From f5bd17a8b558173f54d39b465998b07c05de50ca Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sat, 18 Jul 2026 13:56:06 -0700 Subject: [PATCH] fscrypt: Replace some variable-size memsets with fixed-size For zeroing IVs and raw keys, remove the misguided optimization of zeroing the actual size used (typically 16 and 64 bytes respectively) instead of the max size (32 and 64 bytes respectively). Using a compile-time constant size allows the compiler to specialize the memset for that size (typically by inlining a few 'mov' instructions), which is more important than zeroing a few extra bytes with these small sizes. Link: https://patch.msgid.link/20260718205606.50713-1-ebiggers@kernel.org Signed-off-by: Eric Biggers --- fs/crypto/crypto.c | 2 +- fs/crypto/keysetup.c | 4 ++-- fs/crypto/keysetup_v1.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c index c91eda62f9a4..5286a124b0d9 100644 --- a/fs/crypto/crypto.c +++ b/fs/crypto/crypto.c @@ -83,7 +83,7 @@ void fscrypt_generate_iv(union fscrypt_iv *iv, u64 index, { u8 flags = fscrypt_policy_flags(&ci->ci_policy); - memset(iv, 0, ci->ci_mode->ivsize); + memset(iv, 0, sizeof(*iv)); if (flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) { WARN_ON_ONCE(index > U32_MAX); diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c index c9041f245246..892044ebcaca 100644 --- a/fs/crypto/keysetup.c +++ b/fs/crypto/keysetup.c @@ -267,7 +267,7 @@ static int setup_per_mode_enc_key(struct fscrypt_inode_info *ci, hkdf_info, hkdf_infolen, raw_mode_key, mode->keysize); err = fscrypt_prepare_key(prep_key, raw_mode_key, ci); - memzero_explicit(raw_mode_key, mode->keysize); + memzero_explicit(raw_mode_key, sizeof(raw_mode_key)); } if (err) { kfree(new_node); @@ -397,7 +397,7 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_inode_info *ci, ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE, derived_key, ci->ci_mode->keysize); err = fscrypt_set_per_file_enc_key(ci, derived_key); - memzero_explicit(derived_key, ci->ci_mode->keysize); + memzero_explicit(derived_key, sizeof(derived_key)); } if (err) return err; diff --git a/fs/crypto/keysetup_v1.c b/fs/crypto/keysetup_v1.c index 7e3a58dc4b56..87fe13ccb253 100644 --- a/fs/crypto/keysetup_v1.c +++ b/fs/crypto/keysetup_v1.c @@ -251,7 +251,7 @@ static int setup_v1_file_key_derived(struct fscrypt_inode_info *ci, err = fscrypt_set_per_file_enc_key(ci, derived_key); - memzero_explicit(derived_key, derived_keysize); + memzero_explicit(derived_key, sizeof(derived_key)); /* No need to zeroize 'aes', as its key is not secret. */ return err; }