[PATCH] lib/crypto: aes: use memzero_explicit() instead of memset()

[PATCH] lib/crypto: aes: use memzero_explicit() instead of memset()

[Mohamad Raizudeen]

aes_gcm_decrypt() and aes_ccm_decrypt() use plain memset() to wipe the
output buffer when authentication fails. But the compiler can optimize
that wipe away, so use memzero_explicit() instead of memset().

This matches every other sensitive wipes in this file, which already
uses memzero_explicit() for keystream blocks, tmp buffers, ctx
teardowns.

Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
---
 lib/crypto/aes.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c
index e1c191551736..7814ef525239 100644
--- a/lib/crypto/aes.c
+++ b/lib/crypto/aes.c
@@ -1733,7 +1733,7 @@ int aes_gcm_decrypt(u8 *dst, const u8 *src, size_t data_len, const u8 *authtag,
 		 * Clear the inauthentic decrypted data so that callers won't
 		 * receive it even if they fail to correctly handle errors.
 		 */
-		memset(dst, 0, data_len);
+		memzero_explicit(dst, data_len);
 	}
 	return err;
 }
@@ -2074,7 +2074,7 @@ int aes_ccm_decrypt(u8 *dst, const u8 *src, size_t data_len, const u8 *authtag,
 		 * Clear the inauthentic decrypted data so that callers won't
 		 * receive it even if they fail to correctly handle errors.
 		 */
-		memset(dst, 0, data_len);
+		memzero_explicit(dst, data_len);
 	}
 	return err;
 }
-- 
2.53.0

Re: [PATCH] lib/crypto: aes: use memzero_explicit() instead of memset()

[Eric Biggers]

On Wed, Oct 28, 2026 at 07:56:36PM +0530, Mohamad Raizudeen wrote:
> aes_gcm_decrypt() and aes_ccm_decrypt() use plain memset() to wipe the
> output buffer when authentication fails. But the compiler can optimize
> that wipe away, so use memzero_explicit() instead of memset().
> 
> This matches every other sensitive wipes in this file, which already
> uses memzero_explicit() for keystream blocks, tmp buffers, ctx
> teardowns.
> 
> Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
> ---
>  lib/crypto/aes.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c
> index e1c191551736..7814ef525239 100644
> --- a/lib/crypto/aes.c
> +++ b/lib/crypto/aes.c
> @@ -1733,7 +1733,7 @@ int aes_gcm_decrypt(u8 *dst, const u8 *src, size_t data_len, const u8 *authtag,
>  		 * Clear the inauthentic decrypted data so that callers won't
>  		 * receive it even if they fail to correctly handle errors.
>  		 */
> -		memset(dst, 0, data_len);
> +		memzero_explicit(dst, data_len);

This isn't for "zeroization" (making the data unavailable in ramdumps),
though.  It's just so the caller doesn't accidentally use the
inauthentic data, as the comment right above it states.

- Eric

Re: [PATCH] lib/crypto: aes: use memzero_explicit() instead of memset()

[David Laight]

On Wed, 28 Oct 2026 15:51:34 +0000
Eric Biggers <ebiggers@kernel.org> wrote:

> On Wed, Oct 28, 2026 at 07:56:36PM +0530, Mohamad Raizudeen wrote:
> > aes_gcm_decrypt() and aes_ccm_decrypt() use plain memset() to wipe the
> > output buffer when authentication fails. But the compiler can optimize
> > that wipe away, so use memzero_explicit() instead of memset().
> > 
> > This matches every other sensitive wipes in this file, which already
> > uses memzero_explicit() for keystream blocks, tmp buffers, ctx
> > teardowns.
> > 
> > Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
> > ---
> >  lib/crypto/aes.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/lib/crypto/aes.c b/lib/crypto/aes.c
> > index e1c191551736..7814ef525239 100644
> > --- a/lib/crypto/aes.c
> > +++ b/lib/crypto/aes.c
> > @@ -1733,7 +1733,7 @@ int aes_gcm_decrypt(u8 *dst, const u8 *src, size_t data_len, const u8 *authtag,
> >  		 * Clear the inauthentic decrypted data so that callers won't
> >  		 * receive it even if they fail to correctly handle errors.
> >  		 */
> > -		memset(dst, 0, data_len);
> > +		memzero_explicit(dst, data_len);  
> 
> This isn't for "zeroization" (making the data unavailable in ramdumps),
> though.  It's just so the caller doesn't accidentally use the
> inauthentic data, as the comment right above it states.

It is also a parameter so has to be zeroed anyway.
memzero_explicit() is used to clear on-stack buffers.

David

> 
> - Eric
>