Re: [PATCH] lib/crypto: aes: use memzero_explicit() instead of memset()

[Eric Biggers <ebiggers@kernel.org>]

On Wed, Oct 28, 2026 at 07:56:36PM +0530, Mohamad Raizudeen wrote:
> aes_gcm_decrypt() and aes_ccm_decrypt() use plain memset() to wipe the
> output buffer when authentication fails. But the compiler can optimize
> that wipe away, so use memzero_explicit() instead of memset().
> 
> This matches every other sensitive wipes in this file, which already
> uses memzero_explicit() for keystream blocks, tmp buffers, ctx
> teardowns.
> 
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
> ---
>  lib/crypto/aes.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c
> index e1c191551736..7814ef525239 100644
> --- a/lib/crypto/aes.c
> +++ b/lib/crypto/aes.c
> @@ -1733,7 +1733,7 @@ int aes_gcm_decrypt(u8 *dst, const u8 *src, size_t data_len, const u8 *authtag,
>  		 * Clear the inauthentic decrypted data so that callers won't
>  		 * receive it even if they fail to correctly handle errors.
>  		 */
> -		memset(dst, 0, data_len);
> +		memzero_explicit(dst, data_len);

This isn't for "zeroization" (making the data unavailable in ramdumps),
though.  It's just so the caller doesn't accidentally use the
inauthentic data, as the comment right above it states.

- Eric