From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9624C486E67 for ; Thu, 10 Sep 2026 12:41:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044118; cv=none; b=uZ8Q/ZfRKoelXI3wBdySTuxclCgfXzfTWRwt7+2QriKcCVBCTHlRZFkt4Y4D70eh1LCzzNi6P8L6RnzhUkYZFFRTj4aACULWuqQJitFmeb4ufKc1QC8koJ/1c73f0Ob+QrI56BTYxEHakjZ6U3m/94wnmJhlfmfyuvbHnODQtrs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044118; c=relaxed/simple; bh=qyoMQLJeiLB3R3jNlUUwjIL2eoxPZ7NoHL4nW+PB7jk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Z8X35EXPha6n3Hje4Mtjk173Eg1msiz/qYTZUs3TXBMiL3/XGUWUQ06NYdFw8CCtoiHOqqc9dZZ/3BlxuqafendTC/mY3Y6B4Fv0GFHpYxZeNQ3DBqsJmZccS/cgKoH2LBk8enVIlEUy8GxGSU6aiWFwc8dNV9TX4d+Bq/7ISkU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=I3OCnsAE; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="I3OCnsAE" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044115; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=w8OQ5sTROvl8un9Vo1lqJ9fpMZcWAu8IoU4XAMbOsgU=; b=I3OCnsAEcLdAia123CEXRWikUnyQfvOQX1GYAKhXISWMN/05HLvwG4eUNgZ9gdsESmghoq ERdFro2guVpF3gq78x5Bl4/rNRPjCUJs6KYW/loErbJQWtHsgVkjtnL2Se7v1zaP9WB0tn wUKLZNH34avhEwbOn6y30szvjKUg+0c= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-515-59mnT4cgORuUgcdZu8PnyA-1; Thu, 10 Sep 2026 08:41:50 -0400 X-MC-Unique: 59mnT4cgORuUgcdZu8PnyA-1 X-Mimecast-MFC-AGG-ID: 59mnT4cgORuUgcdZu8PnyA_1789044108 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7CC4A18007EF; Thu, 10 Sep 2026 12:41:48 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B91733000239; Thu, 10 Sep 2026 12:41:44 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v3 01/13] lib/crypto: aes: Provide functions for zeroizing aes_key and aes_enckey Date: Thu, 10 Sep 2026 14:41:20 +0200 Message-ID: <20260910124138.417439-2-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" Some crypto functions need to zeroize their local aes_key or aes_enckey structures after use to avoid leaking sensitive material on the stack. Provide aes_zeroize_key() and aes_zeroize_enckey() helper functions that can be used with __cleanup() to automatically zeroize the structs when they go out of scope. While we're at it, replace the memzero_explicit() calls in lib/crypto/aes.c with the new helper functions. Signed-off-by: Thomas Huth --- include/crypto/aes.h | 18 ++++++++++++++++++ lib/crypto/aes.c | 10 +++++----- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/include/crypto/aes.h b/include/crypto/aes.h index 3279cfa546085..9fe868161e1d3 100644 --- a/include/crypto/aes.h +++ b/include/crypto/aes.h @@ -101,6 +101,15 @@ struct aes_enckey { union aes_enckey_arch k; }; =20 +/** + * aes_zeroize_enckey() - Zeroize an aes_enckey structure + * @key: The aes_enckey to zeroize + */ +static inline void aes_zeroize_enckey(struct aes_enckey *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct aes_key - An AES key prepared for encryption and decryption * @aes_enckey: Common fields and the key prepared for encryption @@ -115,6 +124,15 @@ struct aes_key { union aes_invkey_arch inv_k; }; =20 +/** + * aes_zeroize_key() - Zeroize an aes_key structure + * @key: The aes_key to zeroize + */ +static inline void aes_zeroize_key(struct aes_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /* * Please ensure that the first two fields are 16-byte aligned * relative to the start of the structure, i.e., don't move them! diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c index f1549839b3de0..07c1d912ac365 100644 --- a/lib/crypto/aes.c +++ b/lib/crypto/aes.c @@ -539,7 +539,7 @@ static void __init aes_fips_test(void) if (memcmp(fips_test_data, data, sizeof(data)) !=3D 0) panic("aes: FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_key(&key); } =20 #if IS_ENABLED(CONFIG_CRYPTO_LIB_AES_CBC_MACS) @@ -827,7 +827,7 @@ static void __init aes_ecb_fips_test(void) if (memcmp(fips_test_data, data, sizeof(data)) !=3D 0) panic("aes: ECB FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_key(&key); } #else /* CONFIG_CRYPTO_LIB_AES_ECB */ static inline void aes_ecb_fips_test(void) @@ -1040,7 +1040,7 @@ static void __init aes_cbc_fips_test(void) if (memcmp(fips_test_data, data, sizeof(data)) !=3D 0) panic("aes: CBC FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_key(&key); } =20 /* FIPS cryptographic algorithm self-test for AES-CBC-CTS */ @@ -1069,7 +1069,7 @@ static void __init aes_cbc_cts_fips_test(void) if (memcmp(ptext, data, data_len) !=3D 0) panic("aes: CBC-CTS FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_key(&key); } #else /* CONFIG_CRYPTO_LIB_AES_CBC */ static inline void aes_cbc_fips_test(void) @@ -1194,7 +1194,7 @@ static void __init aes_ctr_fips_test(void) if (memcmp(fips_test_data, data, sizeof(data)) !=3D 0) panic("aes: CTR FIPS self-test failed (wrong plaintext)\n"); =20 - memzero_explicit(&key, sizeof(key)); + aes_zeroize_enckey(&key); } #else /* CONFIG_CRYPTO_LIB_AES_CTR */ static inline void aes_ctr_fips_test(void) --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4FF013DCD95 for ; Thu, 10 Sep 2026 12:42:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044123; cv=none; b=iS9QkFlpN6wQwZvT1C/5spLp9hBbPTw4Ci/F5SxADscEEvwYn0On5SyxS9+F1A0dQBEUbiIW5hDyeZHe3YJvb+CrkvRMPbdM4EckcmANFV6VY0qxyfErR7x/jd2jFUiEwlNSZFMXWxRwPlYJMzGdC1RpBIgLM9Vs/XAEa+5+kv4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044123; c=relaxed/simple; bh=Pu553ZQkM91B4VrsGc9weFb5s0yBfWGWM2iMrF015hs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mpniaJTwQo/Pix7SsB9kUEBdox27ee+1m5WxicLfIAT6oMOkMuByzGS9C6WXYjTG1SWL0dUDOFpnT6Y1O4W7C0lrLFbWka+S7OU74uEtIdzd/itKDgbDs3IsnzJ1eqzuPH3Ae87muT+Xi3fFlmRKEvGDuQPWb4dvbsI8qC/hH+A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=NVPxIY1G; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="NVPxIY1G" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044118; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iKydTuaKi3XtSbexoPJB1tXNpcTYcsS4RpRAKal/7tc=; b=NVPxIY1GcuvUI/CuIkort2MXj5Lik1Nqx/inUT00xvrs9+FIE1P+K5ORYn9DRFoSdBat3X IpIDQXFe4X6vAMMemhmIBM/Ql9yfmTdEps9jrqmlz8B91yz6QhX+vRLO1l3QWeJfrAGuzk 8DBsLsFENIt8muUVioivOCmis2Wm0eE= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-657-UKNCLXBSPXql7KfXoqJSQw-1; Thu, 10 Sep 2026 08:41:55 -0400 X-MC-Unique: UKNCLXBSPXql7KfXoqJSQw-1 X-Mimecast-MFC-AGG-ID: UKNCLXBSPXql7KfXoqJSQw_1789044113 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 458771954214; Thu, 10 Sep 2026 12:41:53 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 594D230001A2; Thu, 10 Sep 2026 12:41:49 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v3 02/13] lib/crypto: aes-xts: Provide function for zeroizing aes_xts_key Date: Thu, 10 Sep 2026 14:41:21 +0200 Message-ID: <20260910124138.417439-3-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" In certain cases crypto code functions need to zeroize their local aes_xts_key structures after use to avoid leaking sensitive material. Provide an aes_xts_zeroize_key() helper function that e.g. can be used with __cleanup() to automatically zeroize the struct when it goes out of scope. While we're at it, replace the related memzero_explicit() call in lib/crypto/aes.c with a call to the new helper function. Signed-off-by: Thomas Huth --- include/crypto/aes-xts.h | 13 +++++++++++-- lib/crypto/aes.c | 2 +- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/include/crypto/aes-xts.h b/include/crypto/aes-xts.h index b9e828265e58a..3a52e1cf40b57 100644 --- a/include/crypto/aes-xts.h +++ b/include/crypto/aes-xts.h @@ -22,6 +22,15 @@ struct aes_xts_key { struct aes_enckey tweak_key; }; =20 +/** + * aes_xts_zeroize_key() - Zeroize an aes_xts_key structure + * @key: The aes_xts_key to zeroize + */ +static inline void aes_xts_zeroize_key(struct aes_xts_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * aes_xts_preparekey() - Prepare a key for AES-XTS encryption and decrypt= ion * @key: (output) The key structure to initialize @@ -30,8 +39,8 @@ struct aes_xts_key { * @flags: Optional flag XTS_FORBID_WEAK_KEYS to forbid keys whose two hal= ves * are the same. * - * Users should use memzero_explicit() to zeroize the key struct at the en= d of - * its lifetime. (But if this function fails, zeroization is unnecessary.) + * Users should use aes_xts_zeroize_key() to zeroize the key struct at the= end + * of its lifetime. (But if this function fails, zeroization is unnecessa= ry.) * * Context: Any context. * Return: diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c index 07c1d912ac365..34ef5deca0a79 100644 --- a/lib/crypto/aes.c +++ b/lib/crypto/aes.c @@ -1223,7 +1223,7 @@ int aes_xts_preparekey(struct aes_xts_key *key, const= u8 *in_key, return 0; =20 out_zeroize: - memzero_explicit(key, sizeof(*key)); + aes_xts_zeroize_key(key); return err; } EXPORT_SYMBOL_GPL(aes_xts_preparekey); --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 80124486E51 for ; Thu, 10 Sep 2026 12:42:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044127; cv=none; b=PuRVEN38hiHjkt7Au1Fn+JtZ0jMPh9t6iAP6Mczg37+2N25CHY8wocNV9hQkXqZareBJuQprC+MiopnWeKtEjULboQcxYXpHML3izSJGuwKF9swVav/5Uttgm9HE59JCShNCtjO/yNfepC7xWTagLxIkoMcFI7/SLfzM3kwQQKw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044127; c=relaxed/simple; bh=4/1kEsT70NlzkN+xrxR35Wl/GIQQI1l/UDDyNSo29h4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FocthPWg/2iiQ6hM+T6FUBv4ImfwodylE9v5glEzM96Cha0FcKw40fmsuk6g/9vEEw8ZN/1W1kbeTS6B4RG8w8ib+ddbC/gHKq3lugBH0LSMvp48zcMMe06wY/YdhPw26O1Qcq86MZvApJ6VOg97voASD3uC+83TiT6iBwLcAM4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=TKTt1jfE; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="TKTt1jfE" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044123; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UEdu/etGA8cxWfcQPyBtvpBW0rX8uyBFZbXJ3IuQEjE=; b=TKTt1jfEs7BlFvAtq7eT55fKl2FRUytt4onY6QT91CrAZ6Lg2I6ALoVOcuCu5EaxX1GRIO rUmDS61GkEfwpgnt4xit7I6DopH7F0vI0+CZJWDxlsO3tNHRtuq6JJv5vyRJn0UBEuExDY OVAH4BLzD0HuK9hT88mCnd/8ajschP0= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-683-BWwW_glNM3CCrhYL_IQcVA-1; Thu, 10 Sep 2026 08:41:59 -0400 X-MC-Unique: BWwW_glNM3CCrhYL_IQcVA-1 X-Mimecast-MFC-AGG-ID: BWwW_glNM3CCrhYL_IQcVA_1789044118 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D11EE1800767; Thu, 10 Sep 2026 12:41:57 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 2C73E30001A2; Thu, 10 Sep 2026 12:41:53 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v3 03/13] lib/crypto: aes-gcm: Provide functions for zeroizing aes_gcm* structures Date: Thu, 10 Sep 2026 14:41:22 +0200 Message-ID: <20260910124138.417439-4-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" In certain cases crypto code needs to zeroize their local aes_gcm_key or aes_gcm_ctx structures after use to avoid leaking sensitive material. Provide aes_gcm_zeroize_key() and aes_gcm_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structures when they go out of scope. While we're at it, replace the related memzero_explicit() calls in lib/crypto/aes.c with calls to the new helper functions. Signed-off-by: Thomas Huth --- include/crypto/aes-gcm.h | 22 ++++++++++++++++++++-- lib/crypto/aes.c | 8 +++----- 2 files changed, 23 insertions(+), 7 deletions(-) diff --git a/include/crypto/aes-gcm.h b/include/crypto/aes-gcm.h index 2aee62f019891..a81b00fd8e27f 100644 --- a/include/crypto/aes-gcm.h +++ b/include/crypto/aes-gcm.h @@ -21,6 +21,15 @@ struct aes_gcm_key { size_t authtag_len; /* Length of authentication tags in bytes */ }; =20 +/** + * aes_gcm_zeroize_key() - Zeroize an aes_gcm_key structure + * @key: The aes_gcm_key to zeroize + */ +static inline void aes_gcm_zeroize_key(struct aes_gcm_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct aes_gcm_ctx - Context for incrementally en/decrypting a message */ @@ -58,6 +67,15 @@ struct aes_gcm_ctx { u64 data_len; }; =20 +/** + * aes_gcm_zeroize_ctx() - Zeroize an aes_gcm_ctx structure + * @ctx: The aes_gcm_ctx to zeroize + */ +static inline void aes_gcm_zeroize_ctx(struct aes_gcm_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * aes_gcm_preparekey() - Prepare a key for AES-GCM encryption and decrypt= ion * @key: (output) The key structure to initialize @@ -66,8 +84,8 @@ struct aes_gcm_ctx { * @authtag_len: Length of the authentication tag in bytes: * 4, 8, 12, 13, 14, 15, or 16. 16 is recommended. * - * Users should use memzero_explicit() to zeroize the key struct at the en= d of - * its lifetime. (But if this function fails, zeroization is unnecessary.) + * Users should use aes_gcm_zeroize_key() to zeroize the key struct at the= end + * of its lifetime. (But if this function fails, zeroization is unnecessa= ry.) * * Context: Any context. * Return: diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c index 34ef5deca0a79..0cb5d7355926e 100644 --- a/lib/crypto/aes.c +++ b/lib/crypto/aes.c @@ -1670,7 +1670,7 @@ void aes_gcm_encrypt_final(struct aes_gcm_ctx *ctx, u= 8 *authtag) ghash_final(&ctx->ghash, ctx->ctr); /* Use ctr as temp buffer */ =20 crypto_xor_cpy(authtag, ctx->ctr, ctx->j0_enc, ctx->key->authtag_len); - memzero_explicit(ctx, sizeof(*ctx)); + aes_gcm_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(aes_gcm_encrypt_final); =20 @@ -1697,7 +1697,7 @@ int aes_gcm_decrypt_final(struct aes_gcm_ctx *ctx, co= nst u8 *authtag) -EBADMSG : 0; out: - memzero_explicit(ctx, sizeof(*ctx)); + aes_gcm_zeroize_ctx(ctx); return err; } EXPORT_SYMBOL_GPL(aes_gcm_decrypt_final); @@ -1742,7 +1742,7 @@ static void __init aes_gcm_fips_test(void) { const size_t data_len =3D sizeof(fips_test_data); u8 buf[sizeof(fips_test_data) + AES_BLOCK_SIZE]; - struct aes_gcm_key key; + struct aes_gcm_key key __cleanup(aes_gcm_zeroize_key); int err; =20 if (aes_gcm_preparekey(&key, fips_test_key, sizeof(fips_test_key), @@ -1760,8 +1760,6 @@ static void __init aes_gcm_fips_test(void) panic("aes: GCM FIPS self-test failed (decryption failed)\n"); if (memcmp(fips_test_data, buf, data_len) !=3D 0) panic("aes: GCM FIPS self-test failed (wrong plaintext)\n"); - - memzero_explicit(&key, sizeof(key)); } #else /* CONFIG_CRYPTO_LIB_AES_GCM */ static inline void aes_gcm_fips_test(void) --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 54525488DB6 for ; Thu, 10 Sep 2026 12:42:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044130; cv=none; b=hwU4GcH5VmMff2svOYwxs1bn0ERQKRkijnqsXQ7UW+s/lHkSnSfp6pmXTZzLC/4EavQ5Fka7VWy/A9nKCjgbJ8HlCGYaLzqrXCtPwezyAmugE+jvPSMbCPquy/J5Z/HVMZjFfz+WtzVSYSrxg12rfS4ZVfE2+Jw0yEufEZralDk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044130; c=relaxed/simple; bh=Gauuyu1weASDOCUOi0niAJFHae1GpPUEFg2Emc3mczQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PxTvUMj5aEjcxYj5jlwlBiddKEcm7AGUQbZ6zqDJKVKhFGq92qXZzhrXR/3Zqxxo2H+ipl7XT2Jt3cbGalRgmWIZ3cbCDMhOHFfE0NZ5JmIwMSBwPsnZ5yWDDbC3FEUXv9Er5n3gsyy8Uc4k6kgwSZDfKTjnsK+2mEu4aaLkZKM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Xj5lWhQ7; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Xj5lWhQ7" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044128; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/X0DqhKQVgSWZ6Kwg3nu2S/S85i2kZoDTzqHkKw8Nxs=; b=Xj5lWhQ7TiLn4oD3UbUVxXXoVPrUUgQ7FcGMWWPUWHeLhOQr0gmluXQuxmm138Bb4H7ruq 68Muq90qpvX0TynJA9u8Pg3Do4Rbf14na6pcsOBpCtcyIEC4gV6x+2EEBjzqQCWRB/5ATZ aYYR1zbN3S5aEKo03Wj8m8orWxcR3C0= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-577-JaQbsh4fNKmp_eeiQqOyVw-1; Thu, 10 Sep 2026 08:42:04 -0400 X-MC-Unique: JaQbsh4fNKmp_eeiQqOyVw-1 X-Mimecast-MFC-AGG-ID: JaQbsh4fNKmp_eeiQqOyVw_1789044122 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D3275195606C; Thu, 10 Sep 2026 12:42:01 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B42D230001A2; Thu, 10 Sep 2026 12:41:58 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v3 04/13] lib/crypto: aes-ccm: Provide functions for zeroizing aes_ccm* structures Date: Thu, 10 Sep 2026 14:41:23 +0200 Message-ID: <20260910124138.417439-5-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" In certain cases crypto code needs to zeroize their local aes_ccm_key or aes_ccm_ctx structures after use to avoid leaking sensitive material. Provide aes_ccm_zeroize_key() and aes_ccm_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structures when they go out of scope. While we're at it, replace the related memzero_explicit() calls in lib/crypto/aes.c with calls to the new helper functions. Signed-off-by: Thomas Huth --- include/crypto/aes-ccm.h | 22 ++++++++++++++++++++-- lib/crypto/aes.c | 8 +++----- 2 files changed, 23 insertions(+), 7 deletions(-) diff --git a/include/crypto/aes-ccm.h b/include/crypto/aes-ccm.h index 8b00859ac4d6b..c52982dd91d2c 100644 --- a/include/crypto/aes-ccm.h +++ b/include/crypto/aes-ccm.h @@ -18,6 +18,15 @@ struct aes_ccm_key { size_t authtag_len; /* Length of authentication tags in bytes */ }; =20 +/** + * aes_ccm_zeroize_key() - Zeroize an aes_ccm_key structure + * @key: The aes_ccm_key to zeroize + */ +static inline void aes_ccm_zeroize_key(struct aes_ccm_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct aes_ccm_ctx - Context for incrementally en/decrypting a message */ @@ -50,6 +59,15 @@ struct aes_ccm_ctx { bool ad_padded; }; =20 +/** + * aes_ccm_zeroize_ctx() - Zeroize an aes_ccm_ctx structure + * @ctx: The aes_ccm_ctx to zeroize + */ +static inline void aes_ccm_zeroize_ctx(struct aes_ccm_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * aes_ccm_preparekey() - Prepare a key for AES-CCM encryption and decrypt= ion * @key: (output) The key structure to initialize @@ -58,8 +76,8 @@ struct aes_ccm_ctx { * @authtag_len: Length of the authentication tag in bytes: * 4, 6, 8, 10, 12, 14, or 16. 16 is recommended. * - * Users should use memzero_explicit() to zeroize the key struct at the en= d of - * its lifetime. (But if this function fails, zeroization is unnecessary.) + * Users should use aes_ccm_zeroize_key() to zeroize the key struct at the= end + * of its lifetime. (But if this function fails, zeroization is unnecessa= ry.) * * Context: Any context. * Return: diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c index 0cb5d7355926e..2d29adca79532 100644 --- a/lib/crypto/aes.c +++ b/lib/crypto/aes.c @@ -2011,7 +2011,7 @@ void aes_ccm_encrypt_final(struct aes_ccm_ctx *ctx, u= 8 *authtag) if (ctx->partial_len) aes_encrypt(&ctx->key->aes, ctx->mac, ctx->mac); crypto_xor_cpy(authtag, ctx->mac, ctx->s0, ctx->key->authtag_len); - memzero_explicit(ctx, sizeof(*ctx)); + aes_ccm_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(aes_ccm_encrypt_final); =20 @@ -2032,7 +2032,7 @@ int aes_ccm_decrypt_final(struct aes_ccm_ctx *ctx, co= nst u8 *authtag) -EBADMSG : 0; out: - memzero_explicit(ctx, sizeof(*ctx)); + aes_ccm_zeroize_ctx(ctx); return err; } EXPORT_SYMBOL_GPL(aes_ccm_decrypt_final); @@ -2084,7 +2084,7 @@ static void __init aes_ccm_fips_test(void) const size_t data_len =3D sizeof(fips_test_data); const size_t nonce_len =3D 13; u8 buf[sizeof(fips_test_data) + AES_BLOCK_SIZE]; - struct aes_ccm_key key; + struct aes_ccm_key key __cleanup(aes_ccm_zeroize_key); int err; =20 if (aes_ccm_preparekey(&key, fips_test_key, sizeof(fips_test_key), @@ -2106,8 +2106,6 @@ static void __init aes_ccm_fips_test(void) panic("aes: CCM FIPS self-test failed (decryption failed)\n"); if (memcmp(fips_test_data, buf, data_len) !=3D 0) panic("aes: CCM FIPS self-test failed (wrong plaintext)\n"); - - memzero_explicit(&key, sizeof(key)); } #else /* CONFIG_CRYPTO_LIB_AES_CCM */ static inline void aes_ccm_fips_test(void) --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1977348987F for ; Thu, 10 Sep 2026 12:42:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044134; cv=none; b=mvOXXMKvAtF/QxYarDLTqO3pKaM93NunfDsKTgvxqOUL1PDI2LNHl/p4kTErUmMVO9X2wP8tzIa5W2L7aRH5AYyNg7C0YUDEH8OOiRIy7EIDDIu613Mk3bJLDLGMi+mq5kYj1KcyjBASLsyotbciextX7GiNLxx5W1A6D83s7X4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044134; c=relaxed/simple; bh=d+vwqEhO/lD2ctFXZn1C2/2N9oPMH8AXcVR0UYYn2jM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e3zG/IEHU1cLmtCyTyOeb9CFdrAANB7VNUotHh8oVA01lt9TO050yH2LBi4qfUByvEM58SXYusDIpXFhTJv34Ky9MjqBrcPlZNNjYEn+3qKIfCx1tSjKKkzh0BwSEDFJwMAfIlWaXs/8g1iD6fkFy1kKSE8husMwfWHJU8scYMo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=dV2yRZnR; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="dV2yRZnR" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044130; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+JeEBAQDGBfdd7h6R58FOX2X8OCTMKwsL/hKMH91GAo=; b=dV2yRZnRWubqQTuzZYQ9jpUVHQgpYFX4W3LVZuW9WMlwSuClpKjSRNOsVaEi1NZuWst85n fMdndJs+InH5rcfoN8HPasvJqnFT9AP3MYg/ny7BLPDr0EneRNXTp4IF7dRT6witdC9Wx7 J0zUYwLXuPUrvdvX9rGc7MTsnU8YwWg= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-634-RFfZgVnAPJ6f1eycoc9NYA-1; Thu, 10 Sep 2026 08:42:07 -0400 X-MC-Unique: RFfZgVnAPJ6f1eycoc9NYA-1 X-Mimecast-MFC-AGG-ID: RFfZgVnAPJ6f1eycoc9NYA_1789044126 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DDC6E1800632; Thu, 10 Sep 2026 12:42:05 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id C77FF30001A2; Thu, 10 Sep 2026 12:42:02 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v3 05/13] lib/crypto: md5: Provide a function for zeroizing hmac_md5 structures Date: Thu, 10 Sep 2026 14:41:24 +0200 Message-ID: <20260910124138.417439-6-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" In certain cases crypto code functions need to zeroize their local hmac_md5_key or hmac_md5_ctx structures after use to avoid leaking sensitive material on the stack. Provide hmac_md5_zeroize_key() and hmac_md5_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structure when it goes out of scope. While we're at it, replace the related memzero_explicit() call in lib/crypto/md5.c with a call to the new helper function. Signed-off-by: Thomas Huth --- include/crypto/md5.h | 19 +++++++++++++++++++ lib/crypto/md5.c | 2 +- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/include/crypto/md5.h b/include/crypto/md5.h index c47aedfe67ecd..1ed89c15b662c 100644 --- a/include/crypto/md5.h +++ b/include/crypto/md5.h @@ -4,6 +4,7 @@ =20 #include #include +#include =20 #define MD5_DIGEST_SIZE 16 #define MD5_HMAC_BLOCK_SIZE 64 @@ -98,6 +99,15 @@ struct hmac_md5_key { struct md5_block_state ostate; }; =20 +/** + * hmac_md5_zeroize_key() - Zeroize an hmac_md5_key structure + * @key: The hmac_md5_key to zeroize + */ +static inline void hmac_md5_zeroize_key(struct hmac_md5_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_md5_ctx - Context for computing HMAC-MD5 of a message * @hash_ctx: private @@ -108,6 +118,15 @@ struct hmac_md5_ctx { struct md5_block_state ostate; }; =20 +/** + * hmac_md5_zeroize_ctx() - Zeroize an hmac_md5_ctx structure + * @ctx: The hmac_md5_ctx context to zeroize + */ +static inline void hmac_md5_zeroize_ctx(struct hmac_md5_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_md5_preparekey() - Prepare a key for HMAC-MD5 * @key: (output) the key structure to initialize diff --git a/lib/crypto/md5.c b/lib/crypto/md5.c index 3d2b017a0525a..a8ee57600012d 100644 --- a/lib/crypto/md5.c +++ b/lib/crypto/md5.c @@ -271,7 +271,7 @@ void hmac_md5_final(struct hmac_md5_ctx *ctx, u8 out[MD= 5_DIGEST_SIZE]) cpu_to_le32_array(ctx->ostate.h, ARRAY_SIZE(ctx->ostate.h)); memcpy(out, ctx->ostate.h, MD5_DIGEST_SIZE); =20 - memzero_explicit(ctx, sizeof(*ctx)); + hmac_md5_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(hmac_md5_final); =20 --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4DA65488DAF for ; Thu, 10 Sep 2026 12:42:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044141; cv=none; b=VP6mlB2yfBUlpAhcYQ2mfnUZvIOAzEzZwIqW6B2d/s5QN5mgxwHlWEkYS3oqM7KLAvDby6HpQRa/kG3PsInq1/qnhRBUA0QMxTYicTwOmr5z/D/qXNFnIvPdHBE27X4rlmDVa9Q0ulVkMaQzw4j+Idu4AMsH7uXfV1sgRVXSPxA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044141; c=relaxed/simple; bh=jlhtz27GSry8dABqGr+SGBe1KYYN8UQBI18T52Q8X+E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LLZolnOgPNoHJf+Q7DnQficpc9cLRejrFRLmkiFQP9gFlmjX3n4r9ieptAaEAWqFRKAK3JKK4DBDkL9QQkOfzZuyACELoVUWm/dUxAm8FGPjG2w8Bdnc+b2KXmrHwIRb9NJE2rDWm0lhIk8w6vcjqlkxUSbkl9GIrW0axwKtPk4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=PtksU38H; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="PtksU38H" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044138; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=T46zRcaSlVLde9uhnONtqfo/sj56j7rPD8ZbLDPStgs=; b=PtksU38HWBniqOnU/0SZqvXDHrT4NRWXzOfVRlQp0MLkTOlvAq6fYnn3QZMfDsUNeF6FLS Ze6vwFjzKGFU1G4FppfoZVwd37cry6db9LLGwpn22SYd/AkNaLQsMS3m8c2N+0hJAEJAyD NjzvePm5Bf2nEHwfWdWY5CeCHCwaCg4= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-283-klihdb6uN42lOfBTdnLaWA-1; Thu, 10 Sep 2026 08:42:11 -0400 X-MC-Unique: klihdb6uN42lOfBTdnLaWA-1 X-Mimecast-MFC-AGG-ID: klihdb6uN42lOfBTdnLaWA_1789044130 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 48E171954AD2; Thu, 10 Sep 2026 12:42:10 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B31293000239; Thu, 10 Sep 2026 12:42:06 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v3 06/13] lib/crypto: sm3: Provide a function for zeroizing the sm3_ctx structure Date: Thu, 10 Sep 2026 14:41:25 +0200 Message-ID: <20260910124138.417439-7-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" In certain cases crypto code functions need to zeroize their local sm3_ctx structure after use to avoid leaking sensitive material. Provide a sm3_zeroize_ctx() helper function that e.g. can be used with __cleanup() to automatically zeroize the structure when it goes out of scope. While we're at it, replace the related memzero_explicit() call in lib/crypto/sm3.c with a call to the new helper function. Signed-off-by: Thomas Huth --- include/crypto/sm3.h | 10 ++++++++++ lib/crypto/sm3.c | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/include/crypto/sm3.h b/include/crypto/sm3.h index 371e8a6617054..d044ca80213ba 100644 --- a/include/crypto/sm3.h +++ b/include/crypto/sm3.h @@ -11,6 +11,7 @@ #define _CRYPTO_SM3_H =20 #include +#include =20 #define SM3_DIGEST_SIZE 32 #define SM3_BLOCK_SIZE 64 @@ -41,6 +42,15 @@ struct sm3_ctx { u8 buf[SM3_BLOCK_SIZE] __aligned(__alignof__(__be64)); }; =20 +/** + * sm3_zeroize_ctx() - Zeroize an sm3_ctx structure + * @ctx: The sm3_ctx to zeroize + */ +static inline void sm3_zeroize_ctx(struct sm3_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * sm3_init() - Initialize an SM3 context for a new message * @ctx: the context to initialize diff --git a/lib/crypto/sm3.c b/lib/crypto/sm3.c index b02b8a247adf2..23059347b4493 100644 --- a/lib/crypto/sm3.c +++ b/lib/crypto/sm3.c @@ -258,7 +258,7 @@ static void __sm3_final(struct sm3_ctx *ctx, u8 out[SM3= _DIGEST_SIZE]) void sm3_final(struct sm3_ctx *ctx, u8 out[SM3_DIGEST_SIZE]) { __sm3_final(ctx, out); - memzero_explicit(ctx, sizeof(*ctx)); + sm3_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(sm3_final); =20 --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E91EF45D911 for ; Thu, 10 Sep 2026 12:42:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044144; cv=none; b=bbvDVcwPf9+8ccu/bcPl8FCSMc5QGpgro0QzFUZkc6KR30oWJp/5zFhn5SDhbi3bilV6iLOY7/ffksHX0rhOhpclbsbssJT8Qp2Oc0eBWs0NnaHH9nFEKpJK1SF6J/U3WONGE61wV+aKRFUse2a3+bz6pmKf+4KSOVuRyUoXbUM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044144; c=relaxed/simple; bh=8Nhgl85UqN7JQx2CBcnw7jYv6wkT5XU8Jx+KGKUJbB0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MMjCPz5kke0aHgqHED96XWx5IPUICHiZ6eT5u5LEMZ2zbp+nMQqiqWwX19mG3Ismx0VlUA5B/G22W2eQjVkKjIhU7xeqtF5rj9ZnUCB1NDgZmMRDdHbwSi+8BIfzB/JM0UTVqvd5f9Cg4aCk8mVF1J6efWkBZ8Eo3XodYxhIYXc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=YtPFd3nK; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="YtPFd3nK" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044141; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ouNZYOOt8CIaEFrfD0VxsHURoh7bbScAMyQARtiv7Dg=; b=YtPFd3nKMBHNQ7zzzpnAt5A6rDcsrb7V2P+ORHW6woCcfAQS+ospQVGv99uOK80feft4rw 1R4QWfsMTk2BTZfuoH+d7rzOqMfAcMWowQ7j9QYBFnro696u+3AIRbQ84FAro/niouJ/nf uD++lxRCvdtPby9Ps6kadVKYoBPiMHo= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-147-A3v72BatP6iKOAO2Q2Fuig-1; Thu, 10 Sep 2026 08:42:16 -0400 X-MC-Unique: A3v72BatP6iKOAO2Q2Fuig-1 X-Mimecast-MFC-AGG-ID: A3v72BatP6iKOAO2Q2Fuig_1789044135 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 825C91800614; Thu, 10 Sep 2026 12:42:14 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6504B30001A2; Thu, 10 Sep 2026 12:42:11 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v3 07/13] lib/crypto: blake2: Provide functions for zeroizing blake2*_ctx structures Date: Thu, 10 Sep 2026 14:41:26 +0200 Message-ID: <20260910124138.417439-8-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" In certain cases crypto code needs to zeroize their local blake2b_ctx or blake2s_ctx structures after use to avoid leaking sensitive material. Provide blake2b_zeroize_ctx() and blake2s_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structures when they go out of scope. While we're at it, replace the related memzero_explicit() calls in lib/crypto/blake2*.c with calls to the new helper functions. Signed-off-by: Thomas Huth --- include/crypto/blake2b.h | 9 +++++++++ include/crypto/blake2s.h | 9 +++++++++ lib/crypto/blake2b.c | 2 +- lib/crypto/blake2s.c | 2 +- 4 files changed, 20 insertions(+), 2 deletions(-) diff --git a/include/crypto/blake2b.h b/include/crypto/blake2b.h index 3bc37fd103a7a..eda1604bce780 100644 --- a/include/crypto/blake2b.h +++ b/include/crypto/blake2b.h @@ -37,6 +37,15 @@ struct blake2b_ctx { unsigned int outlen; }; =20 +/** + * blake2b_zeroize_ctx() - Zeroize a blake2b_ctx structure + * @ctx: The blake2b_ctx to zeroize + */ +static inline void blake2b_zeroize_ctx(struct blake2b_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + enum blake2b_iv { BLAKE2B_IV0 =3D 0x6A09E667F3BCC908ULL, BLAKE2B_IV1 =3D 0xBB67AE8584CAA73BULL, diff --git a/include/crypto/blake2s.h b/include/crypto/blake2s.h index 648cb78243588..bb4e6870ed196 100644 --- a/include/crypto/blake2s.h +++ b/include/crypto/blake2s.h @@ -41,6 +41,15 @@ struct blake2s_ctx { unsigned int outlen; }; =20 +/** + * blake2s_zeroize_ctx() - Zeroize a blake2s_ctx structure + * @ctx: The blake2s_ctx to zeroize + */ +static inline void blake2s_zeroize_ctx(struct blake2s_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + enum blake2s_iv { BLAKE2S_IV0 =3D 0x6A09E667UL, BLAKE2S_IV1 =3D 0xBB67AE85UL, diff --git a/lib/crypto/blake2b.c b/lib/crypto/blake2b.c index 581b7f8486fae..55d6c437f311f 100644 --- a/lib/crypto/blake2b.c +++ b/lib/crypto/blake2b.c @@ -148,7 +148,7 @@ void blake2b_final(struct blake2b_ctx *ctx, u8 *out) blake2b_compress(ctx, ctx->buf, 1, ctx->buflen); cpu_to_le64_array(ctx->h, ARRAY_SIZE(ctx->h)); memcpy(out, ctx->h, ctx->outlen); - memzero_explicit(ctx, sizeof(*ctx)); + blake2b_zeroize_ctx(ctx); } EXPORT_SYMBOL(blake2b_final); =20 diff --git a/lib/crypto/blake2s.c b/lib/crypto/blake2s.c index 71578a0847423..24f7f34334b01 100644 --- a/lib/crypto/blake2s.c +++ b/lib/crypto/blake2s.c @@ -142,7 +142,7 @@ void blake2s_final(struct blake2s_ctx *ctx, u8 *out) blake2s_compress(ctx, ctx->buf, 1, ctx->buflen); cpu_to_le32_array(ctx->h, ARRAY_SIZE(ctx->h)); memcpy(out, ctx->h, ctx->outlen); - memzero_explicit(ctx, sizeof(*ctx)); + blake2s_zeroize_ctx(ctx); } EXPORT_SYMBOL(blake2s_final); =20 --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6DCE3489867 for ; Thu, 10 Sep 2026 12:42:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044151; cv=none; b=DJRGlPq3S4Vrjg8S4ZU3VVE9SfuQteJi7vJEAaDTg0mDN9AeBXdhyC3ttQummXWMXwl/XtNfOBlpoymMsOYQBGeLVIpUI3j1ldmuis47a4ft4Gt5wnH+iD9YeFhHWYRokO1HVCL8CQYnZDwiX1qgzg9k8mmBrp6MhhEXcjE/yDw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044151; c=relaxed/simple; bh=SMz1n2qZSUfU+2cgkcz49kZ4uQA0DD7hBcMOHyDLDOg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oQmrRgXGha8WD1Ly6xGl2H2jEIKk6kWXVbgTJUPHJubzrWzx9kvC/euGiwPrt9rrHQysnOe7sOYq7qfEtxha9V+htiPOpCFL16fvZwr2WOUuwFwmzAF2u9bp7H1eVl2GUCGheqiqBhvzgz0PxgRYG6+qQnF7XOa6Se5mZ8VZqK0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=CbPf6LrA; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="CbPf6LrA" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044147; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YFi1wI0axV9T/N/bsBEiFja16TRKzsIA5VOlO65mHUM=; b=CbPf6LrAhPry/eeS1iWXyijC2A8WA0XiWjECfJDs1/jdtkI4S4rLo8Ay3+VhqPenk2jFkD +FgQP91SFELiR1phf56bhxlvwnLlU/UhncT0tNYcKhWV0M4s7OW4j6S9M1f0Dy1Ml3nT0X xkCYDzTOlQEdbmB6BIjwnZ78EprSrnE= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-102-6Aw1p6L9MhKmBrjsldD0Gw-1; Thu, 10 Sep 2026 08:42:21 -0400 X-MC-Unique: 6Aw1p6L9MhKmBrjsldD0Gw-1 X-Mimecast-MFC-AGG-ID: 6Aw1p6L9MhKmBrjsldD0Gw_1789044139 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E0537180075E; Thu, 10 Sep 2026 12:42:18 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6AE9330001A2; Thu, 10 Sep 2026 12:42:15 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v3 08/13] lib/crypto: sha1: Provide functions for zeroizing hmac_sha1 structures Date: Thu, 10 Sep 2026 14:41:27 +0200 Message-ID: <20260910124138.417439-9-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" In certain cases crypto code needs to zeroize their local hmac_sha1_key or hmac_sha1_ctx structures after use to avoid leaking sensitive material. Provide hmac_sha1_zeroize_key() and hmac_sha1_zeroize_ctx() helper functions that e.g. can be used with __cleanup() to automatically zeroize the structures when they go out of scope. While we're at it, replace the related memzero_explicit() call in lib/crypto/sha1.c with a call to the new helper function. Signed-off-by: Thomas Huth --- include/crypto/sha1.h | 19 +++++++++++++++++++ lib/crypto/sha1.c | 2 +- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/include/crypto/sha1.h b/include/crypto/sha1.h index 4d973e016cd69..bc0046bffeaee 100644 --- a/include/crypto/sha1.h +++ b/include/crypto/sha1.h @@ -7,6 +7,7 @@ #define _CRYPTO_SHA1_H =20 #include +#include =20 #define SHA1_DIGEST_SIZE 20 #define SHA1_BLOCK_SIZE 64 @@ -96,6 +97,15 @@ struct hmac_sha1_key { struct sha1_block_state ostate; }; =20 +/** + * hmac_sha1_zeroize_key() - Zeroize an hmac_sha1_key structure + * @key: The hmac_sha1_key to zeroize + */ +static inline void hmac_sha1_zeroize_key(struct hmac_sha1_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha1_ctx - Context for computing HMAC-SHA1 of a message * @sha_ctx: private @@ -106,6 +116,15 @@ struct hmac_sha1_ctx { struct sha1_block_state ostate; }; =20 +/** + * hmac_sha1_zeroize_ctx() - Zeroize an hmac_sha1_ctx structure + * @ctx: The hmac_sha1_ctx context to zeroize + */ +static inline void hmac_sha1_zeroize_ctx(struct hmac_sha1_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha1_preparekey() - Prepare a key for HMAC-SHA1 * @key: (output) the key structure to initialize diff --git a/lib/crypto/sha1.c b/lib/crypto/sha1.c index b687b89d97cb4..c4361ef77166e 100644 --- a/lib/crypto/sha1.c +++ b/lib/crypto/sha1.c @@ -275,7 +275,7 @@ void hmac_sha1_final(struct hmac_sha1_ctx *ctx, u8 out[= SHA1_DIGEST_SIZE]) for (size_t i =3D 0; i < SHA1_DIGEST_SIZE; i +=3D 4) put_unaligned_be32(ctx->ostate.h[i / 4], out + i); =20 - memzero_explicit(ctx, sizeof(*ctx)); + hmac_sha1_zeroize_ctx(ctx); } EXPORT_SYMBOL_GPL(hmac_sha1_final); =20 --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A23E488742 for ; Thu, 10 Sep 2026 12:42:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044157; cv=none; b=PVJOgAQ/1BDMktrTfA8OZdXZsMFPc3akIHQdDrznx2FBzZXEkpLOfVHTt/AYrz8UemFv9yxZnf2e5NWVd3tVBLT+8q2xuL+YBh5qmTd8JKH+rnNwTp6ngR+8gLYLKJ+Xsagic5Abl/ktLWc1YFEreGwAI8MBX6zL9oeF/xSWXEs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044157; c=relaxed/simple; bh=YA+a6CCA1zWdQPcieNEuLQ0mIwRn0Ck7WsDOY4ql94Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=n9EAZ//fvkqCGYtiMm5TvLfHSM/6ykfeiXJq91wRD35JrJLUx1lyFrMQwCtLiZBBrWGQe6AUM4waAnBTS+qPUhzfaed4HA2kkFHo6EGAoS13/hUBysl1MmZMD9UQPq6aHL8p5B3azcAkCLeUGJcGf2Dz5/eAcUP9LkBD9X7QWiw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=OBajI9Oq; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="OBajI9Oq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044154; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FeWcXK9/x+ZPPaC++IgCQ9jS/VWtgj79RgI0CVq94cU=; b=OBajI9OqHBf3bVnazibaVTi+9UjyUV5BVofFAJrnWuQuq0Cf8EVqySRPEj7pz95msPyu7/ 0Cc5wslmBDbPz42gty4t0x61rv88Baas/KnXHSe5uHkFUotRmzdJtbhRTaptx+l/wBaCN0 yUFIdbJfChC/sjpGqIdQT5CM6CRmU1Q= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-510-_fDLdsfrOGmPiu1KhPeDgg-1; Thu, 10 Sep 2026 08:42:28 -0400 X-MC-Unique: _fDLdsfrOGmPiu1KhPeDgg-1 X-Mimecast-MFC-AGG-ID: _fDLdsfrOGmPiu1KhPeDgg_1789044146 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id EA9721800640; Thu, 10 Sep 2026 12:42:25 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B2AB730001A2; Thu, 10 Sep 2026 12:42:19 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel , James Bottomley , Jarkko Sakkinen , Mimi Zohar , David Howells , Paul Moore , James Morris , "Serge E. Hallyn" Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v3 09/13] security: keys: trusted: always clear the hmac_sha1_ctx before returning Date: Thu, 10 Sep 2026 14:41:28 +0200 Message-ID: <20260910124138.417439-10-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" Clear the hmac_sha1_ctx structure via __cleanup(hmac_sha1_zeroize_ctx) to make sure that the function does not leak sensitive data on the stack when returning without calling hmac_sha1_final(). Reviewed-by: Jarkko Sakkinen Signed-off-by: Thomas Huth --- security/keys/trusted-keys/trusted_tpm1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trus= ted-keys/trusted_tpm1.c index bf0bf7f369705..e5a904b5c1946 100644 --- a/security/keys/trusted-keys/trusted_tpm1.c +++ b/security/keys/trusted-keys/trusted_tpm1.c @@ -101,7 +101,7 @@ static inline void dump_tpm_buf(unsigned char *buf) static int TSS_rawhmac(unsigned char *digest, const unsigned char *key, unsigned int keylen, ...) { - struct hmac_sha1_ctx hmac_ctx; + struct hmac_sha1_ctx hmac_ctx __cleanup(hmac_sha1_zeroize_ctx); va_list argp; unsigned int dlen; unsigned char *data; --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6926C489FC6 for ; Thu, 10 Sep 2026 12:42:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044160; cv=none; b=jicL0yYWVHvHN6hq86pl1bHWb2sifZrgWr6WoffLXgNcDty703IA/LjddDCHnJhUu2isTRGGmFO2VPDZOHQpwB1dTX4Bq53I1wb1qbq/QaewyRSuM8oMBl/mAf9OCdoKUGlNO98aRQLdemLOMkU4kg/LrSekW8sb6pmU1gDf2Yo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044160; c=relaxed/simple; bh=GNqEgrb/+sZ74TXSrcPeteUL+J+8OTzaBVlLilJkm0o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IxC95tSV02lsuC3aQEn3FUxEygbeP+uWas9BS/uF9HXrcMTbTqO5/k8SxaR9LrbDVtOHJLaSXZTXTvto+PmJExtnqQH8T0aLVr1i4P17Ly0hYR73RR7Haq8IZJ3mrc/aQsRIbOisF9yKCPoWldk11lsh7ZUKrnlBEfhOGkSyNTI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Odm4GO+c; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Odm4GO+c" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044158; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=DzI3o5Wk9Ztm1nJZ2Q+wYHNX0B3JnIKhbrRiMd/8awY=; b=Odm4GO+cIxtMCBvt5WSY/j9ytP4ZfepmZnLd6g1JE4OV0SavyCVHD/HTK+NXL+OthIr0jy ivDBKLtobk4zuD+YkJmQqhIVv5HKyovKD5ZNfYvsIJuwADozWoDXmmcLhxzwNlJI2nGT9b QImYJyzBDBrOIebpV9Zq/uij1iXXGmo= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-341-5y99giTJN72VaU_wBkbq0g-1; Thu, 10 Sep 2026 08:42:32 -0400 X-MC-Unique: 5y99giTJN72VaU_wBkbq0g-1 X-Mimecast-MFC-AGG-ID: 5y99giTJN72VaU_wBkbq0g_1789044151 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A830D1800678; Thu, 10 Sep 2026 12:42:30 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 9891E3000239; Thu, 10 Sep 2026 12:42:26 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, "H. Peter Anvin" Subject: [PATCH v3 10/13] x86/purgatory: Compile purgatory.c with -D__NO_FORTIFY Date: Thu, 10 Sep 2026 14:41:29 +0200 Message-ID: <20260910124138.417439-11-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" A subsequent patch will add #include to to use memzero_explicit() there. This will introduce a conflict with the purgatory code: purgatory.c includes both, the header and the arch/x86/boot/string.h header. The latter provides its own prototypes for a lot of string functions which clash with the fortified macros from . To avoid the problem, compile the code in purgatory.c with -D__NO_FORTIFY, so can properly be included from in the purgatory, too. Signed-off-by: Thomas Huth --- arch/x86/purgatory/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile index 5ce1d42630000..9191e3cffc30b 100644 --- a/arch/x86/purgatory/Makefile +++ b/arch/x86/purgatory/Makefile @@ -12,6 +12,7 @@ $(obj)/sha256.o: $(srctree)/lib/crypto/sha256.c FORCE $(call if_changed_rule,cc_o_c) =20 CFLAGS_sha256.o :=3D -D__DISABLE_EXPORTS -D__NO_FORTIFY +CFLAGS_purgatory.o +=3D -D__NO_FORTIFY =20 # When profile-guided optimization is enabled, llvm emits two different # overlapping text sections, which is not supported by kexec. Remove profi= le --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C7C3489FDA for ; Thu, 10 Sep 2026 12:42:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044165; cv=none; b=Iiz98yN5ON5fBYRuvLfirl5VA+iADzJ4iOIOz0lQxhEcD76eS5KYFrT2FJFcn/ZMszwRL8kmC5lel0TNjGsCrTttjAxiogeo9fFrXxrzIHBMDSbifkCgT+68JQDvaWtmiImgfV5xmbIc9HMH3Y1xVpymjpKrbsK8DfV4/BDaWkQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044165; c=relaxed/simple; bh=YRlrtKyXwLbw4eW7KpPvW3BJocezw5keC+TIN5TBhrc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pnQirMw5xdn0c7yc5DPa0RJIjOodsu72Dvs+YHBikUlSaOEJgXq4WwGQ9JiYC8GD+Olv6/ulIME9SRwTnzztNNusEZtGiDme8pigPzvdZJeTS4Y+A/yit191RiA0F58P/dE689BRdEB2UOK1TZqN3QA57Vvs1ddoKYQtGmU7B4I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=delt5dnu; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="delt5dnu" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yb4CuTUSxfTCYuQhpYM23905HoUYR/P0WubB8WL7ZiU=; b=delt5dnuLHDVmv328tzszuRFFu27Ev3UvE7cB4nqjLd6pOZOWoq7ctrbl8XzgOTbPofntn 3jtBBUsFzErqqGnm4qOQuvAr1ezu9dtjCri+Oh6Efy5hX7LaCorB/nuJdJCxf9IZQ5y9QE GxWp7rYfqVw4keWOTkegDq8uX6vq6iY= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-622-_xpFKxjYN-2IpseRsyZXhw-1; Thu, 10 Sep 2026 08:42:36 -0400 X-MC-Unique: _xpFKxjYN-2IpseRsyZXhw-1 X-Mimecast-MFC-AGG-ID: _xpFKxjYN-2IpseRsyZXhw_1789044155 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D508D1954123; Thu, 10 Sep 2026 12:42:34 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 710A530002C4; Thu, 10 Sep 2026 12:42:31 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen Subject: [PATCH v3 11/13] lib/crypto: sha2: Provide functions for zeroizing SHA2 hmac_sha* structures Date: Thu, 10 Sep 2026 14:41:30 +0200 Message-ID: <20260910124138.417439-12-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" In certain cases crypto code functions need to zeroize their local SHA2 hmac_sha*_key or hmac_sha*_ctx structures after use to avoid leaking sensitive material on the stack. Provide hmac_sha*_zeroize_key() and hmac_sha*_zeroize_ctx() helper functions that can be used with __cleanup() to automatically zeroize the structure when it goes out of scope. Signed-off-by: Thomas Huth Reviewed-by: Namjae Jeon --- include/crypto/sha2.h | 73 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) diff --git a/include/crypto/sha2.h b/include/crypto/sha2.h index 7bb8fe169daf2..22fbc37ae8407 100644 --- a/include/crypto/sha2.h +++ b/include/crypto/sha2.h @@ -7,6 +7,7 @@ #define _CRYPTO_SHA2_H =20 #include +#include =20 #define SHA224_DIGEST_SIZE 28 #define SHA224_BLOCK_SIZE 64 @@ -210,6 +211,15 @@ struct hmac_sha224_key { struct __hmac_sha256_key key; }; =20 +/** + * hmac_sha224_zeroize_key() - Zeroize an hmac_sha224_key structure + * @key: The hmac_sha224_key to zeroize + */ +static inline void hmac_sha224_zeroize_key(struct hmac_sha224_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha224_ctx - Context for computing HMAC-SHA224 of a message * @ctx: private @@ -218,6 +228,15 @@ struct hmac_sha224_ctx { struct __hmac_sha256_ctx ctx; }; =20 +/** + * hmac_sha224_zeroize_ctx() - Zeroize an hmac_sha224_ctx structure + * @ctx: The hmac_sha224_ctx context to zeroize + */ +static inline void hmac_sha224_zeroize_ctx(struct hmac_sha224_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha224_preparekey() - Prepare a key for HMAC-SHA224 * @key: (output) the key structure to initialize @@ -414,6 +433,15 @@ struct hmac_sha256_key { struct __hmac_sha256_key key; }; =20 +/** + * hmac_sha256_zeroize_key() - Zeroize an hmac_sha256_key structure + * @key: The hmac_sha256_key to zeroize + */ +static inline void hmac_sha256_zeroize_key(struct hmac_sha256_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha256_ctx - Context for computing HMAC-SHA256 of a message * @ctx: private @@ -422,6 +450,15 @@ struct hmac_sha256_ctx { struct __hmac_sha256_ctx ctx; }; =20 +/** + * hmac_sha256_zeroize_ctx() - Zeroize an hmac_sha256_ctx structure + * @ctx: The hmac_sha256_ctx context to zeroize + */ +static inline void hmac_sha256_zeroize_ctx(struct hmac_sha256_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha256_preparekey() - Prepare a key for HMAC-SHA256 * @key: (output) the key structure to initialize @@ -623,6 +660,15 @@ struct hmac_sha384_key { struct __hmac_sha512_key key; }; =20 +/** + * hmac_sha384_zeroize_key() - Zeroize an hmac_sha384_key structure + * @key: The hmac_sha384_key to zeroize + */ +static inline void hmac_sha384_zeroize_key(struct hmac_sha384_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha384_ctx - Context for computing HMAC-SHA384 of a message * @ctx: private @@ -631,6 +677,15 @@ struct hmac_sha384_ctx { struct __hmac_sha512_ctx ctx; }; =20 +/** + * hmac_sha384_zeroize_ctx() - Zeroize an hmac_sha384_ctx structure + * @ctx: The hmac_sha384_ctx context to zeroize + */ +static inline void hmac_sha384_zeroize_ctx(struct hmac_sha384_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha384_preparekey() - Prepare a key for HMAC-SHA384 * @key: (output) the key structure to initialize @@ -798,6 +853,15 @@ struct hmac_sha512_key { struct __hmac_sha512_key key; }; =20 +/** + * hmac_sha512_zeroize_key() - Zeroize an hmac_sha512_key structure + * @key: The hmac_sha512_key to zeroize + */ +static inline void hmac_sha512_zeroize_key(struct hmac_sha512_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * struct hmac_sha512_ctx - Context for computing HMAC-SHA512 of a message * @ctx: private @@ -806,6 +870,15 @@ struct hmac_sha512_ctx { struct __hmac_sha512_ctx ctx; }; =20 +/** + * hmac_sha512_zeroize_ctx() - Zeroize an hmac_sha512_ctx structure + * @ctx: The hmac_sha512_ctx context to zeroize + */ +static inline void hmac_sha512_zeroize_ctx(struct hmac_sha512_ctx *ctx) +{ + memzero_explicit(ctx, sizeof(*ctx)); +} + /** * hmac_sha512_preparekey() - Prepare a key for HMAC-SHA512 * @key: (output) the key structure to initialize --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9273B488742 for ; Thu, 10 Sep 2026 12:42:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044173; cv=none; b=C17IN/W5oGXiz3oN4bwo3FoLj8/qj4uLXgJrukdwvMK7sFzZ4xfpLjilxF1qqJEMUiTIbpnsFTkkuPoEkpax2dOm8nXi7ZcL237PYz+xfFid5+uG71T5MqO28uNiNZQCxi/deppqn8rBFTpsG7axNCIQg7UNgwlEjivDDxPS6/Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044173; c=relaxed/simple; bh=HsLRaYuEbq7ZzzRNl6uSIAKV4rQlZ2M6v1OhzKK4PeA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sNTNkPvDvAwFKLo0uuEPi07De9luYkoH/hJVwLH09awe92zVh1kobFc9p1lC5wK/rn4LWpm6825cDp8ZQSoE7z+y7syqD+vmju86pothhadZBIIXI4Ez5p0wZ1pNPb95QTfKBQPhjL0oS68uTulq9ARFt5dhR0CfAWT811G7ktw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=GOxuNvRh; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="GOxuNvRh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hUSOoW0g30UFVhZc7yIBkWk1BVCAbM29mk2RKcbK+JY=; b=GOxuNvRhwOg14A2rh6zMAbjsaO1W3oMwRhr6crCREHPlf0syHHgNcPxZR3U2NGc7A0RbKl c1Du1TbbzfO3lUtYWoJzzkf00Gu4nhFPwfzEPuB6bBW5MYEF5rhd0MyOyGPZpVhKWcbouO uIuB88CIDRKx7lFZqICvn3Sd7mCOCjM= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-43-UIXoWfPhPCiSv6Uz3Q3DUA-1; Thu, 10 Sep 2026 08:42:43 -0400 X-MC-Unique: UIXoWfPhPCiSv6Uz3Q3DUA-1 X-Mimecast-MFC-AGG-ID: UIXoWfPhPCiSv6Uz3Q3DUA_1789044161 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E237418005A6; Thu, 10 Sep 2026 12:42:40 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 9208630001A2; Thu, 10 Sep 2026 12:42:35 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel , Paulo Alcantara , Namjae Jeon Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , Ronnie Sahlberg , Shyam Prasad N , Tom Talpey , Bharath SM , linux-cifs@vger.kernel.org, samba-technical@lists.samba.org Subject: [PATCH v3 12/13] smb: client: Use hmac_sha256_zeroize_ctx function to clear hmac_sha256_ctx Date: Thu, 10 Sep 2026 14:41:31 +0200 Message-ID: <20260910124138.417439-13-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" It's just cosmetics, but now that we have a helper function for clearing hmac_sha256_ctx with a __cleanup() statement, we can also use it in the smb client code for good measure. Signed-off-by: Thomas Huth --- fs/smb/client/smb2transport.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c index c407f30e00401..080864b24a0c5 100644 --- a/fs/smb/client/smb2transport.c +++ b/fs/smb/client/smb2transport.c @@ -212,7 +212,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_S= erver_Info *server) unsigned char smb2_signature[SMB2_HMACSHA256_SIZE]; struct kvec *iov =3D rqst->rq_iov; struct smb2_hdr *shdr =3D (struct smb2_hdr *)iov[0].iov_base; - struct hmac_sha256_ctx hmac_ctx; + struct hmac_sha256_ctx hmac_ctx __cleanup(hmac_sha256_zeroize_ctx); struct smb_rqst drqst; __u64 sid =3D le64_to_cpu(shdr->SessionId); u8 key[SMB2_NTLMV2_SESSKEY_SIZE]; @@ -250,7 +250,6 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_S= erver_Info *server) memcpy(shdr->Signature, smb2_signature, SMB2_SIGNATURE_SIZE); =20 memzero_explicit(key, sizeof(key)); - memzero_explicit(&hmac_ctx, sizeof(hmac_ctx)); return rc; } =20 --=20 2.55.0 From nobody Fri Sep 25 16:50:51 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFC2C485958 for ; Thu, 10 Sep 2026 12:42:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044177; cv=none; b=T9zD/+ElJNdipXQOYvQ9TI/R3cOFzJiDUjd0AlGoobllb6necKiiRSzYo05LiS8KdfGCuuB4MjSG8+tnjX02B2DH2au8FyrpOwd7UHqJL+ytIaRz0H1BSKm2HHuqjHeoSCfmnE4g5ppKvZUIz5abPlko6P4bBq0Xo6R0zhOvKMA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789044177; c=relaxed/simple; bh=hyE4ASHNwg9Uj2y/LqFNdaodpbnC/HufT5ZC6lmi+i0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NGNkn1LCgev5+8y5aI2x9AsnyuwTEMwIHit2Pp0hJTCQZqys3vvslnPGpPauW3yr0ew8H48BEvD3G3BfmhEGIwDtTLtzLeR1kFL6HyN620OxqSSNyy9KVkWN194IVcv5ma7QCX9Ama3QgHsSGK7sruRYTVcTfZkQuNoVHNgYWyA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=B3GErHPX; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="B3GErHPX" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1789044170; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wf4K7MwVHeiA8+HVe2UqXYpCXeE1gIwIobNNMMvBsJk=; b=B3GErHPXHJ1CpysmJarqL6H9Rb410jiDgbP5JaBaq/9cbF47ennOM6y397D08U6UEQ/8dO 9HWgXkVQ4/A+UNYAbRr5nGsD3ZITA3mgYmdPHNK4bPmZqnrQtDDwy0SC1ZqQOphDkz6Nom 2H+uaVY18TN4yImvrDGq0FJ1CdOD69w= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-14-acUEBIB3MWuFJTkD2YmIlw-1; Thu, 10 Sep 2026 08:42:49 -0400 X-MC-Unique: acUEBIB3MWuFJTkD2YmIlw-1 X-Mimecast-MFC-AGG-ID: acUEBIB3MWuFJTkD2YmIlw_1789044167 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A04EE1955F6E; Thu, 10 Sep 2026 12:42:46 +0000 (UTC) Received: from thuth-p1g4.redhat.corp (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 0975E30001A2; Thu, 10 Sep 2026 12:42:41 +0000 (UTC) From: Thomas Huth To: Eric Biggers , Herbert Xu , "David S. Miller" , "Jason A. Donenfeld" , Ard Biesheuvel , Jonathan Corbet Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , Shuah Khan , Randy Dunlap , linux-doc@vger.kernel.org Subject: [PATCH v3 13/13] lib/crypto: Add documentation about zeroization of key and context data Date: Thu, 10 Sep 2026 14:41:32 +0200 Message-ID: <20260910124138.417439-14-thuth@redhat.com> In-Reply-To: <20260910124138.417439-1-thuth@redhat.com> References: <20260910124138.417439-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" Add a central document about zeroization in libcrypto so we don't have to repeat this information in the individual kernel docs of the zeroization functions all over the place. Signed-off-by: Thomas Huth --- .../crypto/libcrypto-zeroization.rst | 129 ++++++++++++++++++ Documentation/crypto/libcrypto.rst | 1 + 2 files changed, 130 insertions(+) create mode 100644 Documentation/crypto/libcrypto-zeroization.rst diff --git a/Documentation/crypto/libcrypto-zeroization.rst b/Documentation= /crypto/libcrypto-zeroization.rst new file mode 100644 index 0000000000000..2a12417e335a3 --- /dev/null +++ b/Documentation/crypto/libcrypto-zeroization.rst @@ -0,0 +1,129 @@ +.. SPDX-License-Identifier: GPL-2.0-or-later + +Crypto Key Zeroization +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +This document describes the conventions for zeroizing crypto structures in= the +kernel. + +.. contents:: + +Overview +-------- + +Cryptographic key material and intermediate state (such as HMAC contexts) = must +be zeroized after use to prevent sensitive data from lingering on the stac= k or +heap, where it could be leaked through memory disclosure vulnerabilities, +crash dumps, or cold-boot attacks. + +For memory that has been allocated with kmalloc() or a similar function, +kfree_sensitive() should be used instead of kfree() to release the memory. + +For other cases, the kernel provides memzero_explicit() for clearing the +memory. Unlike plain memset(), memzero_explicit() is guaranteed not +to be optimized away by the compiler, even when the memory being cleared +appears to be dead. + +The crypto library builds on memzero_explicit() by providing typed +zeroization helpers for each key and context structure. These helpers ser= ve +two purposes: + +1. They make __cleanup() annotations possible, so that structures on + the stack are automatically zeroized when they go out of scope. + +2. They improve readability by replacing ``memzero_explicit(&key, sizeof(k= ey))`` + with a self-documenting call like ``aes_zeroize_key(&key)``. + + +What to zeroize +--------------- + +The following types of structures hold sensitive material and should be +zeroized after use: + +- **Key structures** (e.g. ``struct aes_key``, ``struct hmac_sha256_key``): + contain expanded round keys or prepared key material. + +- **HMAC/MAC context structures** (e.g. ``struct hmac_sha256_ctx``, + ``struct aes_cmac_ctx``): contain inner and outer hash states derived fr= om + the key. + +- **Hash context structures** (e.g. ``struct sha256_ctx``): may contain + sensitive data being hashed. + +Not all of these require explicit cleanup by callers. Many ``..._final()`` +functions already zeroize their context internally (see `Automatic vs. man= ual +zeroization`_ below). + + +Zeroization helpers +------------------- + +Each crypto structure that callers may need to zeroize should have a +corresponding inline helper function. The naming convention is:: + + _zeroize_(struct _ *p); + +For example:: + + void aes_zeroize_key(struct aes_key *key); + void aes_zeroize_enckey(struct aes_enckey *key); + void hmac_sha256_zeroize_ctx(struct hmac_sha256_ctx *ctx); + void aes_cmac_zeroize_key(struct aes_cmac_key *key); + void aes_cmac_zeroize_ctx(struct aes_cmac_ctx *ctx); + +Each helper is a ``static inline`` function in the algorithm's header that +wraps ``memzero_explicit()``, for example:: + + static inline void hmac_sha256_zeroize_ctx(struct hmac_sha256_ctx *ctx) + { + memzero_explicit(ctx, sizeof(*ctx)); + } + +These helpers should include kernel-doc comments following the standard +conventions:: + + /** + * hmac_sha256_zeroize_ctx() - Zeroize an hmac_sha256_ctx structure + * @ctx: The hmac_sha256_ctx context to zeroize + */ + + +Using __cleanup for automatic zeroization +----------------------------------------- + +The preferred way to zeroize stack-allocated key and context structures is +with the __cleanup() attribute. This ensures zeroization happens on all +exit paths, including error returns and early exits. + +Note that __cleanup() attributes should not be used in functions that use +"goto" statements. The benefit of cleanup helpers is the removal of "gotos= ", +and that "goto" statements can jump between scopes, so the expectation is +that usage of "goto" and cleanup helpers is never mixed in the same functi= on. + + +Automatic vs. manual zeroization +-------------------------------- + +Many ``..._final()`` functions in the crypto library automatically zeroize +their context before returning. When this is the case, the kernel-doc for= the +function documents it:: + + After finishing, this zeroizes @ctx. So the caller does not need to d= o it. + +In these cases, callers on simple code paths (where ``..._final()`` is alw= ays +reached) do not need to add __cleanup() or explicit zeroization. +However, __cleanup() is still recommended whenever there are error paths +that bypass ``..._final()``, as it ensures zeroization on all paths. + +For algorithms where ``..._final()`` does *not* zeroize the context (such = as +the SHAKE XOFs, where ``shake_squeeze()`` can be called multiple times), +callers must explicitly zeroize the context by calling the appropriate hel= per +or using __cleanup(), for example:: + + struct shake_ctx ctx __cleanup(shake_zeroize_ctx); + + shake256_init(&ctx); + shake_update(&ctx, data, data_len); + shake_squeeze(&ctx, out, out_len); + /* ctx is automatically zeroized at end of scope */ diff --git a/Documentation/crypto/libcrypto.rst b/Documentation/crypto/libc= rypto.rst index e911e05215979..9533c12caa79d 100644 --- a/Documentation/crypto/libcrypto.rst +++ b/Documentation/crypto/libcrypto.rst @@ -165,4 +165,5 @@ API documentation libcrypto-signature libcrypto-unauth-encryption libcrypto-utils + libcrypto-zeroization sha3 --=20 2.55.0