From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B90C49EC56 for ; Wed, 9 Sep 2026 11:55:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954914; cv=none; b=OawniQaPCOqHcCqSSDczLDaXUdKwpemjy7qrxAb44a8Bw2Jbhn77+AueXOozyUdSG902egrIG9JW64I29wm59oY9l4XzHocMTR0zaqhZom0Xx73FxXvghuJjXmY5Z3j5dSbPXgJwmjqxfGLj4tvxstVm8khusm5KENtzdqdFUxw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954914; c=relaxed/simple; bh=qyoMQLJeiLB3R3jNlUUwjIL2eoxPZ7NoHL4nW+PB7jk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ToTdoza18macuHDtp9yotlml/1Ujv8tGXpXmdGf7XHYGy9RNPElLr3xKxn9MdpowsnGz6hJxf/mQMyrmszLhbSzKSbhAkN54AZkLkNZYEXUwcx56IjJ3Ebq9rKmeNhFOKB0TxSRr1hiZRoJyqeUK5AyYJHzPzBGlKHfrSJPNm3k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=foH2700j; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="foH2700j" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954911; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=w8OQ5sTROvl8un9Vo1lqJ9fpMZcWAu8IoU4XAMbOsgU=; b=foH2700jiXKUasoKiHYX17IU5Q/PdBvkfbRWGISiJOd3L4e0tCSSGrkyDsgnO9qUt+liBV DNxzTd8AAF4Srk+02pvyORssnTEekqNSw/7PdtnaO7bYG14UChGuqaR8v7chMRX3vNY5WC WKsv3ZwVuM2EFpNK5RU/q1zGOaux4aI= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-626-9Hy-oOGvMX-IOH7nJdG_nQ-1; Wed, 09 Sep 2026 07:55:07 -0400 X-MC-Unique: 9Hy-oOGvMX-IOH7nJdG_nQ-1 X-Mimecast-MFC-AGG-ID: 9Hy-oOGvMX-IOH7nJdG_nQ_1788954906 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id BECCA1800623; Wed, 9 Sep 2026 11:55:05 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 3E5CE195608D; Wed, 9 Sep 2026 11:55:02 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v2 01/13] lib/crypto: aes: Provide functions for zeroizing aes_key and aes_enckey Date: Wed, 9 Sep 2026 13:54:37 +0200 Message-ID: <20260909115455.157093-2-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Some crypto functions need to zeroize their local aes_key or aes_enckey structures after use to avoid leaking sensitive material on the stack. Provide aes_zeroize_key() and aes_zeroize_enckey() helper functions that can be used with __cleanup() to automatically zeroize the structs when they go out of scope. While we're at it, replace the memzero_explicit() calls in lib/crypto/aes.c with the new helper functions. Signed-off-by: Thomas Huth --- include/crypto/aes.h | 18 ++++++++++++++++++ lib/crypto/aes.c | 10 +++++----- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/include/crypto/aes.h b/include/crypto/aes.h index 3279cfa546085..9fe868161e1d3 100644 --- a/include/crypto/aes.h +++ b/include/crypto/aes.h @@ -101,6 +101,15 @@ struct aes_enckey { union aes_enckey_arch k; }; =20 +/** + * aes_zeroize_enckey() - Zeroize an aes_enckey structure + * @key: The aes_enckey to zeroize + */ +static inline void aes_zeroize_enckey(struct aes_enckey *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct aes_key - An AES key prepared for encryption and decryption * @aes_enckey: Common fields and the key prepared for encryption @@ -115,6 +124,15 @@ struct aes_key { union aes_invkey_arch inv_k; }; =20 +/** + * aes_zeroize_key() - Zeroize an aes_key structure + * @key: The aes_key to zeroize + */ +static inline void aes_zeroize_key(struct aes_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /* * Please ensure that the first two fields are 16-byte aligned * relative to the start of the structure, i.e., don't move them! diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c index f1549839b3de0..07c1d912ac365 100644 --- a/lib/crypto/aes.c +++ b/lib/crypto/aes.c @@ -539,7 +539,7 @@ static void __init aes_fips_test(void) if (memcmp(fips_test_data, data, sizeof(data)) !=3D 0) panic("aes: FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_key(&key); } =20 #if IS_ENABLED(CONFIG_CRYPTO_LIB_AES_CBC_MACS) @@ -827,7 +827,7 @@ static void __init aes_ecb_fips_test(void) if (memcmp(fips_test_data, data, sizeof(data)) !=3D 0) panic("aes: ECB FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_key(&key); } #else /* CONFIG_CRYPTO_LIB_AES_ECB */ static inline void aes_ecb_fips_test(void) @@ -1040,7 +1040,7 @@ static void __init aes_cbc_fips_test(void) if (memcmp(fips_test_data, data, sizeof(data)) !=3D 0) panic("aes: CBC FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_key(&key); } =20 /* FIPS cryptographic algorithm self-test for AES-CBC-CTS */ @@ -1069,7 +1069,7 @@ static void __init aes_cbc_cts_fips_test(void) if (memcmp(ptext, data, data_len) !=3D 0) panic("aes: CBC-CTS FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_key(&key); } #else /* CONFIG_CRYPTO_LIB_AES_CBC */ static inline void aes_cbc_fips_test(void) @@ -1194,7 +1194,7 @@ static void __init aes_ctr_fips_test(void) if (memcmp(fips_test_data, data, sizeof(data)) !=3D 0) panic("aes: CTR FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_enckey(&key); } #else /* CONFIG_CRYPTO_LIB_AES_CTR */ static inline void aes_ctr_fips_test(void) --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 42006548575 for ; Wed, 9 Sep 2026 11:55:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954918; cv=none; b=GS17z88c7rogT0b8diM/H5L5PzyUTOdOhmbLvEIoxkZBgGQdSpkZaA+O9sAF2TgH+Q8bapGrWQ77hRliwQdkt8E1KHcp1dTCcjWygv+CH9MvfNbqRP5ghvocd5vDb6wE9QfCEXxA9Arywiio1YqzO5sdQXjQXfrNKjbn0CbgEhI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954918; c=relaxed/simple; bh=Pu553ZQkM91B4VrsGc9weFb5s0yBfWGWM2iMrF015hs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uDRxT9r71XxCzQIFxX9m7pQvVyADlpPkIHFhoBUzhi2+LSNusLyjmHw9a3NkWWSUjGATZr0OqV3G7c2cym3fIWWRItTTTDV+Z8fazVibObh+DrXmAmV9XKItv1ZgPvC5C9U/m7np+HxJw4/sBKW83/2JcHgSAblMw1QYoUZ5yeQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=OyKSuUIy; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="OyKSuUIy" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954915; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iKydTuaKi3XtSbexoPJB1tXNpcTYcsS4RpRAKal/7tc=; b=OyKSuUIy0D1EZ4ITn+Z+ltwddpWMkQxhpyH1+BjhVVXNfcFEfsrE7Kgnvk7jgVzeoNBgVZ lCZkWWxmEdxWdQVKVPeQGevGBTtuwPz7UQa0OnzXVVV2tcM5Nkf/OrL/unMu9VTeP+DGqe WUHbeIrDY764QhYybNx1LzRX3xvm5ds= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-2-1YNacfg4OeCapJb_Gxn-Lw-1; Wed, 09 Sep 2026 07:55:12 -0400 X-MC-Unique: 1YNacfg4OeCapJb_Gxn-Lw-1 X-Mimecast-MFC-AGG-ID: 1YNacfg4OeCapJb_Gxn-Lw_1788954910 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id F116F1955DCE; Wed, 9 Sep 2026 11:55:09 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 9B4291956088; Wed, 9 Sep 2026 11:55:06 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v2 02/13] lib/crypto: aes-xts: Provide function for zeroizing aes_xts_key Date: Wed, 9 Sep 2026 13:54:38 +0200 Message-ID: <20260909115455.157093-3-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" In certain cases crypto code functions need to zeroize their local aes_xts_key structures after use to avoid leaking sensitive material. Provide an aes_xts_zeroize_key() helper function that e.g. can be used with __cleanup() to automatically zeroize the struct when it goes out of scope. While we're at it, replace the related memzero_explicit() call in lib/crypto/aes.c with a call to the new helper function. Signed-off-by: Thomas Huth --- include/crypto/aes-xts.h | 13 +++++++++++-- lib/crypto/aes.c | 2 +- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/include/crypto/aes-xts.h b/include/crypto/aes-xts.h index b9e828265e58a..3a52e1cf40b57 100644 --- a/include/crypto/aes-xts.h +++ b/include/crypto/aes-xts.h @@ -22,6 +22,15 @@ struct aes_xts_key { struct aes_enckey tweak_key; }; =20 +/** + * aes_xts_zeroize_key() - Zeroize an aes_xts_key structure + * @key: The aes_xts_key to zeroize + */ +static inline void aes_xts_zeroize_key(struct aes_xts_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * aes_xts_preparekey() - Prepare a key for AES-XTS encryption and decrypt= ion * @key: (output) The key structure to initialize @@ -30,8 +39,8 @@ struct aes_xts_key { * @flags: Optional flag XTS_FORBID_WEAK_KEYS to forbid keys whose two hal= ves * are the same. * - * Users should use memzero_explicit() to zeroize the key struct at the en= d of - * its lifetime. (But if this function fails, zeroization is unnecessary.) + * Users should use aes_xts_zeroize_key() to zeroize the key struct at the= end + * of its lifetime. (But if this function fails, zeroization is unnecessa= ry.) * * Context: Any context. * Return: diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c index 07c1d912ac365..34ef5deca0a79 100644 --- a/lib/crypto/aes.c +++ b/lib/crypto/aes.c @@ -1223,7 +1223,7 @@ int aes_xts_preparekey(struct aes_xts_key *key, const= u8 *in_key, return 0; =20 out_zeroize: - memzero_explicit(key, sizeof(*key)); + aes_xts_zeroize_key(key); return err; } EXPORT_SYMBOL_GPL(aes_xts_preparekey); --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 658CE545DAB for ; Wed, 9 Sep 2026 11:55:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954923; cv=none; b=cKsvNyf7AEtWMTPdcc9haTQG4+RFECynxivGHhAeCOMVzTxBzwDg+hv61MYQdGYMC0PA03dAzz0KNrlErwsk/WUFgxBcCJlM932icXXxF8/3AqnR7Lz6RFnxfyZ3/Sr8sXHsiAqppxb0i6uaS88+5T9nBt8vIGyX3ugFqJRCPYM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954923; c=relaxed/simple; bh=4/1kEsT70NlzkN+xrxR35Wl/GIQQI1l/UDDyNSo29h4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hD9Dm1Qgd8InVsgVc9RxKxmbF5i0SSfvYq6ZUgkrivRpfBsoGMQaUX88ZW+Xvi6GHPGhy1WiCqhGn6aNmiciY0qm4hRnBZOmD0MOOgkQwClXKBZIO6rssXWDLT4lrhdVpWpjs7aZprHCoPQCk+0GZEeStB1uA1nNeLrZnIvkZ/Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=XnTjerfI; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="XnTjerfI" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954921; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UEdu/etGA8cxWfcQPyBtvpBW0rX8uyBFZbXJ3IuQEjE=; b=XnTjerfI5I7Hv5ESUmzFZsyKW4+xrrwmNDRp6mWvklb9YS16JQ8Gh3+v+Wi5PfRt53Ho/F vztYD007wRWiFxK4ZYvPLWzekkOrhYUDd+dmaVJGYaCzRPbSy3db/Jt4dGyXeddnSWJ91D z4Ay6ug96n/ukgkzoze6ynqW2VmhXS0= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-330-ZtKow3a1MAKKXJd3sbUo5g-1; Wed, 09 Sep 2026 07:55:16 -0400 X-MC-Unique: ZtKow3a1MAKKXJd3sbUo5g-1 X-Mimecast-MFC-AGG-ID: ZtKow3a1MAKKXJd3sbUo5g_1788954914 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 35AE4180064A; Wed, 9 Sep 2026 11:55:14 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id CA4811956088; Wed, 9 Sep 2026 11:55:10 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v2 03/13] lib/crypto: aes-gcm: Provide functions for zeroizing aes_gcm* structures Date: Wed, 9 Sep 2026 13:54:39 +0200 Message-ID: <20260909115455.157093-4-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" In certain cases crypto code needs to zeroize their local aes_gcm_key or aes_gcm_ctx structures after use to avoid leaking sensitive material. Provide aes_gcm_zeroize_key() and aes_gcm_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structures when they go out of scope. While we're at it, replace the related memzero_explicit() calls in lib/crypto/aes.c with calls to the new helper functions. Signed-off-by: Thomas Huth --- include/crypto/aes-gcm.h | 22 ++++++++++++++++++++-- lib/crypto/aes.c | 8 +++----- 2 files changed, 23 insertions(+), 7 deletions(-) diff --git a/include/crypto/aes-gcm.h b/include/crypto/aes-gcm.h index 2aee62f019891..a81b00fd8e27f 100644 --- a/include/crypto/aes-gcm.h +++ b/include/crypto/aes-gcm.h @@ -21,6 +21,15 @@ struct aes_gcm_key { size_t authtag_len; /* Length of authentication tags in bytes */ }; =20 +/** + * aes_gcm_zeroize_key() - Zeroize an aes_gcm_key structure + * @key: The aes_gcm_key to zeroize + */ +static inline void aes_gcm_zeroize_key(struct aes_gcm_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct aes_gcm_ctx - Context for incrementally en/decrypting a message */ @@ -58,6 +67,15 @@ struct aes_gcm_ctx { u64 data_len; }; =20 +/** + * aes_gcm_zeroize_ctx() - Zeroize an aes_gcm_ctx structure + * @ctx: The aes_gcm_ctx to zeroize + */ +static inline void aes_gcm_zeroize_ctx(struct aes_gcm_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * aes_gcm_preparekey() - Prepare a key for AES-GCM encryption and decrypt= ion * @key: (output) The key structure to initialize @@ -66,8 +84,8 @@ struct aes_gcm_ctx { * @authtag_len: Length of the authentication tag in bytes: * 4, 8, 12, 13, 14, 15, or 16. 16 is recommended. * - * Users should use memzero_explicit() to zeroize the key struct at the en= d of - * its lifetime. (But if this function fails, zeroization is unnecessary.) + * Users should use aes_gcm_zeroize_key() to zeroize the key struct at the= end + * of its lifetime. (But if this function fails, zeroization is unnecessa= ry.) * * Context: Any context. * Return: diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c index 34ef5deca0a79..0cb5d7355926e 100644 --- a/lib/crypto/aes.c +++ b/lib/crypto/aes.c @@ -1670,7 +1670,7 @@ void aes_gcm_encrypt_final(struct aes_gcm_ctx *ctx, u= 8 *authtag) ghash_final(&ctx->ghash, ctx->ctr); /* Use ctr as temp buffer */ =20 crypto_xor_cpy(authtag, ctx->ctr, ctx->j0_enc, ctx->key->authtag_len); - memzero_explicit(ctx, sizeof(*ctx)); + aes_gcm_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(aes_gcm_encrypt_final); =20 @@ -1697,7 +1697,7 @@ int aes_gcm_decrypt_final(struct aes_gcm_ctx *ctx, co= nst u8 *authtag) -EBADMSG : 0; out: - memzero_explicit(ctx, sizeof(*ctx)); + aes_gcm_zeroize_ctx(ctx); return err; } EXPORT_SYMBOL_GPL(aes_gcm_decrypt_final); @@ -1742,7 +1742,7 @@ static void __init aes_gcm_fips_test(void) { const size_t data_len =3D sizeof(fips_test_data); u8 buf[sizeof(fips_test_data) + AES_BLOCK_SIZE]; - struct aes_gcm_key key; + struct aes_gcm_key key __cleanup(aes_gcm_zeroize_key); int err; =20 if (aes_gcm_preparekey(&key, fips_test_key, sizeof(fips_test_key), @@ -1760,8 +1760,6 @@ static void __init aes_gcm_fips_test(void) panic("aes: GCM FIPS self-test failed (decryption failed)\n"); if (memcmp(fips_test_data, buf, data_len) !=3D 0) panic("aes: GCM FIPS self-test failed (wrong plaintext)\n"); - - memzero_explicit(&key, sizeof(key)); } #else /* CONFIG_CRYPTO_LIB_AES_GCM */ static inline void aes_gcm_fips_test(void) --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E502754A7D8 for ; Wed, 9 Sep 2026 11:55:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954928; cv=none; b=TsEFShLcX5PJNjVEilhxlhvD//czx+clmnvASm8eRsPdngSnXD1yQLHNZQ4SGk0Mudmqv5DHekuvdWMD1PX0Y1g6X5Vnk7kqIlGc0Z8Pc32npHSfeSTXzyZ5OBeJNfIHqexXQkcmmGg++bo3M9BqzPv50uCwVdW78S43a52Jok0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954928; c=relaxed/simple; bh=Gauuyu1weASDOCUOi0niAJFHae1GpPUEFg2Emc3mczQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BuafaAhLUH5tB4oODclxGSSd0BGUSG4eGfhThutQKYycGQdVElJwh8E2/mLwV7wHR7MM/uY3l6xyrhUnj464aAu+55RWg8zLAFs5fVen6ku9C5V8X010b8QeJfuBmwfUQnXVYiGGeh5rLlrIwCweqeg87JRlEw3SaJtzxu6Xk4I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=JJPNFWBo; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="JJPNFWBo" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954924; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/X0DqhKQVgSWZ6Kwg3nu2S/S85i2kZoDTzqHkKw8Nxs=; b=JJPNFWBoP8WDBdQDo8cQluPJptD4NT6unYnsXojja6iqUQXq4diq8flT+hhOxEkJUDc/AD kK6H7LuBWT5rjKvIGtEUcaUoSsdquCjSqHmmot4GBVDeKDkrZMXSoIigvj6exKk5wsQ23L L8VULc9EssuP8jJcCY1af7HswqIUt3U= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-168-_E0XYkbqMzOl27A0uF0LOQ-1; Wed, 09 Sep 2026 07:55:21 -0400 X-MC-Unique: _E0XYkbqMzOl27A0uF0LOQ-1 X-Mimecast-MFC-AGG-ID: _E0XYkbqMzOl27A0uF0LOQ_1788954919 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3FA9B1954AE0; Wed, 9 Sep 2026 11:55:19 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 3979D1956088; Wed, 9 Sep 2026 11:55:14 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v2 04/13] lib/crypto: aes-ccm: Provide functions for zeroizing aes_ccm* structures Date: Wed, 9 Sep 2026 13:54:40 +0200 Message-ID: <20260909115455.157093-5-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" In certain cases crypto code needs to zeroize their local aes_ccm_key or aes_ccm_ctx structures after use to avoid leaking sensitive material. Provide aes_ccm_zeroize_key() and aes_ccm_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structures when they go out of scope. While we're at it, replace the related memzero_explicit() calls in lib/crypto/aes.c with calls to the new helper functions. Signed-off-by: Thomas Huth --- include/crypto/aes-ccm.h | 22 ++++++++++++++++++++-- lib/crypto/aes.c | 8 +++----- 2 files changed, 23 insertions(+), 7 deletions(-) diff --git a/include/crypto/aes-ccm.h b/include/crypto/aes-ccm.h index 8b00859ac4d6b..c52982dd91d2c 100644 --- a/include/crypto/aes-ccm.h +++ b/include/crypto/aes-ccm.h @@ -18,6 +18,15 @@ struct aes_ccm_key { size_t authtag_len; /* Length of authentication tags in bytes */ }; =20 +/** + * aes_ccm_zeroize_key() - Zeroize an aes_ccm_key structure + * @key: The aes_ccm_key to zeroize + */ +static inline void aes_ccm_zeroize_key(struct aes_ccm_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct aes_ccm_ctx - Context for incrementally en/decrypting a message */ @@ -50,6 +59,15 @@ struct aes_ccm_ctx { bool ad_padded; }; =20 +/** + * aes_ccm_zeroize_ctx() - Zeroize an aes_ccm_ctx structure + * @ctx: The aes_ccm_ctx to zeroize + */ +static inline void aes_ccm_zeroize_ctx(struct aes_ccm_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * aes_ccm_preparekey() - Prepare a key for AES-CCM encryption and decrypt= ion * @key: (output) The key structure to initialize @@ -58,8 +76,8 @@ struct aes_ccm_ctx { * @authtag_len: Length of the authentication tag in bytes: * 4, 6, 8, 10, 12, 14, or 16. 16 is recommended. * - * Users should use memzero_explicit() to zeroize the key struct at the en= d of - * its lifetime. (But if this function fails, zeroization is unnecessary.) + * Users should use aes_ccm_zeroize_key() to zeroize the key struct at the= end + * of its lifetime. (But if this function fails, zeroization is unnecessa= ry.) * * Context: Any context. * Return: diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c index 0cb5d7355926e..2d29adca79532 100644 --- a/lib/crypto/aes.c +++ b/lib/crypto/aes.c @@ -2011,7 +2011,7 @@ void aes_ccm_encrypt_final(struct aes_ccm_ctx *ctx, u= 8 *authtag) if (ctx->partial_len) aes_encrypt(&ctx->key->aes, ctx->mac, ctx->mac); crypto_xor_cpy(authtag, ctx->mac, ctx->s0, ctx->key->authtag_len); - memzero_explicit(ctx, sizeof(*ctx)); + aes_ccm_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(aes_ccm_encrypt_final); =20 @@ -2032,7 +2032,7 @@ int aes_ccm_decrypt_final(struct aes_ccm_ctx *ctx, co= nst u8 *authtag) -EBADMSG : 0; out: - memzero_explicit(ctx, sizeof(*ctx)); + aes_ccm_zeroize_ctx(ctx); return err; } EXPORT_SYMBOL_GPL(aes_ccm_decrypt_final); @@ -2084,7 +2084,7 @@ static void __init aes_ccm_fips_test(void) const size_t data_len =3D sizeof(fips_test_data); const size_t nonce_len =3D 13; u8 buf[sizeof(fips_test_data) + AES_BLOCK_SIZE]; - struct aes_ccm_key key; + struct aes_ccm_key key __cleanup(aes_ccm_zeroize_key); int err; =20 if (aes_ccm_preparekey(&key, fips_test_key, sizeof(fips_test_key), @@ -2106,8 +2106,6 @@ static void __init aes_ccm_fips_test(void) panic("aes: CCM FIPS self-test failed (decryption failed)\n"); if (memcmp(fips_test_data, buf, data_len) !=3D 0) panic("aes: CCM FIPS self-test failed (wrong plaintext)\n"); - - memzero_explicit(&key, sizeof(key)); } #else /* CONFIG_CRYPTO_LIB_AES_CCM */ static inline void aes_ccm_fips_test(void) --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6407E54854C for ; Wed, 9 Sep 2026 11:55:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954933; cv=none; b=qY3A0LmOC0tDDnyrgd7W/jWVWGGSVUZqr7/LijrLXhrYIDarICVkylk0ywrMj30+pSlpeOhgSshgCs2eNaLvZVamG5RrI3OhfKr5UF9SYH2JHPXYZ0pVQpto+aNoQkB6KUiEerblGtkSPw5MCMe8slE5LwQtQC8ZcjUu4BlmIdI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954933; c=relaxed/simple; bh=d+vwqEhO/lD2ctFXZn1C2/2N9oPMH8AXcVR0UYYn2jM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=q0mn0Bc0p7aMGpNEb5Xtm8s5NypRNnzTIFclq01DvSxF+Yh5vwoJ+9YXYJfB8QLIgpsaxJFPIzp7Skr9a8GVkEMnvWGQfds7NKLxWaaNqlsyKO4YPxqet23wxdLx9lYirXSJiCC7inyrOa/bK2YSJpIw+Eswndp5wqtaBqB01QI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=begoQ8EB; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="begoQ8EB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954931; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+JeEBAQDGBfdd7h6R58FOX2X8OCTMKwsL/hKMH91GAo=; b=begoQ8EB3g7kYGiOVJC7IAGCYd2horDqXJumtQtnRC+0IZGdZ+YakQRoMkcS1MZEeWszAq a6ek74c1qTBsaPdcBMUYTQtA0KRgfEcurW5xXMGyJrQ6bbg4/lM+lTxB3OsTLq6XNXqqtZ RaHIa0IdYUgKjr0m+vD00Psfty+iDJg= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-464-LBdoFZuMO7WDwqjtKQnZ-Q-1; Wed, 09 Sep 2026 07:55:26 -0400 X-MC-Unique: LBdoFZuMO7WDwqjtKQnZ-Q-1 X-Mimecast-MFC-AGG-ID: LBdoFZuMO7WDwqjtKQnZ-Q_1788954924 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9686218052DA; Wed, 9 Sep 2026 11:55:23 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 14E441956088; Wed, 9 Sep 2026 11:55:19 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v2 05/13] lib/crypto: md5: Provide a function for zeroizing hmac_md5 structures Date: Wed, 9 Sep 2026 13:54:41 +0200 Message-ID: <20260909115455.157093-6-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" In certain cases crypto code functions need to zeroize their local hmac_md5_key or hmac_md5_ctx structures after use to avoid leaking sensitive material on the stack. Provide hmac_md5_zeroize_key() and hmac_md5_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structure when it goes out of scope. While we're at it, replace the related memzero_explicit() call in lib/crypto/md5.c with a call to the new helper function. Signed-off-by: Thomas Huth --- include/crypto/md5.h | 19 +++++++++++++++++++ lib/crypto/md5.c | 2 +- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/include/crypto/md5.h b/include/crypto/md5.h index c47aedfe67ecd..1ed89c15b662c 100644 --- a/include/crypto/md5.h +++ b/include/crypto/md5.h @@ -4,6 +4,7 @@ =20 #include #include +#include =20 #define MD5_DIGEST_SIZE 16 #define MD5_HMAC_BLOCK_SIZE 64 @@ -98,6 +99,15 @@ struct hmac_md5_key { struct md5_block_state ostate; }; =20 +/** + * hmac_md5_zeroize_key() - Zeroize an hmac_md5_key structure + * @key: The hmac_md5_key to zeroize + */ +static inline void hmac_md5_zeroize_key(struct hmac_md5_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_md5_ctx - Context for computing HMAC-MD5 of a message * @hash_ctx: private @@ -108,6 +118,15 @@ struct hmac_md5_ctx { struct md5_block_state ostate; }; =20 +/** + * hmac_md5_zeroize_ctx() - Zeroize an hmac_md5_ctx structure + * @ctx: The hmac_md5_ctx context to zeroize + */ +static inline void hmac_md5_zeroize_ctx(struct hmac_md5_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_md5_preparekey() - Prepare a key for HMAC-MD5 * @key: (output) the key structure to initialize diff --git a/lib/crypto/md5.c b/lib/crypto/md5.c index 3d2b017a0525a..a8ee57600012d 100644 --- a/lib/crypto/md5.c +++ b/lib/crypto/md5.c @@ -271,7 +271,7 @@ void hmac_md5_final(struct hmac_md5_ctx *ctx, u8 out[MD= 5_DIGEST_SIZE]) cpu_to_le32_array(ctx->ostate.h, ARRAY_SIZE(ctx->ostate.h)); memcpy(out, ctx->ostate.h, MD5_DIGEST_SIZE); =20 - memzero_explicit(ctx, sizeof(*ctx)); + hmac_md5_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(hmac_md5_final); =20 --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0BA7E54A7D8 for ; Wed, 9 Sep 2026 11:55:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954935; cv=none; b=IIy1UpPEKJZhDDsvr5Pg1A+gHSRw8ynO20T2C9kjvj1aMJ/a3X2fpp1ygWcvC2hcodhZ1ZeD5XhKE6pPbn2JoOqiFZkuLoWv5Us3duIvc2bmU4er26EfnUNbIsLfn+9kFoiHKBeI2+bsglIf7gnlnkXBdQDD7+CKj3fQFJsBoO0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954935; c=relaxed/simple; bh=1eGnr7sGi0HQFB/17GdIY9Hr7u1mX/ltDaQTx/Vt9Jw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KRifvzbVasZR1RA/syr9S+h0sOGtiW5zJO3CTqGFgMkEiNlUY76FS2a0xyYZjJc5TKgeIv6BTmHHLjMZtbVQIblZC06FJLQKdbFMem0RtaI2eK9pF9iPUuQiZFu7x0IL+LyjMpV6CLUDkGOQTZnSvWu6K6B/LW1d+SL/gRCiC6A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=bmPPIkJf; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="bmPPIkJf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954933; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=7xr6U9d+4aCYYZf6FSP46iQRfFcNkrBzahPUUHhcqcw=; b=bmPPIkJfWGCWb1JTdqaDePdxFFYBbBxTI0aJOEGg48GDbZ1VC9BlXxMVE9bGZNl2UCZeir 8/WUgbCkz8pMX56FhAryx7OtywttH6eUmQUc/8/hNimRWH4FNJcStlNlqolg6XYgMDSj09 xqVISXRfBivfmcmwgYnJBVOUmZ/W48Q= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-607-3qWkksO5NKKaHQxpTgDL8w-1; Wed, 09 Sep 2026 07:55:29 -0400 X-MC-Unique: 3qWkksO5NKKaHQxpTgDL8w-1 X-Mimecast-MFC-AGG-ID: 3qWkksO5NKKaHQxpTgDL8w_1788954928 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 24A7B1955BD9; Wed, 9 Sep 2026 11:55:28 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6EADA1956088; Wed, 9 Sep 2026 11:55:24 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v2 06/13] lib/crypto: sm3: Provide a function for zeroizing the sm3_ctx structure Date: Wed, 9 Sep 2026 13:54:42 +0200 Message-ID: <20260909115455.157093-7-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" In certain cases crypto code functions need to zeroize their local sm3_ctx structure after use to avoid leaking sensitive material. Provide a sm3_zeroize_ctx() helper function that e.g. can be used with __cleanup() to automatically zeroize the structure when it goes out of scope. While we're at it, replace the related memzero_explicit() call in lib/crypto/sm3.c with a call to the new helper function. Signed-off-by: Thomas Huth --- include/crypto/sm3.h | 9 +++++++++ lib/crypto/sm3.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/include/crypto/sm3.h b/include/crypto/sm3.h index 371e8a6617054..1b41356ed0864 100644 --- a/include/crypto/sm3.h +++ b/include/crypto/sm3.h @@ -41,6 +41,15 @@ struct sm3_ctx { u8 buf[SM3_BLOCK_SIZE] __aligned(__alignof__(__be64)); }; =20 +/** + * sm3_zeroize_ctx() - Zeroize an sm3_ctx structure + * @ctx: The sm3_ctx to zeroize + */ +static inline void sm3_zeroize_ctx(struct sm3_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * sm3_init() - Initialize an SM3 context for a new message * @ctx: the context to initialize diff --git a/lib/crypto/sm3.c b/lib/crypto/sm3.c index b02b8a247adf2..23059347b4493 100644 --- a/lib/crypto/sm3.c +++ b/lib/crypto/sm3.c @@ -258,7 +258,7 @@ static void __sm3_final(struct sm3_ctx *ctx, u8 out[SM3= _DIGEST_SIZE]) void sm3_final(struct sm3_ctx *ctx, u8 out[SM3_DIGEST_SIZE]) { __sm3_final(ctx, out); - memzero_explicit(ctx, sizeof(*ctx)); + sm3_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(sm3_final); =20 --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DF7654A7D8 for ; Wed, 9 Sep 2026 11:55:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954941; cv=none; b=h4SH0aUjhsvalAjh2cQVmnIAQO1XcG8NX1BSeMCBKbUI6XyWZLfTm0XIyGGN5HQnd9Lzi8BMwL5TaNZpf2ZUodKgBSkv6BkfjiYEYZ5BUpSWkpq0AOgD/qeoL3PP0B+xSIlnr8I4yNaNfPH1MNiuIXhW4iAn+teIRpLQKNNwxmo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954941; c=relaxed/simple; bh=8Nhgl85UqN7JQx2CBcnw7jYv6wkT5XU8Jx+KGKUJbB0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sjXlPQdZm8VzPH/2rLXWwCCujzl8ILjInR2PSg8AMtM0IDCAjCxYjhRabwO6C0cGbofGjc6xqDHnHerj5DSXav8Gu7rIbIYKYmRGNfZkjJUgisQMkxXJld3IHc25GXMAbNdkz+tptdh6oC1TOSOcbKobQQPBzJLgZ6oXR+d+I0Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=H/dmMurc; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="H/dmMurc" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954939; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ouNZYOOt8CIaEFrfD0VxsHURoh7bbScAMyQARtiv7Dg=; b=H/dmMurc7pcrtPnFIe4wSMt0MS6AVwGprmhU18cHTB8QB2VY8GctD7b5Rz3aS8lq3PRxfV 5zx3plw/4xOdRYXb9svl3AuGSpA4J5pRN9+TgztYtk44H0IpBZCEIs/zHTgXlB+uhfmeSv 6ReEYhzhe1KbTotATeIa6h5VLLMf/mA= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-617-50wCsqVqOPiLqs4bGPW_dA-1; Wed, 09 Sep 2026 07:55:34 -0400 X-MC-Unique: 50wCsqVqOPiLqs4bGPW_dA-1 X-Mimecast-MFC-AGG-ID: 50wCsqVqOPiLqs4bGPW_dA_1788954932 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A16001800869; Wed, 9 Sep 2026 11:55:32 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 3D4451956088; Wed, 9 Sep 2026 11:55:29 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v2 07/13] lib/crypto: blake2: Provide functions for zeroizing blake2*_ctx structures Date: Wed, 9 Sep 2026 13:54:43 +0200 Message-ID: <20260909115455.157093-8-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" In certain cases crypto code needs to zeroize their local blake2b_ctx or blake2s_ctx structures after use to avoid leaking sensitive material. Provide blake2b_zeroize_ctx() and blake2s_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structures when they go out of scope. While we're at it, replace the related memzero_explicit() calls in lib/crypto/blake2*.c with calls to the new helper functions. Signed-off-by: Thomas Huth --- include/crypto/blake2b.h | 9 +++++++++ include/crypto/blake2s.h | 9 +++++++++ lib/crypto/blake2b.c | 2 +- lib/crypto/blake2s.c | 2 +- 4 files changed, 20 insertions(+), 2 deletions(-) diff --git a/include/crypto/blake2b.h b/include/crypto/blake2b.h index 3bc37fd103a7a..eda1604bce780 100644 --- a/include/crypto/blake2b.h +++ b/include/crypto/blake2b.h @@ -37,6 +37,15 @@ struct blake2b_ctx { unsigned int outlen; }; =20 +/** + * blake2b_zeroize_ctx() - Zeroize a blake2b_ctx structure + * @ctx: The blake2b_ctx to zeroize + */ +static inline void blake2b_zeroize_ctx(struct blake2b_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + enum blake2b_iv { BLAKE2B_IV0 =3D 0x6A09E667F3BCC908ULL, BLAKE2B_IV1 =3D 0xBB67AE8584CAA73BULL, diff --git a/include/crypto/blake2s.h b/include/crypto/blake2s.h index 648cb78243588..bb4e6870ed196 100644 --- a/include/crypto/blake2s.h +++ b/include/crypto/blake2s.h @@ -41,6 +41,15 @@ struct blake2s_ctx { unsigned int outlen; }; =20 +/** + * blake2s_zeroize_ctx() - Zeroize a blake2s_ctx structure + * @ctx: The blake2s_ctx to zeroize + */ +static inline void blake2s_zeroize_ctx(struct blake2s_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + enum blake2s_iv { BLAKE2S_IV0 =3D 0x6A09E667UL, BLAKE2S_IV1 =3D 0xBB67AE85UL, diff --git a/lib/crypto/blake2b.c b/lib/crypto/blake2b.c index 581b7f8486fae..55d6c437f311f 100644 --- a/lib/crypto/blake2b.c +++ b/lib/crypto/blake2b.c @@ -148,7 +148,7 @@ void blake2b_final(struct blake2b_ctx *ctx, u8 *out) blake2b_compress(ctx, ctx->buf, 1, ctx->buflen); cpu_to_le64_array(ctx->h, ARRAY_SIZE(ctx->h)); memcpy(out, ctx->h, ctx->outlen); - memzero_explicit(ctx, sizeof(*ctx)); + blake2b_zeroize_ctx(ctx); } EXPORT_SYMBOL(blake2b_final); =20 diff --git a/lib/crypto/blake2s.c b/lib/crypto/blake2s.c index 71578a0847423..24f7f34334b01 100644 --- a/lib/crypto/blake2s.c +++ b/lib/crypto/blake2s.c @@ -142,7 +142,7 @@ void blake2s_final(struct blake2s_ctx *ctx, u8 *out) blake2s_compress(ctx, ctx->buf, 1, ctx->buflen); cpu_to_le32_array(ctx->h, ARRAY_SIZE(ctx->h)); memcpy(out, ctx->h, ctx->outlen); - memzero_explicit(ctx, sizeof(*ctx)); + blake2s_zeroize_ctx(ctx); } EXPORT_SYMBOL(blake2s_final); =20 --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70BDC54B1DE for ; Wed, 9 Sep 2026 11:55:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954944; cv=none; b=dVAaRpHAcAGLhOZZDe4Sv5KOyNC+1ep6j+b+MZfy2hBr2nlG4561WQZ2uby0Dasyr6F2FWP2e0BN6OlFG3KEolA3y1hwunJvpDEUv2DUNQQPXoI2mtO9TFChrTvlhxWLKOhk1uzthTfU/BypclCwiV3mm6SncqbSusRVQuH26/o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954944; c=relaxed/simple; bh=SMz1n2qZSUfU+2cgkcz49kZ4uQA0DD7hBcMOHyDLDOg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=plWkp7h1tStBVOyolsq73c0umB90Ue12Y1YolJ8HhXL6Bm8EYjoknDKGth563h60lnYX2TvN+xAR8ClrmxllT0gUax6UVS2pBP6KagT+Eo6YoDV9G21Eafkamrsrgq9lavYO50P49Y07l3CEjJrM5TFXJ/ncWHbRL8ax2PgVahA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Iw7Eq6q8; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Iw7Eq6q8" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954942; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YFi1wI0axV9T/N/bsBEiFja16TRKzsIA5VOlO65mHUM=; b=Iw7Eq6q8AxkNLt7MyT5Nh2JOBj/bme7XDrrFAvkCnjKlW0/ELqOFkbMSfuzp8TeWkMJoB9 hxUF3YjzJCqAcDfDDyfSZfewYSSZErDpLzL2/aLjJIJx4Qa0nZQOa2qcIrhVqOLaeeXCPP c1FzCoCEDrPOKs/sTqxmQav/gLNqXM8= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-614-1UeizDOZM1ilgStpsowz2Q-1; Wed, 09 Sep 2026 07:55:38 -0400 X-MC-Unique: 1UeizDOZM1ilgStpsowz2Q-1 X-Mimecast-MFC-AGG-ID: 1UeizDOZM1ilgStpsowz2Q_1788954937 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E2D271955BD9; Wed, 9 Sep 2026 11:55:36 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7D2A61956088; Wed, 9 Sep 2026 11:55:33 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v2 08/13] lib/crypto: sha1: Provide functions for zeroizing hmac_sha1 structures Date: Wed, 9 Sep 2026 13:54:44 +0200 Message-ID: <20260909115455.157093-9-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" In certain cases crypto code needs to zeroize their local hmac_sha1_key or hmac_sha1_ctx structures after use to avoid leaking sensitive material. Provide hmac_sha1_zeroize_key() and hmac_sha1_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structures when they go out of scope. While we're at it, replace the related memzero_explicit() call in lib/crypto/sha1.c with a call to the new helper function. Signed-off-by: Thomas Huth --- include/crypto/sha1.h | 19 +++++++++++++++++++ lib/crypto/sha1.c | 2 +- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/include/crypto/sha1.h b/include/crypto/sha1.h index 4d973e016cd69..bc0046bffeaee 100644 --- a/include/crypto/sha1.h +++ b/include/crypto/sha1.h @@ -7,6 +7,7 @@ #define _CRYPTO_SHA1_H =20 #include +#include =20 #define SHA1_DIGEST_SIZE 20 #define SHA1_BLOCK_SIZE 64 @@ -96,6 +97,15 @@ struct hmac_sha1_key { struct sha1_block_state ostate; }; =20 +/** + * hmac_sha1_zeroize_key() - Zeroize an hmac_sha1_key structure + * @key: The hmac_sha1_key to zeroize + */ +static inline void hmac_sha1_zeroize_key(struct hmac_sha1_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha1_ctx - Context for computing HMAC-SHA1 of a message * @sha_ctx: private @@ -106,6 +116,15 @@ struct hmac_sha1_ctx { struct sha1_block_state ostate; }; =20 +/** + * hmac_sha1_zeroize_ctx() - Zeroize an hmac_sha1_ctx structure + * @ctx: The hmac_sha1_ctx context to zeroize + */ +static inline void hmac_sha1_zeroize_ctx(struct hmac_sha1_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha1_preparekey() - Prepare a key for HMAC-SHA1 * @key: (output) the key structure to initialize diff --git a/lib/crypto/sha1.c b/lib/crypto/sha1.c index b687b89d97cb4..c4361ef77166e 100644 --- a/lib/crypto/sha1.c +++ b/lib/crypto/sha1.c @@ -275,7 +275,7 @@ void hmac_sha1_final(struct hmac_sha1_ctx *ctx, u8 out[= SHA1_DIGEST_SIZE]) for (size_t i =3D 0; i < SHA1_DIGEST_SIZE; i +=3D 4) put_unaligned_be32(ctx->ostate.h[i / 4], out + i); =20 - memzero_explicit(ctx, sizeof(*ctx)); + hmac_sha1_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(hmac_sha1_final); =20 --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3237D5476D9 for ; Wed, 9 Sep 2026 11:55:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954953; cv=none; b=a0SGBKE8YKTxxx+DYAlH97p+NFwOYD1KpsVctFxpdCVqxAwW2wv3vmyLbcfzzjRHAeto3Q70NtlrfpQFGKEMXVl4eOS3kpwl9ELl0bqf6PRZRKp/d6RvzAKXmJoYof+cLOHzjBM8kHpllsk29foouOTluekIVFWba76e0HzLsJs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954953; c=relaxed/simple; bh=YA+a6CCA1zWdQPcieNEuLQ0mIwRn0Ck7WsDOY4ql94Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EGJ27JzlMVrZe2bAxBnM0kuvGauszIk2OCqq8KrXuf12VO9BY1dUUDzu1hbRjXRB25b8XmkRyvQXPtP/b/Y/xfcSMsU5LVkZbOc722LbKqMegM/uAcr278PWfIElWuXWNBW1cPnzDTJcuWsyvQooPnWXNUbH0FRZa1QmI6mR0Do= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=e+jFvZta; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="e+jFvZta" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954951; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FeWcXK9/x+ZPPaC++IgCQ9jS/VWtgj79RgI0CVq94cU=; b=e+jFvZtaXjEKd4bRzwRtCsJtd2piOzBIaPHrHKlJcrSYJVRuIgk2fnFRxhIW4T4+2VroGZ GrXknkzCC2xnCEWupdK+4K4wv6lCMw+W/AlOkQxYpCJx0VzBHXqF0CQepJI/j6c91UUG+A YMhY5SboXuoLSXWPf1JpLA5C0AeNp1c= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-416-XppBFvCKMm-g7oxw0FdvVQ-1; Wed, 09 Sep 2026 07:55:47 -0400 X-MC-Unique: XppBFvCKMm-g7oxw0FdvVQ-1 X-Mimecast-MFC-AGG-ID: XppBFvCKMm-g7oxw0FdvVQ_1788954944 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id EEFA519541AC; Wed, 9 Sep 2026 11:55:43 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B5571195608D; Wed, 9 Sep 2026 11:55:37 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel , James Bottomley , Jarkko Sakkinen , Mimi Zohar , David Howells , Paul Moore , James Morris , "Serge E. Hallyn" Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v2 09/13] security: keys: trusted: always clear the hmac_sha1_ctx before returning Date: Wed, 9 Sep 2026 13:54:45 +0200 Message-ID: <20260909115455.157093-10-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Clear the hmac_sha1_ctx structure via __cleanup(hmac_sha1_zeroize_ctx) to make sure that the function does not leak sensitive data on the stack when returning without calling hmac_sha1_final(). Reviewed-by: Jarkko Sakkinen Signed-off-by: Thomas Huth --- security/keys/trusted-keys/trusted_tpm1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trus= ted-keys/trusted_tpm1.c index bf0bf7f369705..e5a904b5c1946 100644 --- a/security/keys/trusted-keys/trusted_tpm1.c +++ b/security/keys/trusted-keys/trusted_tpm1.c @@ -101,7 +101,7 @@ static inline void dump_tpm_buf(unsigned char *buf) static int TSS_rawhmac(unsigned char *digest, const unsigned char *key, unsigned int keylen, ...) { - struct hmac_sha1_ctx hmac_ctx; + struct hmac_sha1_ctx hmac_ctx __cleanup(hmac_sha1_zeroize_ctx); va_list argp; unsigned int dlen; unsigned char *data; --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37D0954CF78 for ; Wed, 9 Sep 2026 11:55:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954960; cv=none; b=sYH4NRxjB8pecViATtbY5sAhbFWcW7rcLfr1bMeTb2jXkdYYrpfjYbMw1K21Y85AigeQ5Lt8OSmE0jfIkNuZB/9Oj0Mp6CuKqilVn/1ZwWBPos9ZyFFABv8HNFKqqzHfXn16cEwr+qaAFDUyjHARUVe/0tNQ04zhq4I847CEKHI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954960; c=relaxed/simple; bh=GNqEgrb/+sZ74TXSrcPeteUL+J+8OTzaBVlLilJkm0o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qv6TzOqUB4rHU88ck+k6dX52we181gzO3UEEeNUww+WD4O8EXjqrEAAe+yJ6FQ+V/CW31Ds+w+I/JzDTAS+JUrcPeg6uS7VpeandmIQ5bFkzwgkyBTIPX77WvIafBbR8x867aEBCR2x4r9zW8ADi1YGvnRXGYGYiTETPlUFVXds= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=dKCpaUAi; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="dKCpaUAi" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954957; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=DzI3o5Wk9Ztm1nJZ2Q+wYHNX0B3JnIKhbrRiMd/8awY=; b=dKCpaUAiaVKtqzqOGJ+bAk2CC4TjyW0VfoV6g229MgznEGfC0jNzthg2GCVVEVE7K6LnrR IaYxWHJdDNlJLgjjqTQpXjm5aavhJA9PQ+O1Nn7pyFjfFz/sCFTGt+EgmFDYWgdgy6Xi// sQGDlDCbxjV3Eyww/OaGdjzfapeghm8= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-230-NWfyhj1OPraS-1r2Ux0jCA-1; Wed, 09 Sep 2026 07:55:51 -0400 X-MC-Unique: NWfyhj1OPraS-1r2Ux0jCA-1 X-Mimecast-MFC-AGG-ID: NWfyhj1OPraS-1r2Ux0jCA_1788954949 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B535F1955DDC; Wed, 9 Sep 2026 11:55:48 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A6D5B195608D; Wed, 9 Sep 2026 11:55:44 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, "H. Peter Anvin" Subject: [PATCH v2 10/13] x86/purgatory: Compile purgatory.c with -D__NO_FORTIFY Date: Wed, 9 Sep 2026 13:54:46 +0200 Message-ID: <20260909115455.157093-11-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" A subsequent patch will add #include to to use memzero_explicit() there. This will introduce a conflict with the purgatory code: purgatory.c includes both, the header and the arch/x86/boot/string.h header. The latter provides its own prototypes for a lot of string functions which clash with the fortified macros from . To avoid the problem, compile the code in purgatory.c with -D__NO_FORTIFY, so can properly be included from in the purgatory, too. Signed-off-by: Thomas Huth --- arch/x86/purgatory/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile index 5ce1d42630000..9191e3cffc30b 100644 --- a/arch/x86/purgatory/Makefile +++ b/arch/x86/purgatory/Makefile @@ -12,6 +12,7 @@ $(obj)/sha256.o: $(srctree)/lib/crypto/sha256.c FORCE $(call if_changed_rule,cc_o_c) =20 CFLAGS_sha256.o :=3D -D__DISABLE_EXPORTS -D__NO_FORTIFY +CFLAGS_purgatory.o +=3D -D__NO_FORTIFY =20 # When profile-guided optimization is enabled, llvm emits two different # overlapping text sections, which is not supported by kexec. Remove profi= le --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E869549382 for ; Wed, 9 Sep 2026 11:56:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954962; cv=none; b=FLuv7uovGUE+F8IhxkLhs2fulZYPlytYwOBqP5ZvDePU/hMLfGU3bR5qTbTbKbFKppDDFdNIp7/6taGYOp+tjrJbacWpgZm2/fH6vy1eRJn8giYwdbgGf7pKw0mWzefnjWEnibdcIM81l7h6vEXaxbA5pRCsngk4YWltCMoOOpI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954962; c=relaxed/simple; bh=YRlrtKyXwLbw4eW7KpPvW3BJocezw5keC+TIN5TBhrc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UgCxEe/xlUi70Zqb0OjIbNONcoW8UojFLE1o9aU2lRDnyFE3bYpkQVIaXCGxXTY3BRX2x7DE4C8ecXTjuwbIWJpvLjmZxVBU3HTWGVcJ80jBHFW4yKrNCSCvGNqZx/TrSdCu6GzLL67dJWl/rOxDvaW1/LVdO7WcLCCitSvQTXE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=XmCrSAAX; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="XmCrSAAX" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954959; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yb4CuTUSxfTCYuQhpYM23905HoUYR/P0WubB8WL7ZiU=; b=XmCrSAAX5gDwYL1j0r2aQldrOpemu/yvEpGOsghgT2dQ1NHhFUcSUgstd/e/gdedJUhbvL QbuexUKVkC2nL9WZL5/f38JYx10Ra9xrs4dY2hyq5gn6vWHXlnqZVo8BHDmgkBilux4AwK karmQuc2PBomK4sFa6LfJ1+XnOAUSKY= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-434-x5JThsaLNImD3OvPAT6jUw-1; Wed, 09 Sep 2026 07:55:54 -0400 X-MC-Unique: x5JThsaLNImD3OvPAT6jUw-1 X-Mimecast-MFC-AGG-ID: x5JThsaLNImD3OvPAT6jUw_1788954952 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C36451800622; Wed, 9 Sep 2026 11:55:52 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7D4181956088; Wed, 9 Sep 2026 11:55:49 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v2 11/13] lib/crypto: sha2: Provide functions for zeroizing SHA2 hmac_sha* structures Date: Wed, 9 Sep 2026 13:54:47 +0200 Message-ID: <20260909115455.157093-12-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" In certain cases crypto code functions need to zeroize their local SHA2 hmac_sha*_key or hmac_sha*_ctx structures after use to avoid leaking sensitive material on the stack. Provide hmac_sha*_zeroize_key() and hmac_sha*_zeroize_ctx() helper functions that can be used with __cleanup() to automatically zeroize the structure when it goes out of scope. Signed-off-by: Thomas Huth --- include/crypto/sha2.h | 73 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) diff --git a/include/crypto/sha2.h b/include/crypto/sha2.h index 7bb8fe169daf2..22fbc37ae8407 100644 --- a/include/crypto/sha2.h +++ b/include/crypto/sha2.h @@ -7,6 +7,7 @@ #define _CRYPTO_SHA2_H =20 #include +#include =20 #define SHA224_DIGEST_SIZE 28 #define SHA224_BLOCK_SIZE 64 @@ -210,6 +211,15 @@ struct hmac_sha224_key { struct __hmac_sha256_key key; }; =20 +/** + * hmac_sha224_zeroize_key() - Zeroize an hmac_sha224_key structure + * @key: The hmac_sha224_key to zeroize + */ +static inline void hmac_sha224_zeroize_key(struct hmac_sha224_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha224_ctx - Context for computing HMAC-SHA224 of a message * @ctx: private @@ -218,6 +228,15 @@ struct hmac_sha224_ctx { struct __hmac_sha256_ctx ctx; }; =20 +/** + * hmac_sha224_zeroize_ctx() - Zeroize an hmac_sha224_ctx structure + * @ctx: The hmac_sha224_ctx context to zeroize + */ +static inline void hmac_sha224_zeroize_ctx(struct hmac_sha224_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha224_preparekey() - Prepare a key for HMAC-SHA224 * @key: (output) the key structure to initialize @@ -414,6 +433,15 @@ struct hmac_sha256_key { struct __hmac_sha256_key key; }; =20 +/** + * hmac_sha256_zeroize_key() - Zeroize an hmac_sha256_key structure + * @key: The hmac_sha256_key to zeroize + */ +static inline void hmac_sha256_zeroize_key(struct hmac_sha256_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha256_ctx - Context for computing HMAC-SHA256 of a message * @ctx: private @@ -422,6 +450,15 @@ struct hmac_sha256_ctx { struct __hmac_sha256_ctx ctx; }; =20 +/** + * hmac_sha256_zeroize_ctx() - Zeroize an hmac_sha256_ctx structure + * @ctx: The hmac_sha256_ctx context to zeroize + */ +static inline void hmac_sha256_zeroize_ctx(struct hmac_sha256_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha256_preparekey() - Prepare a key for HMAC-SHA256 * @key: (output) the key structure to initialize @@ -623,6 +660,15 @@ struct hmac_sha384_key { struct __hmac_sha512_key key; }; =20 +/** + * hmac_sha384_zeroize_key() - Zeroize an hmac_sha384_key structure + * @key: The hmac_sha384_key to zeroize + */ +static inline void hmac_sha384_zeroize_key(struct hmac_sha384_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha384_ctx - Context for computing HMAC-SHA384 of a message * @ctx: private @@ -631,6 +677,15 @@ struct hmac_sha384_ctx { struct __hmac_sha512_ctx ctx; }; =20 +/** + * hmac_sha384_zeroize_ctx() - Zeroize an hmac_sha384_ctx structure + * @ctx: The hmac_sha384_ctx context to zeroize + */ +static inline void hmac_sha384_zeroize_ctx(struct hmac_sha384_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha384_preparekey() - Prepare a key for HMAC-SHA384 * @key: (output) the key structure to initialize @@ -798,6 +853,15 @@ struct hmac_sha512_key { struct __hmac_sha512_key key; }; =20 +/** + * hmac_sha512_zeroize_key() - Zeroize an hmac_sha512_key structure + * @key: The hmac_sha512_key to zeroize + */ +static inline void hmac_sha512_zeroize_key(struct hmac_sha512_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha512_ctx - Context for computing HMAC-SHA512 of a message * @ctx: private @@ -806,6 +870,15 @@ struct hmac_sha512_ctx { struct __hmac_sha512_ctx ctx; }; =20 +/** + * hmac_sha512_zeroize_ctx() - Zeroize an hmac_sha512_ctx structure + * @ctx: The hmac_sha512_ctx context to zeroize + */ +static inline void hmac_sha512_zeroize_ctx(struct hmac_sha512_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha512_preparekey() - Prepare a key for HMAC-SHA512 * @key: (output) the key structure to initialize --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B954A550DB1 for ; Wed, 9 Sep 2026 11:56:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954968; cv=none; b=fys5zpOVbmhzt0cQWuiqJYuVqspp9iH0FGY6QcgkAq0E3j8VZx+1ZqAfaLVqOVTV1mKap1NrkLskDg6uE3pnAX22x6FbuQR6gMUCXeCJDsqQ+/b6jkHGjf4Cw3U+PxcXIBJJGNKypXHBs6rhh61U6FhbuaLGkeiw6XJ1xxUJEyk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954968; c=relaxed/simple; bh=HsLRaYuEbq7ZzzRNl6uSIAKV4rQlZ2M6v1OhzKK4PeA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EHWsxxlEUI6wvd3fzGl2OsGcLImjzXsN7QCo1yvvOlJpuqI1AVh8k3MadCRxb3pKazQAWOtDZ7X+TvFeHDdzW0xvVakpPM5SEFsD7kLK+SfobcNulDX/WzlWbVWc3j10k0FyRif49rCINGkLJ4Cfklhc3xkbUNmCvnqJvCTBnAY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=b+DYhiOP; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="b+DYhiOP" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954964; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hUSOoW0g30UFVhZc7yIBkWk1BVCAbM29mk2RKcbK+JY=; b=b+DYhiOPEBzUXzhwFEcgfmHVssRWQPTlOuQcPO/60lUhURaaQSq3HQsM+dw+xGGIvvglG3 n7mO8oY8pCIo9kM1fC6OHRwRHEahVGGkC56SA2b3MRXDAvESDTG1hqXolKm/GjouoOlD/d nW/Y8/16fNaemmJ/Ps/7X+TAVFCrt4Y= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-665-LTe7h3VOOKKbGcjQM4I0FQ-1; Wed, 09 Sep 2026 07:56:01 -0400 X-MC-Unique: LTe7h3VOOKKbGcjQM4I0FQ-1 X-Mimecast-MFC-AGG-ID: LTe7h3VOOKKbGcjQM4I0FQ_1788954959 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id ED3CF19541AC; Wed, 9 Sep 2026 11:55:58 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7D4991956088; Wed, 9 Sep 2026 11:55:53 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel , Paulo Alcantara , Namjae Jeon Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , Ronnie Sahlberg , Shyam Prasad N , Tom Talpey , Bharath SM , linux-cifs@vger.kernel.org, samba-technical@lists.samba.org Subject: [PATCH v2 12/13] smb: client: Use hmac_sha256_zeroize_ctx function to clear hmac_sha256_ctx Date: Wed, 9 Sep 2026 13:54:48 +0200 Message-ID: <20260909115455.157093-13-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" It's just cosmetics, but now that we have a helper function for clearing hmac_sha256_ctx with a __cleanup() statement, we can also use it in the smb client code for good measure. Signed-off-by: Thomas Huth --- fs/smb/client/smb2transport.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c index c407f30e00401..080864b24a0c5 100644 --- a/fs/smb/client/smb2transport.c +++ b/fs/smb/client/smb2transport.c @@ -212,7 +212,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_S= erver_Info *server) unsigned char smb2_signature[SMB2_HMACSHA256_SIZE]; struct kvec *iov =3D rqst->rq_iov; struct smb2_hdr *shdr =3D (struct smb2_hdr *)iov[0].iov_base; - struct hmac_sha256_ctx hmac_ctx; + struct hmac_sha256_ctx hmac_ctx __cleanup(hmac_sha256_zeroize_ctx); struct smb_rqst drqst; __u64 sid =3D le64_to_cpu(shdr->SessionId); u8 key[SMB2_NTLMV2_SESSKEY_SIZE]; @@ -250,7 +250,6 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_S= erver_Info *server) memcpy(shdr->Signature, smb2_signature, SMB2_SIGNATURE_SIZE); =20 memzero_explicit(key, sizeof(key)); - memzero_explicit(&hmac_ctx, sizeof(hmac_ctx)); return rc; } =20 --=20 2.55.0 From nobody Fri Sep 25 19:13:36 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F51754B1D2 for ; Wed, 9 Sep 2026 11:56:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954974; cv=none; b=APiyJ8v1kDbYvBvRL6cEO2ohUAWqjFPeMG7lP7g/uS4Q5deAHSS+8LZgKC+/nW5EcqSaqsvdPBGOEZDfEq53yWCuXZYEE/EehKT0Enw3O6jatY5KuMcstj4RS9LizLGSf2fIyRsDauczXAE2q0vMD7AaIL25TwHHT6eDzbdJeis= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788954974; c=relaxed/simple; bh=LvHU+WY1XnXcp3J6reMyDn4V7yDRysf1KLcYrbeZDcw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eur68l1t8yv+/f/oYBm5X5fJgWNqiBfrkUKnt8YsWy400nxWvAmtFuQUqf46BoiL14KvsYKnR7rRpKKsXxD8ZGz0VbNpuFvLTy8RtLuH5ef7FyQesu6E7z2f76W2s9Pdxid4XUeBNhfMKVx+nFJDrTvoWLU3TLbSAOF2uGQ97ak= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=USrI7Zyt; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="USrI7Zyt" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788954972; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=c4eejlWwd5v95yqiSdhvvCd5zgSHMIu25fflPX5vypA=; b=USrI7ZytmDSG0KDK8JeTaqqE3jJCRoyXknax5IdryPI5PEuiF/B5pzqeiCP3SS2EFq0nQj poKjojZMZlq/g64h8Gv7Ql0nm8gG6WHi/wkDMjORYMQiPXkDiT8xKOMIZRJ/yWGV6W49hB chg5/fbxXsLG9wjwzlWHcZuuvzlYRMo= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-14-8MsdSkmzP-CU4zuPdIGbJA-1; Wed, 09 Sep 2026 07:56:07 -0400 X-MC-Unique: 8MsdSkmzP-CU4zuPdIGbJA-1 X-Mimecast-MFC-AGG-ID: 8MsdSkmzP-CU4zuPdIGbJA_1788954965 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 29D301800627; Wed, 9 Sep 2026 11:56:05 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 18B4A1956088; Wed, 9 Sep 2026 11:55:59 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel , Jonathan Corbet Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , Shuah Khan , Randy Dunlap , linux-doc@vger.kernel.org Subject: [PATCH v2 13/13] lib/crypto: Add documentation about zeroization of key and context data Date: Wed, 9 Sep 2026 13:54:49 +0200 Message-ID: <20260909115455.157093-14-thuth@redhat.com> In-Reply-To: <20260909115455.157093-1-thuth@redhat.com> References: <20260909115455.157093-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Add a central document about zeroization in libcrypto so we don't have to repeat this information in the individual kernel docs of the zeroization functions all over the place. Signed-off-by: Thomas Huth --- .../crypto/libcrypto-zeroization.rst | 129 ++++++++++++++++++ Documentation/crypto/libcrypto.rst | 1 + 2 files changed, 130 insertions(+) create mode 100644 Documentation/crypto/libcrypto-zeroization.rst diff --git a/Documentation/crypto/libcrypto-zeroization.rst b/Documentation= /crypto/libcrypto-zeroization.rst new file mode 100644 index 0000000000000..ba9b05320ad53 --- /dev/null +++ b/Documentation/crypto/libcrypto-zeroization.rst @@ -0,0 +1,129 @@ +.. SPDX-License-Identifier: GPL-2.0-or-later + +Crypto Key Zeroization +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +This document describes the conventions for zeroizing crypto structures in= the +kernel. + +.. contents:: + +Overview +-------- + +Cryptographic key material and intermediate state (such as HMAC contexts) = must +be zeroized after use to prevent sensitive data from lingering on the stac= k or +heap, where it could be leaked through memory disclosure vulnerabilities, +crash dumps, or cold-boot attacks. + +For memory that has been allocated with kmalloc() or a similar function, +kfree_sensitive() should be used instead of kfree() to release the memory. + +For other cases, the kernel provides ``memzero_explicit()`` for clearing t= he +memory. Unlike plain ``memset()``, ``memzero_explicit()`` is guaranteed n= ot +to be optimized away by the compiler, even when the memory being cleared +appears to be dead. + +The crypto library builds on ``memzero_explicit()`` by providing typed +zeroization helpers for each key and context structure. These helpers ser= ve +two purposes: + +1. They make ``__cleanup()`` annotations possible, so that structures on + the stack are automatically zeroized when they go out of scope. + +2. They improve readability by replacing ``memzero_explicit(&key, sizeof(k= ey))`` + with a self-documenting call like ``aes_zeroize_key(&key)``. + + +What to zeroize +--------------- + +The following types of structures hold sensitive material and should be +zeroized after use: + +- **Key structures** (e.g. ``struct aes_key``, ``struct hmac_sha256_key``): + contain expanded round keys or prepared key material. + +- **HMAC/MAC context structures** (e.g. ``struct hmac_sha256_ctx``, + ``struct aes_cmac_ctx``): contain inner and outer hash states derived fr= om + the key. + +- **Hash context structures** (e.g. ``struct sha256_ctx``): may contain + sensitive data being hashed. + +Not all of these require explicit cleanup by callers. Many ``..._final()`` +functions already zeroize their context internally (see `Automatic vs. man= ual +zeroization`_ below). + + +Zeroization helpers +------------------- + +Each crypto structure that callers may need to zeroize should have a +corresponding inline helper function. The naming convention is:: + + _zeroize_(struct _ *p); + +For example:: + + void aes_zeroize_key(struct aes_key *key); + void aes_zeroize_enckey(struct aes_enckey *key); + void hmac_sha256_zeroize_ctx(struct hmac_sha256_ctx *ctx); + void aes_cmac_zeroize_key(struct aes_cmac_key *key); + void aes_cmac_zeroize_ctx(struct aes_cmac_ctx *ctx); + +Each helper is a ``static inline`` function in the algorithm's header that +wraps ``memzero_explicit()``, for example:: + + static inline void hmac_sha256_zeroize_ctx(struct hmac_sha256_ctx *ctx) + { + memzero_explicit(ctx, sizeof(*ctx)); + } + +These helpers should include kernel-doc comments following the standard +conventions:: + + /** + * hmac_sha256_zeroize_ctx() - Zeroize an hmac_sha256_ctx structure + * @ctx: The hmac_sha256_ctx context to zeroize + */ + + +Using __cleanup for automatic zeroization +----------------------------------------- + +The preferred way to zeroize stack-allocated key and context structures is +with the ``__cleanup()`` attribute. This ensures zeroization happens on a= ll +exit paths, including error returns and early exits. + +Note that __cleanup() attributes should not be used in functions that use +"goto" statements. The benefit of cleanup helpers is the removal of "gotos= ", +and that "goto" statements can jump between scopes, so the expectation is +that usage of "goto" and cleanup helpers is never mixed in the same functi= on. + + +Automatic vs. manual zeroization +-------------------------------- + +Many ``..._final()`` functions in the crypto library automatically zeroize +their context before returning. When this is the case, the kernel-doc for= the +function documents it:: + + After finishing, this zeroizes @ctx. So the caller does not need to d= o it. + +In these cases, callers on simple code paths (where ``..._final()`` is alw= ays +reached) do not need to add ``__cleanup()`` or explicit zeroization. +However, ``__cleanup()`` is still recommended whenever there are error pat= hs +that bypass ``..._final()``, as it ensures zeroization on all paths. + +For algorithms where ``_final()`` does *not* zeroize the context (such as = the +SHAKE XOFs, where ``shake_squeeze()`` can be called multiple times), calle= rs +must explicitly zeroize the context by calling the appropriate helper or u= sing +``__cleanup()``, for example:: + + struct shake_ctx ctx __cleanup(shake_zeroize_ctx); + + shake256_init(&ctx); + shake_update(&ctx, data, data_len); + shake_squeeze(&ctx, out, out_len); + /* ctx is automatically zeroized at end of scope */ diff --git a/Documentation/crypto/libcrypto.rst b/Documentation/crypto/libc= rypto.rst index e911e05215979..9533c12caa79d 100644 --- a/Documentation/crypto/libcrypto.rst +++ b/Documentation/crypto/libcrypto.rst @@ -165,4 +165,5 @@ API documentation libcrypto-signature libcrypto-unauth-encryption libcrypto-utils + libcrypto-zeroization sha3 --=20 2.55.0