Code that uses AES-CMAC might need to zeroize their local aes_cmac_key
and/or aes_cmac_ctx structures after use to avoid leaking sensitive
material on the stack.

The first patch introduces an aes_cmac_zeroize_key() and an
aes_cmac_zeroize_ctx() helper function that can be used with __cleanup()
to automatically clear the key and context when they go out of scope.

Patches 2 - 4 add the __cleanup markers to spots in the code that
missed to clean up the structures so far.

The final two patches are just cosmetics and change some memzero_explicit()
calls to use the __cleanup() way instead.

Note: There are more spots in the smb, tcp-ao and bluetooth code that
need some zeroization of sensitive data on the stack. I will tackle
those in later patches, this series here focuses on the new __cleanup
wrappers.

v2:
- Update comments and positions of the functions in the 1st patch
- Also clear tmp[] in the bluetooth patch (the patch is pointless otherwise)

Thomas Huth (6):
  crypto: Provide wrapper functions for zeroizing aes_cmac_key and
    aes_cmac_ctx
  smb: clear the aes_cmac_key and aes_cmac_ctx when done
  net/tcp-ao: clear the aes_cmac_key when done
  Bluetooth: SMP: clear the aes_cmac_key when done
  lib/crypto: aes: Use _cleanup() for aes_cmac_key instead of
    memzero_explicit()
  mac80211: fils_aead: Use _cleanup for aes_cmac_key instead of
    memzero_explicit

 fs/smb/client/smb2transport.c |  4 ++--
 fs/smb/server/auth.c          |  2 +-
 include/crypto/aes-cbc-macs.h | 34 ++++++++++++++++++++++++++++++++++
 lib/crypto/aes.c              |  3 +--
 net/bluetooth/smp.c           |  3 ++-
 net/ipv4/tcp_ao.c             |  2 +-
 net/mac80211/fils_aead.c      |  3 +--
 7 files changed, 42 insertions(+), 9 deletions(-)

-- 
2.55.0

On Fri, Aug 07, 2026 at 02:58:37PM +0200, Thomas Huth wrote:
> Code that uses AES-CMAC might need to zeroize their local aes_cmac_key
> and/or aes_cmac_ctx structures after use to avoid leaking sensitive
> material on the stack.
> 
> The first patch introduces an aes_cmac_zeroize_key() and an
> aes_cmac_zeroize_ctx() helper function that can be used with __cleanup()
> to automatically clear the key and context when they go out of scope.
> 
> Patches 2 - 4 add the __cleanup markers to spots in the code that
> missed to clean up the structures so far.
> 
> The final two patches are just cosmetics and change some memzero_explicit()
> calls to use the __cleanup() way instead.
> 
> Note: There are more spots in the smb, tcp-ao and bluetooth code that
> need some zeroization of sensitive data on the stack. I will tackle
> those in later patches, this series here focuses on the new __cleanup
> wrappers.
> 
> v2:
> - Update comments and positions of the functions in the 1st patch
> - Also clear tmp[] in the bluetooth patch (the patch is pointless otherwise)
> 
> Thomas Huth (6):
>   crypto: Provide wrapper functions for zeroizing aes_cmac_key and
>     aes_cmac_ctx
>   smb: clear the aes_cmac_key and aes_cmac_ctx when done
>   net/tcp-ao: clear the aes_cmac_key when done
>   Bluetooth: SMP: clear the aes_cmac_key when done
>   lib/crypto: aes: Use _cleanup() for aes_cmac_key instead of
>     memzero_explicit()
>   mac80211: fils_aead: Use _cleanup for aes_cmac_key instead of
>     memzero_explicit
> 
>  fs/smb/client/smb2transport.c |  4 ++--
>  fs/smb/server/auth.c          |  2 +-
>  include/crypto/aes-cbc-macs.h | 34 ++++++++++++++++++++++++++++++++++
>  lib/crypto/aes.c              |  3 +--
>  net/bluetooth/smp.c           |  3 ++-
>  net/ipv4/tcp_ao.c             |  2 +-
>  net/mac80211/fils_aead.c      |  3 +--
>  7 files changed, 42 insertions(+), 9 deletions(-)

Applied all except patch 3 to
https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

- Eric