Bluetooth: ecdh_helper - fix leak of private key

tmp buffer contains the swapped private key. In case the setkey call
failed, the tmp buffer was freed without clearing the private key.

Zeroize the temporary buffer so we don't leak the private key.

Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/ecdh_helper.c b/net/bluetooth/ecdh_helper.c
index 22c8daa0b45116b2f3eeb6c99c9f8e8c2e9f9c4a..16e022f5ab276c8475d314b26366a5e57ce8c078 100644 (file)
--- a/net/bluetooth/ecdh_helper.c
+++ b/net/bluetooth/ecdh_helper.c
@@ -122,7 +122,7 @@ int compute_ecdh_secret(struct crypto_kpp *tfm, const u8 public_key[64],
 free_req:
        kpp_request_free(req);
 free_tmp:
-       kfree(tmp);
+       kzfree(tmp);
        return err;
 }