linux-kernel - [PATCH] lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251102-curve25519-hacl64-fix-kasan-workaround-v1-1-6ec6738f9741@kernel.org>
Date: Sun, 02 Nov 2025 21:35:03 -0500
From: Nathan Chancellor <nathan@...nel.org>
To: Eric Biggers <ebiggers@...nel.org>, 
 "Jason A. Donenfeld" <Jason@...c4.com>, Ard Biesheuvel <ardb@...nel.org>
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org, 
 stable@...r.kernel.org, Nathan Chancellor <nathan@...nel.org>
Subject: [PATCH] lib/crypto: curve25519-hacl64: Fix older clang KASAN
 workaround for GCC

Commit 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with
clang-17 and older") inadvertently disabled KASAN in curve25519-hacl64.o
for GCC unconditionally because clang-min-version will always evaluate
to nothing for GCC. Add a check for CONFIG_CC_IS_GCC to avoid the
workaround, which is only needed for clang-17 and older.

Additionally, invert the 'ifeq (...,)' into 'ifneq (...,y)', as it is a
little easier to read and understand the intention ("if not GCC or at
least clang-18, disable KASAN").

Cc: stable@...r.kernel.org
Fixes: 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older")
Signed-off-by: Nathan Chancellor <nathan@...nel.org>
---
 lib/crypto/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/crypto/Makefile b/lib/crypto/Makefile
index bded351aeace..372b7a12b371 100644
--- a/lib/crypto/Makefile
+++ b/lib/crypto/Makefile
@@ -90,7 +90,7 @@ else
 libcurve25519-$(CONFIG_CRYPTO_LIB_CURVE25519_GENERIC) += curve25519-fiat32.o
 endif
 # clang versions prior to 18 may blow out the stack with KASAN
-ifeq ($(call clang-min-version, 180000),)
+ifneq ($(CONFIG_CC_IS_GCC)$(call clang-min-version, 180000),y)
 KASAN_SANITIZE_curve25519-hacl64.o := n
 endif

---
base-commit: 6146a0f1dfae5d37442a9ddcba012add260bceb0
change-id: 20251102-curve25519-hacl64-fix-kasan-workaround-75fdb8c098fd

Best regards,
--  
Nathan Chancellor <nathan@...nel.org>