On Wed, Aug 12, 2026 at 06:33:33PM +0200, Thomas Huth wrote: > It's maybe not worth the effort for hmac_sha1_ctx right now (since there > is only one spot that forgot to zeroize the structure in case of errors), > but offering a function for zeroizing the data via __cleanup might help to > get future code into the proper shape right from the start. Thus let's > introduce a hmac_sha1_zeroize_ctx() function now and use it in the > appropriate spots. > > Thomas Huth (3): > crypto: Provide a wrapper for zeroizing hmac_sha1_ctx > security: keys: trusted: always clear the hmac_sha1_ctx before > returning > lib/crypto: sha1: Use hmac_sha1_zeroize_ctx() instead of > memzero_explicit() > > include/crypto/sha1.h | 17 +++++++++++++++++ > lib/crypto/sha1.c | 2 +- > security/keys/trusted-keys/trusted_tpm1.c | 2 +- > 3 files changed, 19 insertions(+), 2 deletions(-) > > -- > 2.55.0 >
Looks right to me: For 1-3: Reviewed-by: Jarkko Sakkinen <[email protected]> BR, Jarkko
