tree c06fed3ffd9b7c9e8326acdfa5554a038803346a
parent c3830fca233beab7f7928024c288a4ad5e32b00b
author Luiz Augusto von Dentz <luiz.von.dentz@intel.com> 1696539599 -0700
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1698225213 +0200

Bluetooth: hci_event: Fix using memcmp when comparing keys

commit b541260615f601ae1b5d6d0cc54e790de706303b upstream.

memcmp is not consider safe to use with cryptographic secrets:

 'Do  not  use memcmp() to compare security critical data, such as
 cryptographic secrets, because the required CPU time depends on the
 number of equal bytes.'

While usage of memcmp for ZERO_KEY may not be considered a security
critical data, it can lead to more usage of memcmp with pairing keys
which could introduce more security problems.

Fixes: 455c2ff0a558 ("Bluetooth: Fix BR/EDR out-of-band pairing with only initiator data")
Fixes: 33155c4aae52 ("Bluetooth: hci_event: Ignore NULL link key")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>