net: atlantic: macsec: clear encryption keys from the stack

Commit aaab73f8fba4 ("macsec: clear encryption keys from the stack after
setting up offload") made sure to clean encryption keys from the stack
after setting up offloading, but the atlantic driver made a copy and did
not clear it. Fix this.

[4 Fixes tags below, all part of the same series, no need to split this]

Fixes: 9ff40a751a6f ("net: atlantic: MACSec ingress offload implementation")
Fixes: b8f8a0b7b5cb ("net: atlantic: MACSec ingress offload HW bindings")
Fixes: 27736563ce32 ("net: atlantic: MACSec egress offload implementation")
Fixes: 9d106c6dd81b ("net: atlantic: MACSec egress offload HW bindings")
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c b/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c
index a0180811305dc8bc3a793342a7328913d12a126b..7eb5851eb95dc3f8a948dc2783489aca6dd45530 100644 (file)
--- a/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c
@@ -570,6 +570,7 @@ static int aq_update_txsa(struct aq_nic_s *nic, const unsigned int sc_idx,
 
        ret = aq_mss_set_egress_sakey_record(hw, &key_rec, sa_idx);
 
+       memzero_explicit(&key_rec, sizeof(key_rec));
        return ret;
 }
 
@@ -899,6 +900,7 @@ static int aq_update_rxsa(struct aq_nic_s *nic, const unsigned int sc_idx,
 
        ret = aq_mss_set_ingress_sakey_record(hw, &sa_key_record, sa_idx);
 
+       memzero_explicit(&sa_key_record, sizeof(sa_key_record));
        return ret;
 }
 

diff --git a/drivers/net/ethernet/aquantia/atlantic/macsec/macsec_api.c b/drivers/net/ethernet/aquantia/atlantic/macsec/macsec_api.c
index 36c7cf05630a1ea4711cde2d1a88d7a0050ed0d0..4319249595207c0a7cca9c479a9465bc7f2548a2 100644 (file)
--- a/drivers/net/ethernet/aquantia/atlantic/macsec/macsec_api.c
+++ b/drivers/net/ethernet/aquantia/atlantic/macsec/macsec_api.c
@@ -757,6 +757,7 @@ set_ingress_sakey_record(struct aq_hw_s *hw,
                         u16 table_index)
 {
        u16 packed_record[18];
+       int ret;
 
        if (table_index >= NUMROWS_INGRESSSAKEYRECORD)
                return -EINVAL;
@@ -789,9 +790,12 @@ set_ingress_sakey_record(struct aq_hw_s *hw,
 
        packed_record[16] = rec->key_len & 0x3;
 
-       return set_raw_ingress_record(hw, packed_record, 18, 2,
-                                     ROWOFFSET_INGRESSSAKEYRECORD +
-                                             table_index);
+       ret = set_raw_ingress_record(hw, packed_record, 18, 2,
+                                    ROWOFFSET_INGRESSSAKEYRECORD +
+                                    table_index);
+
+       memzero_explicit(packed_record, sizeof(packed_record));
+       return ret;
 }
 
 int aq_mss_set_ingress_sakey_record(struct aq_hw_s *hw,
@@ -1739,14 +1743,14 @@ static int set_egress_sakey_record(struct aq_hw_s *hw,
        ret = set_raw_egress_record(hw, packed_record, 8, 2,
                                    ROWOFFSET_EGRESSSAKEYRECORD + table_index);
        if (unlikely(ret))
-               return ret;
+               goto clear_key;
        ret = set_raw_egress_record(hw, packed_record + 8, 8, 2,
                                    ROWOFFSET_EGRESSSAKEYRECORD + table_index -
                                            32);
-       if (unlikely(ret))
-               return ret;
 
-       return 0;
+clear_key:
+       memzero_explicit(packed_record, sizeof(packed_record));
+       return ret;
 }
 
 int aq_mss_set_egress_sakey_record(struct aq_hw_s *hw,