History

cfg80211: don't put kek/kck/replay counter on the stack

There's no need to put the values on the stack, just pass a pointer to the data in the nl80211 message. This reduces stack usage and avoids potential issues with putting sensitive data on the stack.

Johannes Berg committed 12 years ago

Commit 78f686c1 parent 538c9eb2 files · +7 −13Browse files

Unified · Split

2 files
  1. include/net/cfg80211.h +4 −6
  2. net/wireless/nl80211.c +3 −7
include/net/cfg80211.h+4−6
@@ -1980,14 +1980,12 @@ struct cfg80211_wowlan_wakeup { · 1979 unmodified lines
1980 1980
1981/**1981/**
1982 * struct cfg80211_gtk_rekey_data - rekey data1982 * struct cfg80211_gtk_rekey_data - rekey data
1983 * @kek: key encryption key1983 * @kek: key encryption key (NL80211_KEK_LEN bytes)
1984 * @kck: key confirmation key1984 * @kck: key confirmation key (NL80211_KCK_LEN bytes)
1985 * @replay_ctr: replay counter1985 * @replay_ctr: replay counter (NL80211_REPLAY_CTR_LEN bytes)
1986 */1986 */
1987struct cfg80211_gtk_rekey_data {1987struct cfg80211_gtk_rekey_data {
1988 u8 kek[NL80211_KEK_LEN];1988 const u8 *kek, *kck, *replay_ctr;
1989 u8 kck[NL80211_KCK_LEN];
1990 u8 replay_ctr[NL80211_REPLAY_CTR_LEN];
1991};1989};
1992 1990
1993/**1991/**
net/wireless/nl80211.c+3−7
@@ -8959,13 +8959,9 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) · 8958 unmodified lines
8959 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)8959 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8960 return -ERANGE;8960 return -ERANGE;
8961 8961
8962 memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),8962 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
8963 NL80211_KEK_LEN);8963 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
8964 memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),8964 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
8965 NL80211_KCK_LEN);
8966 memcpy(rekey_data.replay_ctr,
8967 nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8968 NL80211_REPLAY_CTR_LEN);
8969 8965
8970 wdev_lock(wdev);8966 wdev_lock(wdev);
8971 if (!wdev->current_bss) {8967 if (!wdev->current_bss) {