diff options
| author | Thomas Huth <thuth@redhat.com> | 2026-09-10 14:32:54 +0200 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-09-15 15:44:52 -0400 |
| commit | eaa8746a14a699b0289d99335a4abf2dd27ca05b (patch) | |
| tree | 0fbc7c080fc4036e38830d05da2134d7e17b77e0 | |
| parent | 49fd31f69072ecee5b360400498a20b34e2cb9ad (diff) | |
| download | linux-next-eaa8746a14a699b0289d99335a4abf2dd27ca05b.tar.gz linux-next-eaa8746a14a699b0289d99335a4abf2dd27ca05b.zip | |
Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()
smp_e() already clears the AES key in its "struct aes_enckey aes"
on the stack before leaving the function - but the very same
information is also available as raw key data in the tmp[] array,
so this should get cleared, too.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
| -rw-r--r-- | net/bluetooth/smp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 6091c47cb002..637bf134dfbd 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -366,7 +366,7 @@ static int smp_e(const u8 *k, u8 *r) err = aes_prepareenckey(&aes, tmp, 16); if (err) { BT_ERR("cipher setkey failed: %d", err); - return err; + goto out_clear; } /* Most significant octet of plaintextData corresponds to data[0] */ @@ -379,6 +379,8 @@ static int smp_e(const u8 *k, u8 *r) SMP_DBG("r %16phN", r); +out_clear: + memzero_explicit(tmp, sizeof(tmp)); memzero_explicit(&aes, sizeof(aes)); return err; } |