Skip to content

memory.c: add wc_ConstantCompare wrapper. #10867

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
philljj wants to merge 2 commits into
base: master
Choose a base branch
from
Open

memory.c: add wc_ConstantCompare wrapper. #10867

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
69b0905
memory.c: add wc_ConstantCompare wrapper.
philljj Jul 8, 2026
26584bf
linuxkm: remove unneeded misc include.
philljj Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions linuxkm/lkcapi_aes_glue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1523,7 +1523,7 @@ static int AesGcmCrypt_1(struct aead_request *req, int decrypt_p, int rfc4106_p)
out:

if (sg_buf) {
ForceZero(sg_buf, req->assoclen + req->cryptlen);
wc_ForceZero(sg_buf, req->assoclen + req->cryptlen);
free(sg_buf);
}
else {
Expand Down Expand Up @@ -2018,7 +2018,7 @@ static int AesCcmCrypt_1(struct aead_request *req, int decrypt_p, int rfc4309_p)
out:

if (sg_buf) {
ForceZero(sg_buf, req->assoclen + req->cryptlen);
wc_ForceZero(sg_buf, req->assoclen + req->cryptlen);
free(sg_buf);
}
else {
Expand Down
4 changes: 2 additions & 2 deletions linuxkm/lkcapi_dh_glue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -382,7 +382,7 @@ static int km_dh_decode_secret(const u8 * buf, unsigned int len,
static inline void km_dh_clear_keys(struct km_dh_ctx * ctx)
{
if (ctx->priv_key) {
ForceZero(ctx->priv_key, ctx->priv_len);
wc_ForceZero(ctx->priv_key, ctx->priv_len);
free(ctx->priv_key);
ctx->priv_key = NULL;
ctx->priv_len = 0;
Expand Down Expand Up @@ -1014,7 +1014,7 @@ static int km_dh_compute_shared_secret(struct kpp_request *req)

dh_shared_secret_end:
if (shared_secret) {
ForceZero(shared_secret, shared_secret_len);
wc_ForceZero(shared_secret, shared_secret_len);
free(shared_secret);
shared_secret = NULL;
}
Expand Down
2 changes: 1 addition & 1 deletion linuxkm/lkcapi_ecdh_glue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -682,7 +682,7 @@ static int km_ecdh_compute_shared_secret(struct kpp_request *req)

ecdh_shared_secret_end:
if (shared_secret) {
ForceZero(shared_secret, shared_secret_len);
wc_ForceZero(shared_secret, shared_secret_len);
free(shared_secret);
shared_secret = NULL;
}
Expand Down
8 changes: 0 additions & 8 deletions linuxkm/lkcapi_glue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,14 +42,6 @@
#endif
#endif

/* need misc.c for ForceZero(). */
#ifdef NO_INLINE
#include <wolfssl/wolfcrypt/misc.h>
#else
#define WOLFSSL_MISC_INCLUDED
#include <wolfcrypt/src/misc.c>
#endif

#ifndef WOLFSSL_LINUXKM_LKCAPI_PRIORITY
/* Larger number means higher priority. The highest in-tree priority is
* 4001, in the Cavium driver.
Expand Down
22 changes: 11 additions & 11 deletions linuxkm/lkcapi_rsa_glue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -748,7 +748,7 @@ static int km_direct_rsa_enc(struct akcipher_request *req)
rsa_enc_out:
free(enc);
if (dec != NULL) {
ForceZero(dec, req->src_len);
wc_ForceZero(dec, req->src_len);
free(dec);
}

Expand Down Expand Up @@ -853,7 +853,7 @@ static int km_direct_rsa_dec(struct akcipher_request *req)
rsa_dec_out:
free(enc);
if (dec != NULL) {
ForceZero(dec, dec_alloc);
wc_ForceZero(dec, dec_alloc);
free(dec);
}

Expand Down Expand Up @@ -1185,7 +1185,7 @@ static int km_pkcs1pad_sign(struct akcipher_request *req)
err = 0;
pkcs1pad_sign_out:
if (work_buffer) {
ForceZero(work_buffer, 2 * ctx->key_len);
wc_ForceZero(work_buffer, 2 * ctx->key_len);
free(work_buffer);
}

Expand Down Expand Up @@ -1300,7 +1300,7 @@ static int km_pkcs1pad_verify(struct akcipher_request *req)
goto pkcs1pad_verify_out;
}

n_diff = ConstantCompare(sig, msg, dec_len);
n_diff = wc_ConstantCompare(sig, msg, dec_len);
if (unlikely(n_diff != 0)) {
err = -EKEYREJECTED;
goto pkcs1pad_verify_out;
Expand Down Expand Up @@ -1442,7 +1442,7 @@ static int km_pkcs1_sign(struct crypto_sig *tfm,
#endif /* linux >= 6.15.0 */
pkcs1_sign_out:
if (msg != NULL) {
ForceZero(msg, ctx->key_len);
wc_ForceZero(msg, ctx->key_len);
free(msg);
}

Expand Down Expand Up @@ -1556,7 +1556,7 @@ static int km_pkcs1_verify(struct crypto_sig *tfm,
goto pkcs1_verify_out;
}

n_diff = ConstantCompare(enc_digest, msg, enc_msg_len);
n_diff = wc_ConstantCompare(enc_digest, msg, enc_msg_len);
if (unlikely(n_diff != 0)) {
#ifdef WOLFKM_DEBUG_RSA
pr_err("error: %s: recovered msg did not match digest: %d\n",
Expand Down Expand Up @@ -1771,7 +1771,7 @@ static int km_pkcs1pad_enc(struct akcipher_request *req)
pkcs1_enc_out:
free(enc);
if (dec != NULL) {
ForceZero(dec, req->src_len);
wc_ForceZero(dec, req->src_len);
free(dec);
}

Expand Down Expand Up @@ -1863,7 +1863,7 @@ static int km_pkcs1pad_dec(struct akcipher_request *req)
pkcs1_dec_out:
free(enc);
if (dec != NULL) {
ForceZero(dec, dec_alloc);
wc_ForceZero(dec, dec_alloc);
free(dec);
}

Expand Down Expand Up @@ -2430,7 +2430,7 @@ static int linuxkm_test_rsa_driver(const char * driver, int nbits)
free(pub);
if (priv) {
if (priv_len > 0)
ForceZero(priv, priv_len);
wc_ForceZero(priv, priv_len);
free(priv);
}
free(plaintext);
Expand Down Expand Up @@ -2961,7 +2961,7 @@ static int linuxkm_test_pkcs1pad_driver(const char * driver, int nbits,
crypto_free_akcipher(tfm);
if (priv) {
if (priv_len > 0)
ForceZero(priv, priv_len);
wc_ForceZero(priv, priv_len);
free(priv);
}
free(pub);
Expand Down Expand Up @@ -3329,7 +3329,7 @@ static int linuxkm_test_pkcs1_driver(const char * driver, int nbits,
crypto_free_sig(tfm);
if (priv) {
if (priv_len > 0)
ForceZero(priv, priv_len);
wc_ForceZero(priv, priv_len);
free(priv);
}
free(pub);
Expand Down
8 changes: 4 additions & 4 deletions linuxkm/lkcapi_sha_glue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -822,7 +822,7 @@ WC_MAYBE_UNUSED static int km_hmac_init(struct shash_desc *desc) {

ret = wc_HmacCopy(&p_ctx->wc_hmac, t_ctx->wc_hmac);
if (ret != 0) {
ForceZero(t_ctx->wc_hmac, sizeof *t_ctx->wc_hmac);
wc_ForceZero(t_ctx->wc_hmac, sizeof *t_ctx->wc_hmac);
free(t_ctx->wc_hmac);
t_ctx->wc_hmac = NULL;
return -EINVAL;
Expand Down Expand Up @@ -1421,7 +1421,7 @@ static ssize_t wc_get_random_bytes_user(struct iov_iter *iter) {

(void)wc_rng_bank_default_checkin(&current_default_wc_rng_bank);

ForceZero(block, sizeof(block));
wc_ForceZero(block, sizeof(block));

if (total_copied == 0) {
if (ret == 0)
Expand Down Expand Up @@ -1485,7 +1485,7 @@ static ssize_t wc_extract_crng_user(void __user *buf, size_t nbytes) {

(void)wc_rng_bank_default_checkin(&current_default_wc_rng_bank);

ForceZero(block, sizeof(block));
wc_ForceZero(block, sizeof(block));

if ((total_copied == 0) && (ret == 0)) {
ret = -ECANCELED;
Expand Down Expand Up @@ -1726,7 +1726,7 @@ static int wc_get_random_bytes_user_kretprobe_enter(struct kretprobe_instance *p
#endif
}

ForceZero(block, sizeof(block));
wc_ForceZero(block, sizeof(block));

if ((total_copied == 0) && (ret == 0))
total_copied = (size_t)(-EFAULT);
Expand Down
9 changes: 9 additions & 0 deletions wolfcrypt/src/memory.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1685,6 +1685,15 @@ void wc_ForceZero(void *mem, size_t len)
}
#endif

#ifndef WOLFSSL_NO_CONST_CMP
/* Exported version of ConstantCompare(). */
int wc_ConstantCompare(const byte* a, const byte* b, int length)

{
return ConstantCompare(a, b, length);
}
#endif

#ifdef WC_DEBUG_CIPHER_LIFECYCLE
static const byte wc_debug_cipher_lifecycle_tag_value[] =
{ 'W', 'o', 'l', 'f' };
Expand Down
4 changes: 4 additions & 0 deletions wolfssl/wolfcrypt/memory.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,6 +335,10 @@ WOLFSSL_LOCAL void wc_MemZero_Check(void* addr, size_t len);
WOLFSSL_API void wc_ForceZero(void *mem, size_t len);
#endif

#ifndef WOLFSSL_NO_CONST_CMP
WOLFSSL_API int wc_ConstantCompare(const byte* a, const byte* b, int length);
#endif

#ifdef WC_DEBUG_CIPHER_LIFECYCLE
WOLFSSL_LOCAL int wc_debug_CipherLifecycleInit(void **CipherLifecycleTag,
void *heap);
Expand Down
Loading