[PATCH] fscrypt: Replace some variable-size memsets with fixed-size

[PATCH] fscrypt: Replace some variable-size memsets with fixed-size

[Eric Biggers]

For zeroing IVs and raw keys, remove the misguided optimization of
zeroing the actual size used (typically 16 and 64 bytes respectively)
instead of the max size (32 and 64 bytes respectively).  Using a
compile-time constant size allows the compiler to specialize the memset
for that size (typically by inlining a few 'mov' instructions), which
is more important than zeroing a few extra bytes with these small sizes.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 fs/crypto/crypto.c      | 2 +-
 fs/crypto/keysetup.c    | 4 ++--
 fs/crypto/keysetup_v1.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
index 94dd6c89ddcd..3a280dcecc11 100644
--- a/fs/crypto/crypto.c
+++ b/fs/crypto/crypto.c
@@ -91,7 +91,7 @@ void fscrypt_generate_iv(union fscrypt_iv *iv, u64 index,
 {
 	u8 flags = fscrypt_policy_flags(&ci->ci_policy);
 
-	memset(iv, 0, ci->ci_mode->ivsize);
+	memset(iv, 0, sizeof(*iv));
 
 	if (flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) {
 		WARN_ON_ONCE(index > U32_MAX);
diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c
index cfd348e2252e..348e05283ee4 100644
--- a/fs/crypto/keysetup.c
+++ b/fs/crypto/keysetup.c
@@ -282,7 +282,7 @@ static int setup_per_mode_enc_key(struct fscrypt_inode_info *ci,
 				    hkdf_info, hkdf_infolen, raw_mode_key,
 				    mode->keysize);
 		err = fscrypt_prepare_key(prep_key, raw_mode_key, ci);
-		memzero_explicit(raw_mode_key, mode->keysize);
+		memzero_explicit(raw_mode_key, sizeof(raw_mode_key));
 	}
 	if (err) {
 		kfree(new_node);
@@ -412,7 +412,7 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_inode_info *ci,
 				    ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE,
 				    derived_key, ci->ci_mode->keysize);
 		err = fscrypt_set_per_file_enc_key(ci, derived_key);
-		memzero_explicit(derived_key, ci->ci_mode->keysize);
+		memzero_explicit(derived_key, sizeof(derived_key));
 	}
 	if (err)
 		return err;
diff --git a/fs/crypto/keysetup_v1.c b/fs/crypto/keysetup_v1.c
index e6e527c73f16..2d95a0048438 100644
--- a/fs/crypto/keysetup_v1.c
+++ b/fs/crypto/keysetup_v1.c
@@ -245,7 +245,7 @@ static int setup_v1_file_key_derived(struct fscrypt_inode_info *ci,
 
 	err = fscrypt_set_per_file_enc_key(ci, derived_key);
 
-	memzero_explicit(derived_key, derived_keysize);
+	memzero_explicit(derived_key, sizeof(derived_key));
 	/* No need to zeroize 'aes', as its key is not secret. */
 	return err;
 }

base-commit: 2d0afaac9137e95e504bd3ad3512a9044745536b
-- 
2.55.0