a1eb1073 (drm/gem: Acquire references on GEM handles for framebuffers) → upstream 5307dce878d4
  Differences found:

diff -u b/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
--- b/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -204,12 +204,10 @@
 {
 	struct drm_device *dev = obj->dev;
 
-	mutex_lock(&dev->object_name_lock);
+	guard(mutex)(&dev->object_name_lock);
 
 	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
 	drm_gem_object_handle_get(obj);
-
-	mutex_unlock(&dev->object_name_lock);
 }
 EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);

• ⚠️ PR commit 6d1b009002ca (drm/framebuffer: Acquire internal references on GEM handles) → upstream f6bfc9afc751
  Differences found:

diff -u b/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
--- b/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -193,37 +193,25 @@
 }
 
 /**
- * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any
+ * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles
  * @obj: GEM object
  *
- * Acquires a reference on the GEM buffer object's handle. Required to keep
- * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked()
- * to release the reference. Does nothing if the buffer object has no handle.
- *
- * Returns:
- * True if a handle exists, or false otherwise
+ * Acquires a reference on the GEM buffer object's handle. Required
+ * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked()
+ * to release the reference.
  */
-bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj)
+void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj)
 {
 	struct drm_device *dev = obj->dev;
 
 	mutex_lock(&dev->object_name_lock);
 
-	/*
-	 * First ref taken during GEM object creation, if any. Some
-	 * drivers set up internal framebuffers with GEM objects that
-	 * do not have a GEM handle. Hence, this counter can be zero.
-	 */
-	if (!obj->handle_count) {
-		mutex_unlock(&dev->object_name_lock);
-		return false;
-	}
-
+	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
 	drm_gem_object_handle_get(obj);
 
 	mutex_unlock(&dev->object_name_lock);
-	return true;
 }
+EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);
 
 /**
  * drm_gem_object_handle_free - release resources bound to userspace handles
@@ -223,23 +223,34 @@
 }
 
 /**
- * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles
+ * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any
  * @obj: GEM object
  *
- * Acquires a reference on the GEM buffer object's handle. Required
- * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked()
- * to release the reference.
+ * Acquires a reference on the GEM buffer object's handle. Required to keep
+ * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked()
+ * to release the reference. Does nothing if the buffer object has no handle.
+ *
+ * Returns:
+ * True if a handle exists, or false otherwise
  */
-void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj)
+bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj)
 {
 	struct drm_device *dev = obj->dev;
 
 	guard(mutex)(&dev->object_name_lock);
 
-	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
+	/*
+	 * First ref taken during GEM object creation, if any. Some
+	 * drivers set up internal framebuffers with GEM objects that
+	 * do not have a GEM handle. Hence, this counter can be zero.
+	 */
+	if (!obj->handle_count)
+		return false;
+
 	drm_gem_object_handle_get(obj);
+
+	return true;
 }
-EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);
 
 /**
  * drm_gem_object_handle_free - release resources bound to userspace handles

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Upstream Linux Kernel Commit Check

• ⚠️ PR commit 049e1e615816 (net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull) does not reference a CVE but
  upstream commit 43ffe6caccc7 is associated with CVE-2023-53104

This is an automated message from the kernel commit checker workflow.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 11f7a1eb1073 (drm/gem: Acquire references on GEM handles for framebuffers) → upstream 5307dce878d4
  Differences found:

diff -u b/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
--- b/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -204,12 +204,10 @@
 {
 	struct drm_device *dev = obj->dev;
 
-	mutex_lock(&dev->object_name_lock);
+	guard(mutex)(&dev->object_name_lock);
 
 	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
 	drm_gem_object_handle_get(obj);
-
-	mutex_unlock(&dev->object_name_lock);
 }
 EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);

• ⚠️ PR commit 6d1b009002ca (drm/framebuffer: Acquire internal references on GEM handles) → upstream f6bfc9afc751
  Differences found:

diff -u b/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
--- b/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -193,37 +193,25 @@
 }
 
 /**
- * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any
+ * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles
  * @obj: GEM object
  *
- * Acquires a reference on the GEM buffer object's handle. Required to keep
- * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked()
- * to release the reference. Does nothing if the buffer object has no handle.
- *
- * Returns:
- * True if a handle exists, or false otherwise
+ * Acquires a reference on the GEM buffer object's handle. Required
+ * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked()
+ * to release the reference.
  */
-bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj)
+void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj)
 {
 	struct drm_device *dev = obj->dev;
 
 	mutex_lock(&dev->object_name_lock);
 
-	/*
-	 * First ref taken during GEM object creation, if any. Some
-	 * drivers set up internal framebuffers with GEM objects that
-	 * do not have a GEM handle. Hence, this counter can be zero.
-	 */
-	if (!obj->handle_count) {
-		mutex_unlock(&dev->object_name_lock);
-		return false;
-	}
-
+	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
 	drm_gem_object_handle_get(obj);
 
 	mutex_unlock(&dev->object_name_lock);
-	return true;
 }
+EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);
 
 /**
  * drm_gem_object_handle_free - release resources bound to userspace handles
@@ -223,23 +223,34 @@
 }
 
 /**
- * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles
+ * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any
  * @obj: GEM object
  *
- * Acquires a reference on the GEM buffer object's handle. Required
- * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked()
- * to release the reference.
+ * Acquires a reference on the GEM buffer object's handle. Required to keep
+ * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked()
+ * to release the reference. Does nothing if the buffer object has no handle.
+ *
+ * Returns:
+ * True if a handle exists, or false otherwise
  */
-void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj)
+bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj)
 {
 	struct drm_device *dev = obj->dev;
 
 	guard(mutex)(&dev->object_name_lock);
 
-	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
+	/*
+	 * First ref taken during GEM object creation, if any. Some
+	 * drivers set up internal framebuffers with GEM objects that
+	 * do not have a GEM handle. Hence, this counter can be zero.
+	 */
+	if (!obj->handle_count)
+		return false;
+
 	drm_gem_object_handle_get(obj);
+
+	return true;
 }
-EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);
 
 /**
  * drm_gem_object_handle_free - release resources bound to userspace handles

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Upstream Linux Kernel Commit Check

• ⚠️ PR commit 049e1e615816 (net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull) does not reference a CVE but
  upstream commit 43ffe6caccc7 is associated with CVE-2023-53104

This is an automated message from the kernel commit checker workflow.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 11f7a1eb1073 (drm/gem: Acquire references on GEM handles for framebuffers) → upstream 5307dce878d4
  Differences found:

diff -u b/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
--- b/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -204,12 +204,10 @@
 {
 	struct drm_device *dev = obj->dev;
 
-	mutex_lock(&dev->object_name_lock);
+	guard(mutex)(&dev->object_name_lock);
 
 	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
 	drm_gem_object_handle_get(obj);
-
-	mutex_unlock(&dev->object_name_lock);
 }
 EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);

• ⚠️ PR commit 6d1b009002ca (drm/framebuffer: Acquire internal references on GEM handles) → upstream f6bfc9afc751
  Differences found:

diff -u b/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
--- b/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -193,37 +193,25 @@
 }
 
 /**
- * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any
+ * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles
  * @obj: GEM object
  *
- * Acquires a reference on the GEM buffer object's handle. Required to keep
- * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked()
- * to release the reference. Does nothing if the buffer object has no handle.
- *
- * Returns:
- * True if a handle exists, or false otherwise
+ * Acquires a reference on the GEM buffer object's handle. Required
+ * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked()
+ * to release the reference.
  */
-bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj)
+void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj)
 {
 	struct drm_device *dev = obj->dev;
 
 	mutex_lock(&dev->object_name_lock);
 
-	/*
-	 * First ref taken during GEM object creation, if any. Some
-	 * drivers set up internal framebuffers with GEM objects that
-	 * do not have a GEM handle. Hence, this counter can be zero.
-	 */
-	if (!obj->handle_count) {
-		mutex_unlock(&dev->object_name_lock);
-		return false;
-	}
-
+	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
 	drm_gem_object_handle_get(obj);
 
 	mutex_unlock(&dev->object_name_lock);
-	return true;
 }
+EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);
 
 /**
  * drm_gem_object_handle_free - release resources bound to userspace handles
@@ -223,23 +223,34 @@
 }
 
 /**
- * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles
+ * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any
  * @obj: GEM object
  *
- * Acquires a reference on the GEM buffer object's handle. Required
- * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked()
- * to release the reference.
+ * Acquires a reference on the GEM buffer object's handle. Required to keep
+ * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked()
+ * to release the reference. Does nothing if the buffer object has no handle.
+ *
+ * Returns:
+ * True if a handle exists, or false otherwise
  */
-void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj)
+bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj)
 {
 	struct drm_device *dev = obj->dev;
 
 	guard(mutex)(&dev->object_name_lock);
 
-	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
+	/*
+	 * First ref taken during GEM object creation, if any. Some
+	 * drivers set up internal framebuffers with GEM objects that
+	 * do not have a GEM handle. Hence, this counter can be zero.
+	 */
+	if (!obj->handle_count)
+		return false;
+
 	drm_gem_object_handle_get(obj);
+
+	return true;
 }
-EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);
 
 /**
  * drm_gem_object_handle_free - release resources bound to userspace handles

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit ecf0891583a3 (HID: core: Harden s32ton() against conversion to 0 bits) → upstream a6b87bfc2ab5
  Differences found:

diff -u b/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
--- b/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -66,8 +66,12 @@
 
 static u32 s32ton(__s32 value, unsigned int n)
 {
-	s32 a = value >> (n - 1);
+	s32 a;
 
+	if (!value || !n)
+		return 0;
+
+	a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);
@@ -1338,12 +1338,7 @@
 
 static u32 s32ton(__s32 value, unsigned n)
 {
-	s32 a;
-
-	if (!value || !n)
-		return 0;
-
-	a = value >> (n - 1);
+	s32 a = value >> (n - 1);
 	if (a && a != -1)
 		return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 	return value & ((1 << n) - 1);

• ⚠️ PR commit dbc0be4e25ae (tls: fix handling of zero-length records on the rx_list) → upstream 62708b9452f8
  Differences found:

reverted:
--- b/fs/cifs/cifsencrypt.c
+++ a/fs/cifs/cifsencrypt.c
@@ -679,7 +679,7 @@
 unlock:
 	cifs_server_unlock(ses->server);
 setup_ntlmv2_rsp_ret:
+	kfree(tiblob);
-	kfree_sensitive(tiblob);
 
 	return rc;
 }
@@ -753,14 +753,14 @@
 		server->secmech.ccmaesdecrypt = NULL;
 	}
 
+	kfree(server->secmech.sdesccmacaes);
-	kfree_sensitive(server->secmech.sdesccmacaes);
 	server->secmech.sdesccmacaes = NULL;
+	kfree(server->secmech.sdeschmacsha256);
-	kfree_sensitive(server->secmech.sdeschmacsha256);
 	server->secmech.sdeschmacsha256 = NULL;
+	kfree(server->secmech.sdeschmacmd5);
-	kfree_sensitive(server->secmech.sdeschmacmd5);
 	server->secmech.sdeschmacmd5 = NULL;
+	kfree(server->secmech.sdescmd5);
-	kfree_sensitive(server->secmech.sdescmd5);
 	server->secmech.sdescmd5 = NULL;
+	kfree(server->secmech.sdescsha512);
-	kfree_sensitive(server->secmech.sdescsha512);
 	server->secmech.sdescsha512 = NULL;
 }
reverted:
--- b/fs/cifs/connect.c
+++ a/fs/cifs/connect.c
@@ -288,7 +288,7 @@
 	}
 	server->sequence_number = 0;
 	server->session_estab = false;
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	server->lstrp = jiffies;
@@ -1562,7 +1562,7 @@
 
 	cifs_crypto_secmech_release(server);
 
+	kfree(server->session_key.response);
-	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
 	kfree(server->hostname);
@@ -4097,7 +4097,7 @@
 		if (ses->auth_key.response) {
 			cifs_dbg(FYI, "Free previous auth_key.response = %p\n",
 				 ses->auth_key.response);
+			kfree(ses->auth_key.response);
-			kfree_sensitive(ses->auth_key.response);
 			ses->auth_key.response = NULL;
 			ses->auth_key.len = 0;
 		}
reverted:
--- b/fs/cifs/fs_context.c
+++ a/fs/cifs/fs_context.c
@@ -789,13 +789,6 @@
 	cifs_sb->ctx->field = NULL;					\
 } while (0)
 
-#define STEAL_STRING_SENSITIVE(cifs_sb, ctx, field)			\
-do {									\
-	kfree_sensitive(ctx->field);					\
-	ctx->field = cifs_sb->ctx->field;				\
-	cifs_sb->ctx->field = NULL;					\
-} while (0)
-
 static int smb3_reconfigure(struct fs_context *fc)
 {
 	struct smb3_fs_context *ctx = smb3_fc2context(fc);
@@ -816,7 +809,7 @@
 	STEAL_STRING(cifs_sb, ctx, UNC);
 	STEAL_STRING(cifs_sb, ctx, source);
 	STEAL_STRING(cifs_sb, ctx, username);
+	STEAL_STRING(cifs_sb, ctx, password);
-	STEAL_STRING_SENSITIVE(cifs_sb, ctx, password);
 	STEAL_STRING(cifs_sb, ctx, domainname);
 	STEAL_STRING(cifs_sb, ctx, nodename);
 	STEAL_STRING(cifs_sb, ctx, iocharset);
@@ -1157,7 +1150,7 @@
 		}
 		break;
 	case Opt_pass:
+		kfree(ctx->password);
-		kfree_sensitive(ctx->password);
 		ctx->password = NULL;
 		if (strlen(param->string) == 0)
 			break;
@@ -1465,7 +1458,6 @@
 	return 0;
 
  cifs_parse_mount_err:
-	kfree_sensitive(ctx->password);
 	return -EINVAL;
 }
 
reverted:
--- b/fs/cifs/misc.c
+++ a/fs/cifs/misc.c
@@ -1118,7 +1118,7 @@
 void
 cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc)
 {
+	kfree(*sdesc);
-	kfree_sensitive(*sdesc);
 	*sdesc = NULL;
 	if (*shash)
 		crypto_free_shash(*shash);
reverted:
--- b/fs/cifs/sess.c
+++ a/fs/cifs/sess.c
@@ -1211,12 +1211,6 @@
 static void
 sess_free_buffer(struct sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 3; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
 
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
@@ -1378,7 +1372,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1517,7 +1511,7 @@
 	sess_data->result = rc;
 	sess_data->func = NULL;
 	sess_free_buffer(sess_data);
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
 }
 
@@ -1652,7 +1646,7 @@
 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1662,9 +1656,9 @@
 	}
 
 	/* Else error. Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1763,7 +1757,7 @@
 	}
 
 out_free_ntlmsspblob:
+	kfree(ntlmsspblob);
-	kfree_sensitive(ntlmsspblob);
 out:
 	sess_free_buffer(sess_data);
 
@@ -1771,9 +1765,9 @@
 		rc = sess_establish_session(sess_data);
 
 	/* Cleanup */
+	kfree(ses->auth_key.response);
-	kfree_sensitive(ses->auth_key.response);
 	ses->auth_key.response = NULL;
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 
 	sess_data->func = NULL;
@@ -1849,7 +1843,7 @@
 	rc = sess_data->result;
 
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }
 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
reverted:
--- b/fs/cifs/smb2ops.c
+++ a/fs/cifs/smb2ops.c
@@ -4390,11 +4390,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
+	kfree(iv);
-	kfree_sensitive(iv);
 free_sg:
+	kfree(sg);
-	kfree_sensitive(sg);
 free_req:
+	kfree(req);
-	kfree_sensitive(req);
 	return rc;
 }
 
reverted:
--- b/fs/cifs/smb2pdu.c
+++ a/fs/cifs/smb2pdu.c
@@ -1333,13 +1333,6 @@
 static void
 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
 {
-	int i;
-
-	/* zero the session data before freeing, as it might contain sensitive info (keys, etc) */
-	for (i = 0; i < 2; i++)
-		if (sess_data->iov[i].iov_base)
-			memzero_explicit(sess_data->iov[i].iov_base, sess_data->iov[i].iov_len);
-
 	free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
 	sess_data->buf0_type = CIFS_NO_BUFFER;
 }
@@ -1472,8 +1465,6 @@
 out_put_spnego_key:
 	key_invalidate(spnego_key);
 	key_put(spnego_key);
-	if (rc)
-		kfree_sensitive(ses->auth_key.response);
 out:
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1570,7 +1561,7 @@
 	}
 
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
 	if (!rc) {
 		sess_data->result = 0;
@@ -1578,7 +1569,7 @@
 		return;
 	}
 out_err:
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1654,9 +1645,9 @@
 	}
 #endif
 out:
+	kfree(ntlmssp_blob);
-	memzero_explicit(ntlmssp_blob, blob_length);
 	SMB2_sess_free_buffer(sess_data);
+	kfree(ses->ntlmssp);
-	kfree_sensitive(ses->ntlmssp);
 	ses->ntlmssp = NULL;
 	sess_data->result = rc;
 	sess_data->func = NULL;
@@ -1734,7 +1725,7 @@
 		cifs_server_dbg(VFS, "signing requested but authenticated as guest\n");
 	rc = sess_data->result;
 out:
+	kfree(sess_data);
-	kfree_sensitive(sess_data);
 	return rc;
 }

This is an automated interdiff check for backported commits.