[PATCH] Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()

[PATCH] Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()

[Thomas Huth]

smp_e() already clears the AES key in its "struct aes_enckey aes"
on the stack before leaving the function - but the very same
information is also available as raw key data in the tmp[] array,
so this should get cleared, too.

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 net/bluetooth/smp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 6091c47cb0028..637bf134dfbd9 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -366,7 +366,7 @@ static int smp_e(const u8 *k, u8 *r)
 	err = aes_prepareenckey(&aes, tmp, 16);
 	if (err) {
 		BT_ERR("cipher setkey failed: %d", err);
-		return err;
+		goto out_clear;
 	}
 
 	/* Most significant octet of plaintextData corresponds to data[0] */
@@ -379,6 +379,8 @@ static int smp_e(const u8 *k, u8 *r)
 
 	SMP_DBG("r %16phN", r);
 
+out_clear:
+	memzero_explicit(tmp, sizeof(tmp));
 	memzero_explicit(&aes, sizeof(aes));
 	return err;
 }
-- 
2.55.0

Re: [PATCH] Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 10 Sep 2026 14:32:54 +0200 you wrote:
> smp_e() already clears the AES key in its "struct aes_enckey aes"
> on the stack before leaving the function - but the very same
> information is also available as raw key data in the tmp[] array,
> so this should get cleared, too.
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> 
> [...]

Here is the summary with links:
  - Bluetooth: SMP: Zeroize raw key data on the stack in smp_e()
    https://git.kernel.org/bluetooth/bluetooth-next/c/e40edfa049b9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html