diff options
| author | Zilin Guan <zilin@seu.edu.cn> | 2025-05-23 11:01:56 +0000 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2025-06-11 11:36:56 +0200 |
| commit | f87586598fffac31afc1141471b789251b030a76 (patch) | |
| tree | 56469c522fad33f3b3764688ab7f493f50203b1a | |
| parent | 8d60350891b185553836ebea1c406078a69a56e4 (diff) | |
wifi: cfg80211: use kfree_sensitive() for connkeys cleanup
The nl80211_parse_connkeys() function currently uses kfree() to release
the 'result' structure in error handling paths. However, if an error
occurs due to result->def being less than 0, the 'result' structure may
contain sensitive information.
To prevent potential leakage of sensitive data, replace kfree() with
kfree_sensitive() when freeing 'result'. This change aligns with the
approach used in its caller, nl80211_join_ibss(), enhancing the overall
security of the wireless subsystem.
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Link: https://patch.msgid.link/20250523110156.4017111-1-zilin@seu.edu.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/wireless/nl80211.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index fd5f79266471..85f139016da2 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -1583,7 +1583,7 @@ nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, return result; error: - kfree(result); + kfree_sensitive(result); return ERR_PTR(err); } |