[PATCH] lib/crypto: chacha20poly1305: Clear chacha_state in xchacha20poly1305_decrypt()

From: Thomas Huth <[email protected]>

The chacha20poly1305_decrypt() already clears it chacha_state at the
end, so xchacha20poly1305_decrypt() should do the same, too, to avoid
leaking sensitive information on the stack. Use a __cleanup() marker
to avoid that we have to do it manually here. For symmetry, use the
__cleanup() marker in chacha20poly1305_decrypt(), too.

Signed-off-by: Thomas Huth <[email protected]>
---
 lib/crypto/chacha20poly1305.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/crypto/chacha20poly1305.c b/lib/crypto/chacha20poly1305.c
index ea42a28f4ff7d..b40377dca8e02 100644
--- a/lib/crypto/chacha20poly1305.c
+++ b/lib/crypto/chacha20poly1305.c
@@ -172,7 +172,7 @@ bool chacha20poly1305_decrypt(u8 *dst, const u8 *src, const size_t src_len,
 			      const u64 nonce,
 			      const u8 key[at_least CHACHA20POLY1305_KEY_SIZE])
 {
-	struct chacha_state chacha_state;
+	struct chacha_state chacha_state __cleanup(chacha_zeroize_state);
 	u32 k[CHACHA_KEY_WORDS];
 	__le64 iv[2];
 	bool ret;
@@ -186,7 +186,6 @@ bool chacha20poly1305_decrypt(u8 *dst, const u8 *src, const size_t src_len,
 	ret = __chacha20poly1305_decrypt(dst, src, src_len, ad, ad_len,
 					 &chacha_state);
 
-	chacha_zeroize_state(&chacha_state);
 	memzero_explicit(iv, sizeof(iv));
 	memzero_explicit(k, sizeof(k));
 	return ret;
@@ -198,7 +197,7 @@ bool xchacha20poly1305_decrypt(u8 *dst, const u8 *src, const size_t src_len,
 			       const u8 nonce[at_least XCHACHA20POLY1305_NONCE_SIZE],
 			       const u8 key[at_least CHACHA20POLY1305_KEY_SIZE])
 {
-	struct chacha_state chacha_state;
+	struct chacha_state chacha_state __cleanup(chacha_zeroize_state);
 
 	xchacha_init(&chacha_state, key, nonce);
 	return __chacha20poly1305_decrypt(dst, src, src_len, ad, ad_len,
-- 
2.55.0