Re: [PATCH v2 1/9] crypto: Provide a wrapper for zeroizing crypto_aes_ctx

[Eric Biggers]

On Mon, Aug 03, 2026 at 11:44:20AM +0200, Thomas Huth wrote:
> From: Thomas Huth <thuth@xxxxxxxxxx>
> 
> Several crypto drivers need to zeroize their local crypto_aes_ctx
> structures after use to avoid leaking key material on the stack.
> Currently some call sites do this with their own memzero_explicit()
> call, which is error-prone since it is easy to miss a return path
> (what already happened in some drivers). Some other call sites miss
> to clear crypto_aes_ctx completely.
> 
> Provide an aes_clear_ctx() helper that can be used with __cleanup()
> to automatically zeroize the context when it goes out of scope.
> 
> Signed-off-by: Thomas Huth <thuth@xxxxxxxxxx>
> ---
>  include/crypto/aes.h | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/include/crypto/aes.h b/include/crypto/aes.h
> index 3279cfa546085..5ca7b1ab50e8c 100644
> --- a/include/crypto/aes.h
> +++ b/include/crypto/aes.h
> @@ -159,6 +159,19 @@ static inline int aes_check_keylen(size_t keylen)
>  int aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key,
>  		  unsigned int key_len);
>  
> +/**
> + * aes_clear_ctx - Zeroize a crypto_aes_ctx structure
> + * @ctx:	The location of the context that should be zeroized
> + *
> + * Explicitly fills the crypto_aes_ctx with zeroes. This should be done
> + * once the context is not required anymore to avoid that its contents
> + * are leaked on the stack or heap.
> + */
> +static inline void aes_clear_ctx(struct crypto_aes_ctx *ctx)
> +{
> +	memzero_explicit(ctx, sizeof(*ctx));
> +}

Acked-by: Eric Biggers <ebiggers@xxxxxxxxxx>

I guess we should start using __cleanup with type-specific zeroization
functions like this more often.  One gotcha is that __cleanup and 'goto'
should not be mixed in the same function; see the comment at
include/linux/cleanup.h line 148.  Patch 8 of this series doesn't follow
that in safexcel_aead_setkey().

- Eric