Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5d4185ae authored by Johannes Berg's avatar Johannes Berg Committed by Emmanuel Grumbach
Browse files

iwlwifi: pcie: clear command data on freeing 



When freeing the structures used for command data, clear their
memory as they may have contained key material at some point.
Also clear the duplicated buffer when freeing it to be safe;
currently key material is never put there but that may change.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
parent c2a2b28b

drivers/net/wireless/iwlwifi/pcie/rx.c

+1 −1
Original line number Diff line number Diff line
@@ -640,7 +640,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans, 
		err = iwl_op_mode_rx(trans->op_mode, &rxcb, cmd);



		if (reclaim) {

			kfree(txq->entries[cmd_index].free_buf);

			kzfree(txq->entries[cmd_index].free_buf);

			txq->entries[cmd_index].free_buf = NULL;

		}

drivers/net/wireless/iwlwifi/pcie/tx.c

+3 −3
Original line number Diff line number Diff line
@@ -620,8 +620,8 @@ static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id) 
	/* De-alloc array of command/tx buffers */

	if (txq_id == trans_pcie->cmd_queue)

		for (i = 0; i < txq->q.n_window; i++) {

			kfree(txq->entries[i].cmd);

			kfree(txq->entries[i].free_buf);

			kzfree(txq->entries[i].cmd);

			kzfree(txq->entries[i].free_buf);

		}



	/* De-alloc circular buffer of TFDs */
@@ -1409,7 +1409,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans, 


	out_meta->flags = cmd->flags;

	if (WARN_ON_ONCE(txq->entries[idx].free_buf))

		kfree(txq->entries[idx].free_buf);

		kzfree(txq->entries[idx].free_buf);

	txq->entries[idx].free_buf = dup_buf;



	trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size, &out_cmd->hdr);