diff options
| author | David S. Miller <davem@davemloft.net> | 2018-09-13 12:03:47 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-09-13 12:03:47 -0700 |
| commit | 79140335ac12e71d9270dabe030274a297d8a2cf (patch) | |
| tree | 909dc26b18e1ee20e6fcac8936b4bcaa1bfa9eeb /net/tls/tls_device.c | |
| parent | f0e0d04413fcce9bc76388839099aee93cd0d33b (diff) | |
| parent | c844eb46b7d43c2cf760169df5ae1d5b033af338 (diff) | |
Merge branch 'tls-don-t-leave-keys-in-kernel-memory'
Sabrina Dubroca says:
====================
tls: don't leave keys in kernel memory
There are a few places where the RX/TX key for a TLS socket is copied
to kernel memory. This series clears those memory areas when they're no
longer needed.
v2: add union tls_crypto_context, following Vakul Garg's comment
swap patch 2 and 3, using new union in patch 3
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tls/tls_device.c')
| -rw-r--r-- | net/tls/tls_device.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c index 292742e50bfa..961b07d4d41c 100644 --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -686,7 +686,7 @@ int tls_set_device_offload(struct sock *sk, struct tls_context *ctx) goto free_marker_record; } - crypto_info = &ctx->crypto_send; + crypto_info = &ctx->crypto_send.info; switch (crypto_info->cipher_type) { case TLS_CIPHER_AES_GCM_128: nonce_size = TLS_CIPHER_AES_GCM_128_IV_SIZE; @@ -780,7 +780,7 @@ int tls_set_device_offload(struct sock *sk, struct tls_context *ctx) ctx->priv_ctx_tx = offload_ctx; rc = netdev->tlsdev_ops->tls_dev_add(netdev, sk, TLS_OFFLOAD_CTX_DIR_TX, - &ctx->crypto_send, + &ctx->crypto_send.info, tcp_sk(sk)->write_seq); if (rc) goto release_netdev; @@ -862,7 +862,7 @@ int tls_set_device_offload_rx(struct sock *sk, struct tls_context *ctx) goto release_ctx; rc = netdev->tlsdev_ops->tls_dev_add(netdev, sk, TLS_OFFLOAD_CTX_DIR_RX, - &ctx->crypto_recv, + &ctx->crypto_recv.info, tcp_sk(sk)->copied_seq); if (rc) { pr_err_ratelimited("%s: The netdev has refused to offload this socket\n", |