From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E65933CF212 for ; Sat, 3 Oct 2026 09:28:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791019727; cv=none; b=efOOSNXMtU/GMiRSBRVl8OQfoqXP7uXImrV8wYGHGvVL+fdjgxIZLfA1hG3nqDWiVCrOwCZVcTnMjk1ZTyEvbrSpCJW8uVued8O6XpHzD9pL9UtczjLVX+x/8CDNansVBWMZ0jagw+oqYGZG7mARdHj0XTDbO3EM5hPu5ALZ7Gk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791019727; c=relaxed/simple; bh=Sfk0UwJ3tjklr8atozqCktFvsFL6wQOpuL9pPk57400=; h=MIME-Version:Date:From:To:Cc:Message-Id:In-Reply-To:References: Subject:Content-Type; b=tIOYVJAPzyKGEy9VXifMzMiHm8cJ6uNm+HhMn6kj8CBsuSVOEN/waUYpLE/0lto8JzrmrLrlpNtP5XMkT1CoD6WwUWpb4SIyDgyzvBIQ2t1UtDF+a/CyNgjMZuWQaCCxibw3o5GN/pzdEX36qytIjDmWte7wocjJDx3iuvwlVZY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=PkOxg/6N; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="PkOxg/6N" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DE9F21F0089B; Sat, 3 Oct 2026 09:28:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791019724; bh=NXHTDGFzDR1i3PJvTQnsk21+Bd0QI0atro2c8qzup6Q=; h=Date:From:To:Cc:In-Reply-To:References:Subject; b=PkOxg/6NOkWaRJw2lRcg3Q3ZHZoZ7UvNTmcJH5PBroF2UGaXihmHiIkDBFth/zFc4 AfWAbn5LzCjCKkRktxiRt0q8zG2NLNAVGwe6FFCyiucxm2YBB/cVCECuv8Fyo0fgNx hEKpOhATEsk1o6iHodM2phuPASx3KfpytVgyuUqvMHmHbrRkLosSU1W6dEtP3l2tnf jfSX26fYLqEGGE8NMewzp7PCr6+OtB64OSs5XGDOQICulsqDTmafvktiWs6kLQNuKv TxxEpLrZ8ZmshAN3vEUZ4Re38MSGuMcH9acVY2fK0Yxu960jOEa81wmvpvo2ehXPnu fpqK168GpF/qg== Received: from ams-compute-02.internal (ams-compute-02.internal [10.64.2.62]) by mailfauth.ams.internal (Postfix) with ESMTP id 6DEE7198004A; Sat, 3 Oct 2026 05:28:42 -0400 (EDT) Received: from ams-imap-11 ([10.64.2.31]) by ams-compute-02.internal (MEProxy); Sat, 03 Oct 2026 05:28:42 -0400 X-ME-Sender: X-ME-Proxy-Cause: dmFkZTGUOpTrvF/UVMRbKIW2rMITUrWTIbqE0HIdGbdFFk0eqaRrYo3fXpLhvBwMPblllr n+5t7M7F/mcPFRv+mJPQN6MX3tnaCJmh7UHJlLPRzTbb/HrruLCqYzOdGsI03JyJIWT4jC 3aFkCv5KSpy5ClJ8cP8t8HsARwOyLXQP+BDpE0REpoDWqq4vm17F2CNU+Rf4E6i63Rqdc7 oZ/gUa6I22JuWZU6U0ZGnGrozSpkCRcSwlbHwR3Yr/5UYAjBT4lM7yeR0IMAB29k/txrn2 p7f7PzSEQIkcEI5IesFSZRRvdoIx5I5psCZ14IwyBlCz7lUbfOFZWOyO66mc+1EwlTwrlW ZnZ8Hc2LE3aIEp3TqRjLFBGhs/iQNYE7PSJnzrmpe0/3Oo9UvTIv4VtNVdR6BAOo+zh2s9 nFu3NlXbodGxglR7L25Cqd8RdKNpfbNr65VCxx8GFCf/JWTNlTlsS1sY6BpnDs3dqgOoq9 3SNTs6o18Hu9FSq65irCzkU6yNetbmE70BFzk8FEDhHiv1TjI+TGpNwlmLR1JqPJ9UsdDm NMzZsGwtDW+DkbWpwYLY4p9E+ePlTA49RT0rC544jXRRwiBy2CDSs+UCsKndOh0lrMVFN2 bGLt1DmutxIHejDjX3MWr/4pptCv2d3p7XLzQFBGANNVbha1ofE0VcjmnWMg X-ME-Proxy: Feedback-ID: ice86485a:Fastmail Received: by mailuser.ams.internal (Postfix, from userid 501) id 2139EF8008E; Sat, 3 Oct 2026 05:28:40 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Date: Sat, 03 Oct 2026 11:28:20 +0200 From: "Ard Biesheuvel" To: "Eric Biggers" Cc: "Mohamad Raizudeen" , "Jason A . Donenfeld" , "Shuah Khan" , me@brighamcampbell.com, jkoolstra@xs4all.nl, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Message-Id: In-Reply-To: <20261003085757.GA144870@quark> References: <20261003060826.7792-1-raizudeen.kerneldev@gmail.com> <20261003085757.GA144870@quark> Subject: Re: [PATCH] crypto: chacha20poly1305 - Fix missing state zeroization in xchacha decrypt Content-Type: text/plain Content-Transfer-Encoding: 7bit On Sat, 3 Oct 2026, at 10:57, Eric Biggers wrote: > On Sat, Oct 03, 2026 at 09:34:21AM +0200, Ard Biesheuvel wrote: >> >> >> On Sat, 3 Oct 2026, at 08:08, Mohamad Raizudeen wrote: >> > The `__chacha20poly1305_decrypt` function does not zeroize the chacha >> > state, unlike its encrypt counterpart. The regular >> > `chacha20poly1305_decrypt` function handles this by manually calling >> > chacha_zeroize_state(). However, `xchacha20poly1305_decrypt` returns >> > the result directly without clearing the state. >> > >> > This leaves the derived chacha20 subkey on the stack after the function >> > returns. Fix this by storing the return value, calling >> > chacha_zeroize_state() and then returning the result, matching the >> > logic in `chacha20poly1305_decrypt`. >> > >> > Fixes: ed20078b7e333 ("crypto: chacha20poly1305 - import construction >> > and selftest from Zinc") >> > Cc: stable@vger.kernel.org >> > Signed-off-by: Mohamad Raizudeen >> > --- >> > lib/crypto/chacha20poly1305.c | 5 ++++- >> > 1 file changed, 4 insertions(+), 1 deletion(-) >> > >> > diff --git a/lib/crypto/chacha20poly1305.c >> > b/lib/crypto/chacha20poly1305.c >> > index ea42a28f4ff7..03b14d272520 100644 >> > --- a/lib/crypto/chacha20poly1305.c >> > +++ b/lib/crypto/chacha20poly1305.c >> > @@ -199,10 +199,13 @@ bool xchacha20poly1305_decrypt(u8 *dst, const u8 >> > *src, const size_t src_len, >> > const u8 key[at_least CHACHA20POLY1305_KEY_SIZE]) >> > { >> > struct chacha_state chacha_state; >> > + bool ret; >> > >> > xchacha_init(&chacha_state, key, nonce); >> > - return __chacha20poly1305_decrypt(dst, src, src_len, ad, ad_len, >> > + ret = __chacha20poly1305_decrypt(dst, src, src_len, ad, ad_len, >> > &chacha_state); >> > + chacha_zeroize_state(&chacha_state); >> > + return ret; >> > } >> > EXPORT_SYMBOL(xchacha20poly1305_decrypt); >> > >> >> Wouldn't it be better to move the existing call from chacha20poly1305_decrypt() >> to __chacha20poly1305_decrypt()? > > Since __chacha20poly1305_decrypt() has two return statements that would > need to be considered, I think this patch (which makes each > *chacha_init() clearly paired with chacha_zeroize_state()) is slightly > cleaner. > Fair enough.