Commit 0dc33c65 authored by Antoine Tenart's avatar Antoine Tenart Committed by David S. Miller
Browse files

net: phy: mscc: macsec: do not copy encryption keys 



Following 1b16b3fd ("net: phy: mscc: macsec: clear encryption keys when freeing a flow"),
go one step further and instead of calling memzero_explicit on the key
when freeing a flow, simply not copy the key in the first place as it's
only used when a new flow is set up.

Signed-off-by: default avatarAntoine Tenart <atenart@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a452d30f

drivers/net/phy/mscc/mscc_macsec.c

+30 −27
Original line number Diff line number Diff line
@@ -501,8 +501,7 @@ static u32 vsc8584_macsec_flow_context_id(struct macsec_flow *flow) 
}



/* Derive the AES key to get a key for the hash autentication */

static int vsc8584_macsec_derive_key(const u8 key[MACSEC_MAX_KEY_LEN],

				     u16 key_len, u8 hkey[16])

static int vsc8584_macsec_derive_key(const u8 *key, u16 key_len, u8 hkey[16])

{

	const u8 input[AES_BLOCK_SIZE] = {0};

	struct crypto_aes_ctx ctx;
@@ -518,7 +517,8 @@ static int vsc8584_macsec_derive_key(const u8 key[MACSEC_MAX_KEY_LEN], 
}



static int vsc8584_macsec_transformation(struct phy_device *phydev,

					 struct macsec_flow *flow)

					 struct macsec_flow *flow,

					 const u8 *key)

{

	struct vsc8531_private *priv = phydev->priv;

	enum macsec_bank bank = flow->bank;
@@ -527,7 +527,7 @@ static int vsc8584_macsec_transformation(struct phy_device *phydev, 
	u8 hkey[16];

	u64 sci;



	ret = vsc8584_macsec_derive_key(flow->key, priv->secy->key_len, hkey);

	ret = vsc8584_macsec_derive_key(key, priv->secy->key_len, hkey);

	if (ret)

		return ret;
@@ -563,7 +563,7 @@ static int vsc8584_macsec_transformation(struct phy_device *phydev, 
	for (i = 0; i < priv->secy->key_len / sizeof(u32); i++)

		vsc8584_macsec_phy_write(phydev, bank,

					 MSCC_MS_XFORM_REC(index, rec++),

					 ((u32 *)flow->key)[i]);

					 ((u32 *)key)[i]);



	/* Set the authentication key */

	for (i = 0; i < 4; i++)
@@ -632,28 +632,14 @@ static void vsc8584_macsec_free_flow(struct vsc8531_private *priv, 


	list_del(&flow->list);

	clear_bit(flow->index, bitmap);

	memzero_explicit(flow->key, sizeof(flow->key));

	kfree(flow);

}



static int vsc8584_macsec_add_flow(struct phy_device *phydev,

				   struct macsec_flow *flow, bool update)

static void vsc8584_macsec_add_flow(struct phy_device *phydev,

				    struct macsec_flow *flow)

{

	int ret;



	flow->port = MSCC_MS_PORT_CONTROLLED;

	vsc8584_macsec_flow(phydev, flow);



	if (update)

		return 0;



	ret = vsc8584_macsec_transformation(phydev, flow);

	if (ret) {

		vsc8584_macsec_free_flow(phydev->priv, flow);

		return ret;

	}



	return 0;

}



static int vsc8584_macsec_default_flows(struct phy_device *phydev)
@@ -706,6 +692,7 @@ static int __vsc8584_macsec_add_rxsa(struct macsec_context *ctx, 
{

	struct phy_device *phydev = ctx->phydev;

	struct vsc8531_private *priv = phydev->priv;

	int ret;



	flow->assoc_num = ctx->sa.assoc_num;

	flow->rx_sa = ctx->sa.rx_sa;
@@ -717,19 +704,39 @@ static int __vsc8584_macsec_add_rxsa(struct macsec_context *ctx, 
	if (priv->secy->validate_frames != MACSEC_VALIDATE_DISABLED)

		flow->match.untagged = 1;



	return vsc8584_macsec_add_flow(phydev, flow, update);

	vsc8584_macsec_add_flow(phydev, flow);



	if (update)

		return 0;



	ret = vsc8584_macsec_transformation(phydev, flow, ctx->sa.key);

	if (ret)

		vsc8584_macsec_free_flow(phydev->priv, flow);



	return ret;

}



static int __vsc8584_macsec_add_txsa(struct macsec_context *ctx,

				     struct macsec_flow *flow, bool update)

{

	int ret;



	flow->assoc_num = ctx->sa.assoc_num;

	flow->tx_sa = ctx->sa.tx_sa;



	/* Always match untagged packets on egress */

	flow->match.untagged = 1;



	return vsc8584_macsec_add_flow(ctx->phydev, flow, update);

	vsc8584_macsec_add_flow(ctx->phydev, flow);



	if (update)

		return 0;



	ret = vsc8584_macsec_transformation(ctx->phydev, flow, ctx->sa.key);

	if (ret)

		vsc8584_macsec_free_flow(ctx->phydev->priv, flow);



	return ret;

}



static int vsc8584_macsec_dev_open(struct macsec_context *ctx)
@@ -829,8 +836,6 @@ static int vsc8584_macsec_add_rxsa(struct macsec_context *ctx) 
	if (IS_ERR(flow))

		return PTR_ERR(flow);



	memcpy(flow->key, ctx->sa.key, priv->secy->key_len);



	ret = __vsc8584_macsec_add_rxsa(ctx, flow, false);

	if (ret)

		return ret;
@@ -882,8 +887,6 @@ static int vsc8584_macsec_add_txsa(struct macsec_context *ctx) 
	if (IS_ERR(flow))

		return PTR_ERR(flow);



	memcpy(flow->key, ctx->sa.key, priv->secy->key_len);



	ret = __vsc8584_macsec_add_txsa(ctx, flow, false);

	if (ret)

		return ret;

drivers/net/phy/mscc/mscc_macsec.h

+0 −2
Original line number Diff line number Diff line
@@ -81,8 +81,6 @@ struct macsec_flow { 
	/* Highest takes precedence [0..15] */

	u8 priority;



	u8 key[MACSEC_MAX_KEY_LEN];



	union {

		struct macsec_rx_sa *rx_sa;

		struct macsec_tx_sa *tx_sa;