[PATCH] Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()
From: Thomas Huth <hidden>
Date: 2026-09-10 12:33:01
Also in:
lkml
Subsystem:
bluetooth subsystem, the rest · Maintainers:
Marcel Holtmann, Luiz Augusto von Dentz, Linus Torvalds
smp_e() already clears the AES key in its "struct aes_enckey aes" on the stack before leaving the function - but the very same information is also available as raw key data in the tmp[] array, so this should get cleared, too. Signed-off-by: Thomas Huth <redacted> --- net/bluetooth/smp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 6091c47cb0028..637bf134dfbd9 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c@@ -366,7 +366,7 @@ static int smp_e(const u8 *k, u8 *r) err = aes_prepareenckey(&aes, tmp, 16); if (err) { BT_ERR("cipher setkey failed: %d", err); - return err; + goto out_clear; } /* Most significant octet of plaintextData corresponds to data[0] */
@@ -379,6 +379,8 @@ static int smp_e(const u8 *k, u8 *r) SMP_DBG("r %16phN", r); +out_clear: + memzero_explicit(tmp, sizeof(tmp)); memzero_explicit(&aes, sizeof(aes)); return err; }
--
2.55.0