Re: [PATCH v2 0/1] Fix missing mem scrub at clear key import in cca_clr2cipherkey()

On Wed, Jul 29, 2026 at 04:01:33PM +0200, Harald Freudenberger wrote:
> The helper function _ip_cprb_helper() uses internal buffer memory for
> building and processing CPRBs. After use this buffer was never
> scrubbed which could lead to leaving for example clear key material in
> memory which could be exposed via tricky reuse of this same memory.
> 
> Extent the _ip_cprb_helper() function with another parameter 'scrub'
> used to steer scrubbing of this buffer. So now the caller has the
> opportunity to decide if scrubbing is needed or not.
> 
> Extent the clear key to secure key token import process in function
> cca_clr2cipherkey() to tell the helper function from above to scrub
> the cprb buffer when the clear key value is part of the request data.
> 
> Add explicit scrubbing on return from function cca_clr2cipherkey() for
> the random EXOR buffer and the cprb buffer.
> 
> Overall this cleans the internal used buffer in case of clear key
> import to prevent sensitive data to get exposed.
> 
> Changelog:
> v1: initial version
> v2: added explicit scrubbing on return of cca_clr2cipherkey()
> 
> Harald Freudenberger (1):
>   s390/zcrypt: Fix missing mem scrub at clear key import in
>     cca_clr2cipherkey()
> 
>  drivers/s390/crypto/zcrypt_ccamisc.c | 19 +++++++++++++------
>  1 file changed, 13 insertions(+), 6 deletions(-)

Applied, thank you!