[PATCH] Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()

[PATCH] Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()

[Thomas Huth]

smp_e() already clears the AES key in its "struct aes_enckey aes"
on the stack before leaving the function - but the very same
information is also available as raw key data in the tmp[] array,
so this should get cleared, too.

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 net/bluetooth/smp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 6091c47cb0028..637bf134dfbd9 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -366,7 +366,7 @@ static int smp_e(const u8 *k, u8 *r)
 	err = aes_prepareenckey(&aes, tmp, 16);
 	if (err) {
 		BT_ERR("cipher setkey failed: %d", err);
-		return err;
+		goto out_clear;
 	}
 
 	/* Most significant octet of plaintextData corresponds to data[0] */
@@ -379,6 +379,8 @@ static int smp_e(const u8 *k, u8 *r)
 
 	SMP_DBG("r %16phN", r);
 
+out_clear:
+	memzero_explicit(tmp, sizeof(tmp));
 	memzero_explicit(&aes, sizeof(aes));
 	return err;
 }
-- 
2.55.0

RE: Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1074 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1162047/

---Test result---

Test Summary:
CheckPatch                    PASS      0.49 seconds
VerifyFixes                   PASS      11.59 seconds
VerifySignedoff               PASS      2.08 seconds
GitLint                       PASS      0.25 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      22.52 seconds
CheckAllWarning               PASS      24.90 seconds
CheckSparse                   PASS      28.37 seconds
BuildKernel32                 PASS      21.87 seconds
CheckKernelLLVM               PASS      24.38 seconds
TestRunnerSetup               PASS      563.96 seconds
TestRunner_smp-tester         PASS      11.97 seconds
IncrementalBuild              PASS      21.06 seconds



https://github.com/bluez/bluetooth-next/pull/749

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 10 Sep 2026 14:32:54 +0200 you wrote:
> smp_e() already clears the AES key in its "struct aes_enckey aes"
> on the stack before leaving the function - but the very same
> information is also available as raw key data in the tmp[] array,
> so this should get cleared, too.
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> 
> [...]

Here is the summary with links:
  - Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()
    https://git.kernel.org/bluetooth/bluetooth-next/c/e40edfa049b9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html