iwlwifi: pcie: clear command data on freeing

When freeing the structures used for command data, clear their
memory as they may have contained key material at some point.
Also clear the duplicated buffer when freeing it to be safe;
currently key material is never put there but that may change.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 702f47fb16fe6c30a1958fa1f7ae393e2dbec186..7b7e2f223fb230fad922e7fcaec08ec8ae7eb5ac 100644 (file)
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -640,7 +640,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                err = iwl_op_mode_rx(trans->op_mode, &rxcb, cmd);
 
                if (reclaim) {
-                       kfree(txq->entries[cmd_index].free_buf);
+                       kzfree(txq->entries[cmd_index].free_buf);
                        txq->entries[cmd_index].free_buf = NULL;
                }
 

diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 35fe38e52d2e53daf5bf5e260a057b9d9be08c82..eb8e2984c5e90f6d8f498e69b1cee4420dffb85d 100644 (file)
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -620,8 +620,8 @@ static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id)
        /* De-alloc array of command/tx buffers */
        if (txq_id == trans_pcie->cmd_queue)
                for (i = 0; i < txq->q.n_window; i++) {
-                       kfree(txq->entries[i].cmd);
-                       kfree(txq->entries[i].free_buf);
+                       kzfree(txq->entries[i].cmd);
+                       kzfree(txq->entries[i].free_buf);
                }
 
        /* De-alloc circular buffer of TFDs */
@@ -1409,7 +1409,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
 
        out_meta->flags = cmd->flags;
        if (WARN_ON_ONCE(txq->entries[idx].free_buf))
-               kfree(txq->entries[idx].free_buf);
+               kzfree(txq->entries[idx].free_buf);
        txq->entries[idx].free_buf = dup_buf;
 
        trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size, &out_cmd->hdr);