diff options
| author | Thomas Huth <thuth@redhat.com> | 2026-09-10 14:32:54 +0200 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-10-14 14:38:13 -0400 |
| commit | c930a69fecb98fc058ad4d57f2d9bf2e11f318f3 (patch) | |
| tree | 828d81582ae0a9448309837c295c10b41de8e446 /net/bluetooth | |
| parent | 00b201656db41c9eeeed5ca92a4efb6d729ae58e (diff) | |
| download | linux-c930a69fecb98fc058ad4d57f2d9bf2e11f318f3.tar.gz linux-c930a69fecb98fc058ad4d57f2d9bf2e11f318f3.zip | |
Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()
smp_e() already clears the AES key in its "struct aes_enckey aes"
on the stack before leaving the function - but the very same
information is also available as raw key data in the tmp[] array,
so this should get cleared, too.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/smp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 2df303f6a38f..5c3bd4278386 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -366,7 +366,7 @@ static int smp_e(const u8 *k, u8 *r) err = aes_prepareenckey(&aes, tmp, 16); if (err) { BT_ERR("cipher setkey failed: %d", err); - return err; + goto out_clear; } /* Most significant octet of plaintextData corresponds to data[0] */ @@ -379,6 +379,8 @@ static int smp_e(const u8 *k, u8 *r) SMP_DBG("r %16phN", r); +out_clear: + memzero_explicit(tmp, sizeof(tmp)); memzero_explicit(&aes, sizeof(aes)); return err; } |