瀏覽代碼

qcacmn: Reset keys to zero after use

In functions that use key values, reset the local variables (key) to
zero after use to avoid security vulnerability.

Change-Id: I105b1abf7c707102ef99bbe4fa213708039d933e
CRs-fixed: 2581402
Pooventhiran G 5 年之前
父節點
當前提交
9a1b59247c
共有 2 個文件被更改,包括 5 次插入0 次删除
  1. 2 0
      target_if/crypto/src/target_if_crypto.c
  2. 3 0
      umac/cmn_services/crypto/src/wlan_crypto_global_api.c

+ 2 - 0
target_if/crypto/src/target_if_crypto.c

@@ -220,6 +220,8 @@ QDF_STATUS target_if_crypto_set_key(struct wlan_objmgr_vdev *vdev,
 			   &params.key_rsc_ctr, sizeof(uint64_t));
 			   &params.key_rsc_ctr, sizeof(uint64_t));
 	status = wmi_unified_setup_install_key_cmd(pdev_wmi_handle, &params);
 	status = wmi_unified_setup_install_key_cmd(pdev_wmi_handle, &params);
 
 
+	/* Zero-out local key variables */
+	qdf_mem_zero(&params, sizeof(struct set_key_params));
 	return status;
 	return status;
 }
 }
 
 

+ 3 - 0
umac/cmn_services/crypto/src/wlan_crypto_global_api.c

@@ -1104,6 +1104,9 @@ QDF_STATUS wlan_crypto_delkey(struct wlan_objmgr_vdev *vdev,
 				qdf_mem_free(key->private);
 				qdf_mem_free(key->private);
 		}
 		}
 	}
 	}
+
+	/* Zero-out local key variables */
+	qdf_mem_zero(key, sizeof(struct wlan_crypto_key));
 	qdf_mem_free(key);
 	qdf_mem_free(key);
 
 
 	return QDF_STATUS_SUCCESS;
 	return QDF_STATUS_SUCCESS;