[PATCH] wireguard: use memzero_explicit() when zeroing handshake key material

Jeroen Robben <[email protected]> Wed, 18 Mar 2026 23:06:38 +0000
Newsgroups com.zx2c4.lists.wireguard
Message-ID <[email protected]>
Replace memset() calls in handshake_zero() with memzero_explicit()
to ensure clearing handshake state is not optimized away by the compiler.

Signed-off-by: Jeroen Robben <[email protected]>
---
 drivers/net/wireguard/noise.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireguard/noise.c b/drivers/net/wireguard/noise.c
index 7eb9a23a3d4d..b8be04549fa6 100644
--- a/drivers/net/wireguard/noise.c
+++ b/drivers/net/wireguard/noise.c
@@ -77,10 +77,10 @@ void wg_noise_handshake_init(struct noise_handshake *ha=
ndshake,
=20
 static void handshake_zero(struct noise_handshake *handshake)
 {
-=09memset(&handshake->ephemeral_private, 0, NOISE_PUBLIC_KEY_LEN);
-=09memset(&handshake->remote_ephemeral, 0, NOISE_PUBLIC_KEY_LEN);
-=09memset(&handshake->hash, 0, NOISE_HASH_LEN);
-=09memset(&handshake->chaining_key, 0, NOISE_HASH_LEN);
+=09memzero_explicit(&handshake->ephemeral_private, NOISE_PUBLIC_KEY_LEN);
+=09memzero_explicit(&handshake->remote_ephemeral, NOISE_PUBLIC_KEY_LEN);
+=09memzero_explicit(&handshake->hash, NOISE_HASH_LEN);
+=09memzero_explicit(&handshake->chaining_key, NOISE_HASH_LEN);
 =09handshake->remote_index =3D 0;
 =09handshake->state =3D HANDSHAKE_ZEROED;
 }
--=20
2.53.0