[PATCH v3 02/13] lib/crypto: aes-xts: Provide function for zeroizing aes_xts_key
From: Thomas Huth <hidden>
Date: 2026-09-10 12:41:57
Also in:
lkml
Subsystem:
crypto api, crypto library, library code, the rest · Maintainers:
Herbert Xu, "David S. Miller", Eric Biggers, Jason A. Donenfeld, Ard Biesheuvel, Andrew Morton, Linus Torvalds
In certain cases crypto code functions need to zeroize their local aes_xts_key structures after use to avoid leaking sensitive material. Provide an aes_xts_zeroize_key() helper function that e.g. can be used with __cleanup() to automatically zeroize the struct when it goes out of scope. While we're at it, replace the related memzero_explicit() call in lib/crypto/aes.c with a call to the new helper function. Signed-off-by: Thomas Huth <redacted> --- include/crypto/aes-xts.h | 13 +++++++++++-- lib/crypto/aes.c | 2 +- 2 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/include/crypto/aes-xts.h b/include/crypto/aes-xts.h
index b9e828265e58a..3a52e1cf40b57 100644
--- a/include/crypto/aes-xts.h
+++ b/include/crypto/aes-xts.h@@ -22,6 +22,15 @@ struct aes_xts_key { struct aes_enckey tweak_key; }; +/** + * aes_xts_zeroize_key() - Zeroize an aes_xts_key structure + * @key: The aes_xts_key to zeroize + */ +static inline void aes_xts_zeroize_key(struct aes_xts_key *key) +{ + memzero_explicit(key, sizeof(*key)); +} + /** * aes_xts_preparekey() - Prepare a key for AES-XTS encryption and decryption * @key: (output) The key structure to initialize
@@ -30,8 +39,8 @@ struct aes_xts_key { * @flags: Optional flag XTS_FORBID_WEAK_KEYS to forbid keys whose two halves * are the same. * - * Users should use memzero_explicit() to zeroize the key struct at the end of - * its lifetime. (But if this function fails, zeroization is unnecessary.) + * Users should use aes_xts_zeroize_key() to zeroize the key struct at the end + * of its lifetime. (But if this function fails, zeroization is unnecessary.) * * Context: Any context. * Return:
diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c
index 07c1d912ac365..34ef5deca0a79 100644
--- a/lib/crypto/aes.c
+++ b/lib/crypto/aes.c@@ -1223,7 +1223,7 @@ int aes_xts_preparekey(struct aes_xts_key *key, const u8 *in_key, return 0; out_zeroize: - memzero_explicit(key, sizeof(*key)); + aes_xts_zeroize_key(key); return err; } EXPORT_SYMBOL_GPL(aes_xts_preparekey);
--
2.55.0