iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: phy: mscc: macsec: do not copy encryption keys

Browse Source 
Following 1b16b3fdf675 ("net: phy: mscc: macsec: clear encryption keys when freeing a flow"),
go one step further and instead of calling memzero_explicit on the key
when freeing a flow, simply not copy the key in the first place as it's
only used when a new flow is set up.

Signed-off-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Antoine Tenart 2022-11-15 16:44:51 +01:00 committed by David S. Miller
parent a452d30f3f
commit 0dc33c6583
2 changed files with 30 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
drivers/net/phy/mscc/mscc_macsec.c
View File

@ -501,8 +501,7 @@ static u32 vsc8584_macsec_flow_context_id(struct macsec_flow *flow)
}
/* Derive the AES key to get a key for the hash autentication */
static int vsc8584_macsec_derive_key(const u8 key[MACSEC_MAX_KEY_LEN],
u16 key_len, u8 hkey[16])
static int vsc8584_macsec_derive_key(const u8 *key, u16 key_len, u8 hkey[16])
{
const u8 input[AES_BLOCK_SIZE] = {0};
struct crypto_aes_ctx ctx;
@ -518,7 +517,8 @@ static int vsc8584_macsec_derive_key(const u8 key[MACSEC_MAX_KEY_LEN],
}
static int vsc8584_macsec_transformation(struct phy_device *phydev,
struct macsec_flow *flow)
struct macsec_flow *flow,
const u8 *key)
{
struct vsc8531_private *priv = phydev->priv;
enum macsec_bank bank = flow->bank;
@ -527,7 +527,7 @@ static int vsc8584_macsec_transformation(struct phy_device *phydev,
u8 hkey[16];
u64 sci;
ret = vsc8584_macsec_derive_key(flow->key, priv->secy->key_len, hkey);
ret = vsc8584_macsec_derive_key(key, priv->secy->key_len, hkey);
if (ret)
return ret;
@ -563,7 +563,7 @@ static int vsc8584_macsec_transformation(struct phy_device *phydev,
for (i = 0; i < priv->secy->key_len / sizeof(u32); i++)
vsc8584_macsec_phy_write(phydev, bank,
MSCC_MS_XFORM_REC(index, rec++),
((u32 *)flow->key)[i]);
((u32 *)key)[i]);
/* Set the authentication key */
for (i = 0; i < 4; i++)
@ -632,28 +632,14 @@ static void vsc8584_macsec_free_flow(struct vsc8531_private *priv,
list_del(&flow->list);
clear_bit(flow->index, bitmap);
memzero_explicit(flow->key, sizeof(flow->key));
kfree(flow);
}
static int vsc8584_macsec_add_flow(struct phy_device *phydev,
struct macsec_flow *flow, bool update)
static void vsc8584_macsec_add_flow(struct phy_device *phydev,
struct macsec_flow *flow)
{
int ret;
flow->port = MSCC_MS_PORT_CONTROLLED;
vsc8584_macsec_flow(phydev, flow);
if (update)
return 0;
ret = vsc8584_macsec_transformation(phydev, flow);
if (ret) {
vsc8584_macsec_free_flow(phydev->priv, flow);
return ret;
}
return 0;
}
static int vsc8584_macsec_default_flows(struct phy_device *phydev)
@ -706,6 +692,7 @@ static int __vsc8584_macsec_add_rxsa(struct macsec_context *ctx,
{
struct phy_device *phydev = ctx->phydev;
struct vsc8531_private *priv = phydev->priv;
int ret;
flow->assoc_num = ctx->sa.assoc_num;
flow->rx_sa = ctx->sa.rx_sa;
@ -717,19 +704,39 @@ static int __vsc8584_macsec_add_rxsa(struct macsec_context *ctx,
if (priv->secy->validate_frames != MACSEC_VALIDATE_DISABLED)
flow->match.untagged = 1;
return vsc8584_macsec_add_flow(phydev, flow, update);
vsc8584_macsec_add_flow(phydev, flow);
if (update)
return 0;
ret = vsc8584_macsec_transformation(phydev, flow, ctx->sa.key);
if (ret)
vsc8584_macsec_free_flow(phydev->priv, flow);
return ret;
}
static int __vsc8584_macsec_add_txsa(struct macsec_context *ctx,
struct macsec_flow *flow, bool update)
{
int ret;
flow->assoc_num = ctx->sa.assoc_num;
flow->tx_sa = ctx->sa.tx_sa;
/* Always match untagged packets on egress */
flow->match.untagged = 1;
return vsc8584_macsec_add_flow(ctx->phydev, flow, update);
vsc8584_macsec_add_flow(ctx->phydev, flow);
if (update)
return 0;
ret = vsc8584_macsec_transformation(ctx->phydev, flow, ctx->sa.key);
if (ret)
vsc8584_macsec_free_flow(ctx->phydev->priv, flow);
return ret;
}
static int vsc8584_macsec_dev_open(struct macsec_context *ctx)
@ -829,8 +836,6 @@ static int vsc8584_macsec_add_rxsa(struct macsec_context *ctx)
if (IS_ERR(flow))
return PTR_ERR(flow);
memcpy(flow->key, ctx->sa.key, priv->secy->key_len);
ret = __vsc8584_macsec_add_rxsa(ctx, flow, false);
if (ret)
return ret;
@ -882,8 +887,6 @@ static int vsc8584_macsec_add_txsa(struct macsec_context *ctx)
if (IS_ERR(flow))
return PTR_ERR(flow);
memcpy(flow->key, ctx->sa.key, priv->secy->key_len);
ret = __vsc8584_macsec_add_txsa(ctx, flow, false);
if (ret)
return ret;

2
drivers/net/phy/mscc/mscc_macsec.h
View File

@ -81,8 +81,6 @@ struct macsec_flow {
/* Highest takes precedence [0..15] */
u8 priority;
u8 key[MACSEC_MAX_KEY_LEN];
union {
struct macsec_rx_sa *rx_sa;
struct macsec_tx_sa *tx_sa;