Re: [PATCH v4 11/13] lib/crypto: sha2: Provide functions for zeroizing SHA2 hmac_sha* structures

[Thomas Huth <thuth@redhat.com>]

On 24/09/2026 19.49, Eric Biggers wrote:
> On Thu, Sep 24, 2026 at 10:58:06AM -0400, Nathan Chancellor wrote:
>> Hi Thomas,
>>
>> On Wed, Sep 16, 2026 at 11:50:13AM +0200, Thomas Huth wrote:
>>> In certain cases crypto code functions need to zeroize their local SHA2
>>> hmac_sha*_key or hmac_sha*_ctx structures after use to avoid leaking
>>> sensitive material on the stack.
>>> Provide hmac_sha*_zeroize_key() and hmac_sha*_zeroize_ctx() helper
>>> functions that can be used with __cleanup() to automatically zeroize
>>> the structure when it goes out of scope.
>>>
>>> Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
>>> Signed-off-by: Thomas Huth <thuth@redhat.com>
>>> ---
>>>   include/crypto/sha2.h | 73 +++++++++++++++++++++++++++++++++++++++++++
>>>   1 file changed, 73 insertions(+)
>>>
>>> diff --git a/include/crypto/sha2.h b/include/crypto/sha2.h
>>> index 7bb8fe169daf2..22fbc37ae8407 100644
>>> --- a/include/crypto/sha2.h
>>> +++ b/include/crypto/sha2.h
>>> @@ -7,6 +7,7 @@
>>>   #define _CRYPTO_SHA2_H
>>>   
>>>   #include <linux/types.h>
>>> +#include <linux/string.h>
>>
>> I am seeing a build failure with CONFIG_CFI=y after this patch landed in
>> -next as commit 09eb210b7deb ("lib/crypto: sha2: Provide functions for
>> zeroizing SHA2 hmac_sha* structures").
>>
>>    $ printf 'CONFIG_%s=y\n' CFI KEXEC_FILE >kernel/configs/repro.config
>>
>>    $ make -skj"$(nproc)" ARCH=x86_64 LLVM=1 mrproper defconfig repro.config arch/x86/purgatory/
>>    ld.lld: error: undefined symbol: __memset
>>    >>> referenced by string.c
>>    >>>               arch/x86/purgatory/purgatory.ro:(__UNIQUE_ID_addressable___memset_5)
>>
>>    ld.lld: error: undefined symbol: __memmove
>>    >>> referenced by string.c
>>    >>>               arch/x86/purgatory/purgatory.ro:(__UNIQUE_ID_addressable___memmove_6)
>>    make[6]: *** [arch/x86/purgatory/Makefile:80: arch/x86/purgatory/purgatory.chk] Error 1
>>    ...
>>
>> This comes from the instances of KCFI_REFERENCE in
>> arch/x86/include/asm/string_64.h. Maybe __DISABLE_EXPORTS should be set
>> for the full purgatory to avoid this? I am juggling a lot of stuff at
>> the moment so just this report instead of a full patch.
> 
> To fix linux-next, I dropped patches 10-12 of this series.  Thomas,
> please resend just those once there is a solution.
Yes, thanks, dropping those three patches is the right thing to do right 
now. I will try to reproduce the problem in the next days and come up with a 
proper solution (like setting __DISABLE_EXPORTS if that helps...).

  Thomas