linux-kernel - Re: [PATCH] crypto: lib/sha1 - use __DISABLE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251217235745.GB89113@google.com>
Date: Wed, 17 Dec 2025 23:57:45 +0000
From: Eric Biggers <ebiggers@...nel.org>
To: Ross Philipson <ross.philipson@...cle.com>
Cc: linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org,
	Jason@...c4.com, ardb@...nel.org, dpsmith@...rtussolutions.com,
	kanth.ghatraju@...cle.com, andrew.cooper3@...rix.com,
	trenchboot-devel@...glegroups.com
Subject: Re: [PATCH] crypto: lib/sha1 - use __DISABLE_EXPORTS for SHA1 library

On Wed, Dec 17, 2025 at 03:38:26PM -0800, Ross Philipson wrote:
> Allow the SHA1 library code in lib/crypto/sha1.c to be used in a pre-boot
> environments. Use the __DISABLE_EXPORTS macro to disable function exports and
> define the proper values for that environment as was done earlier for SHA256.
> 
> This issue was brought up during the review of the Secure Launch v15 patches
> that use SHA1 in a pre-boot environment (link in tags below). This is being
> sent as a standalone patch to address this.
> 
> Link: https://lore.kernel.org/r/20251216002150.GA11579@quark
> Cc: Eric Biggers <ebiggers@...nel.org>
> Signed-off-by: Ross Philipson <ross.philipson@...cle.com>
> ---
>  lib/crypto/sha1.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/crypto/sha1.c b/lib/crypto/sha1.c
> index 52788278cd17..e5a9e1361058 100644
> --- a/lib/crypto/sha1.c
> +++ b/lib/crypto/sha1.c
> @@ -154,7 +154,7 @@ static void __maybe_unused sha1_blocks_generic(struct sha1_block_state *state,
>  	memzero_explicit(workspace, sizeof(workspace));
>  }
>  
> -#ifdef CONFIG_CRYPTO_LIB_SHA1_ARCH
> +#if defined(CONFIG_CRYPTO_LIB_SHA1_ARCH) && !defined(__DISABLE_EXPORTS)
>  #include "sha1.h" /* $(SRCARCH)/sha1.h */
>  #else
>  #define sha1_blocks sha1_blocks_generic

Shouldn't this be part of the patchset that needs this?

Also, when __DISABLE_EXPORTS is defined, only the functionality actually
used by pre-boot environments should be included.  HMAC support for
example probably isn't needed.

The commit title is also misleading.  How about:
"lib/crypto: sha1: Add support for pre-boot environments".

- Eric