From dd0712ec5275f96b26989f98b6dfd8b32d5e0293 Mon Sep 17 00:00:00 2001
From: Daniele Lacamera <root@danielinux.net>
Date: Thu, 2 Jul 2026 15:23:43 +0200
Subject: [PATCH] F-6130: clear disk_encrypt_key/nonce before panic paths that
 skip the final cleanup

update_disk.c wolfBoot_start() already zeroizes disk_encrypt_key/nonce and
the decrypted header before most wolfBoot_panic() halts, but four paths
were missed: anti-rollback rejection, FIT FPGA load failure, FIT kernel
load failure, and flash-protect failure. Since wolfBoot_panic() halts
forever on real targets, these paths left the key live in BSS on a halted
device. Add the same disk_decrypted_header_clear()/disk_crypto_clear()
pair used on the other panic paths immediately before each.
---
 src/update_disk.c                   | 16 ++++++++++++++++
 tools/unit-tests/unit-update-disk.c |  8 ++++++++
 2 files changed, 24 insertions(+)

diff --git a/src/update_disk.c b/src/update_disk.c
index 0607e7a7..767df7c2 100644
--- a/src/update_disk.c
+++ b/src/update_disk.c
@@ -397,6 +397,10 @@ void RAMFUNCTION wolfBoot_start(void)
             uint32_t cur_ver = selected ? pB_ver_u : pA_ver_u;
             if ((max_ver > 0U) && (cur_ver < max_ver)) {
                 wolfBoot_printf("Rollback to lower version not allowed\r\n");
+#ifdef DISK_ENCRYPT
+                disk_decrypted_header_clear(dec_hdr);
+                disk_crypto_clear();
+#endif
                 wolfBoot_panic();
                 return;
             }
@@ -573,6 +577,10 @@ void RAMFUNCTION wolfBoot_start(void)
         if (fpga != NULL) {
             if (fit_load_fpga(fit, fpga) != 0) {
                 wolfBoot_printf("FIT: FPGA load failed\r\n");
+#ifdef DISK_ENCRYPT
+                disk_decrypted_header_clear(dec_hdr);
+                disk_crypto_clear();
+#endif
                 wolfBoot_panic();
             }
         }
@@ -584,6 +592,10 @@ void RAMFUNCTION wolfBoot_start(void)
             if (new_load == NULL) {
                 wolfBoot_printf("FIT: failed to load kernel '%s'\r\n",
                     kernel);
+#ifdef DISK_ENCRYPT
+                disk_decrypted_header_clear(dec_hdr);
+                disk_crypto_clear();
+#endif
                 wolfBoot_panic();
             }
             load_address = new_load;
@@ -627,6 +639,10 @@ void RAMFUNCTION wolfBoot_start(void)
 #ifndef TZEN
     if (hal_flash_protect(WOLFBOOT_ORIGIN, BOOTLOADER_PARTITION_SIZE) < 0) {
         wolfBoot_printf("Error protecting bootloader flash region\r\n");
+#ifdef DISK_ENCRYPT
+        disk_decrypted_header_clear(dec_hdr);
+        disk_crypto_clear();
+#endif
         wolfBoot_panic();
     }
 #endif
diff --git a/tools/unit-tests/unit-update-disk.c b/tools/unit-tests/unit-update-disk.c
index d92ec43f..072f239e 100644
--- a/tools/unit-tests/unit-update-disk.c
+++ b/tools/unit-tests/unit-update-disk.c
@@ -361,6 +361,8 @@ END_TEST
 
 START_TEST(test_update_disk_rejects_rollback_after_higher_image_failure)
 {
+    size_t i;
+
     reset_mocks();
     build_image(part_a_image, 7, 0xA1);
     build_image(part_b_image, 5, 0xB2);
@@ -370,6 +372,12 @@ START_TEST(test_update_disk_rejects_rollback_after_higher_image_failure)
 
     ck_assert_int_gt(wolfBoot_panicked, 0);
     ck_assert_int_eq(mock_do_boot_called, 0);
+    for (i = 0; i < ENCRYPT_KEY_SIZE; i++) {
+        ck_assert_uint_eq(disk_encrypt_key[i], 0);
+    }
+    for (i = 0; i < ENCRYPT_NONCE_SIZE; i++) {
+        ck_assert_uint_eq(disk_encrypt_nonce[i], 0);
+    }
 }
 END_TEST