From: Zilin Guan Date: Fri, 23 May 2025 11:01:56 +0000 (+0000) Subject: wifi: cfg80211: use kfree_sensitive() for connkeys cleanup X-Git-Tag: v6.16-rc2~20^2^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f87586598fffac31afc1141471b789251b030a76;p=thirdparty%2Fkernel%2Flinux.git wifi: cfg80211: use kfree_sensitive() for connkeys cleanup The nl80211_parse_connkeys() function currently uses kfree() to release the 'result' structure in error handling paths. However, if an error occurs due to result->def being less than 0, the 'result' structure may contain sensitive information. To prevent potential leakage of sensitive data, replace kfree() with kfree_sensitive() when freeing 'result'. This change aligns with the approach used in its caller, nl80211_join_ibss(), enhancing the overall security of the wireless subsystem. Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20250523110156.4017111-1-zilin@seu.edu.cn Signed-off-by: Johannes Berg --- diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index fd5f79266471..85f139016da2 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -1583,7 +1583,7 @@ nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, return result; error: - kfree(result); + kfree_sensitive(result); return ERR_PTR(err); }