20260615-linuxkm-fixes#10696

Open

douzzer wants to merge 22 commits into

wolfSSL:masterfrom

douzzer:20260615-linuxkm-fixes

Commits on Jun 26, 2026

fixes for false positives on linuxkm CONFIG_FORTIFY_SOURCE builds on gcc-16:
douzzer
committed
linuxkm/lkcapi_sha_glue.c: refactor error code handling in wc_linuxkm_drbg_generate() (followup to 3c9996efe0 in #10688).
douzzer
committed

Commits on Jun 27, 2026

wolfcrypt/src/aes.c: fix performance regressions on GMAC and AES-CFB decrypt:
douzzer
committed
src/include.am: remove wolfcrypt/src/aes_x86_64_asm.S from AESNI source lists in FIPS v2/v5/v6 sections.
douzzer
committed
in all FIPS-relevant C sources, add a "#define _WC_BUILDING_foo" first (where foo is a stylization of the filename), before including libwolfssl_sources.h, to allow future file-specific suppression…
douzzer
committed
wolfcrypt/src/aes.c, wolfcrypt/src/port/, wolfssl/wolfcrypt/aes.h, wolfcrypt/src/pkcs7.c, wolfcrypt/test/test.c:
douzzer
committed
wolfcrypt/test/test.c:
douzzer
committed
linuxkm/x86_vector_register_glue.c, linuxkm/linuxkm_wc_port.h, wolfssl/wolfcrypt/memory.h: add WC_SVR_FLAG_FUZZ, implement support for DEBUG_VECTOR_REGISTER_ACCESS_FUZZING directly in the save/rest…
douzzer
committed
wolfcrypt/src/sha3.c: refactor WC_C_DYNAMIC_FALLBACK using SAVE_VECTOR_REGISTERS2().
douzzer
committed
clean up setup code for kernel modules:
douzzer
committed
* add hard compile-time assert in settings.h for FIPS v7+ asserting that WOLFSSL_MIN_AUTH_TAG_SZ meets SP 800-38D Rev 1 requirements.
douzzer
committed
linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: add linuxkm-pie support for CheckOcspResponder() (WOLFSSL_NO_OCSP_ISSUER_CHECK is no longer implied by KERNEL_MODE_DEFAULTS).
douzzer
committed
linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: on kernel >= 7.2, remove indirect symbol support for strncpy and add backward-compat implementation wc_linuxkm_strncpy().
douzzer
committed
replace several nonconformant uses of __FUNCTION__ with __func__ (linuxkm/linuxkm_memory.c, wolfcrypt/src/random.c, wolfcrypt/test/test.c, wolfssl/wolfcrypt/mem_track.h, wolfssl/wolfcrypt/memory.h,…
douzzer
committed
wolfcrypt/src/port/riscv/riscv-64-aes.c: in GHASH(), remove runtime nullness check for arg 1 (matching nonnull attribute to arg 1 added to prototype in earlier commit).
douzzer
committed
wolfcrypt/src/wc_slhdsa.c:
douzzer
committed
linuxkm-related loose ends:
douzzer
committed
tweaks for linuxkm targeting clang-built kernels:
douzzer
committed
wolfcrypt/src/pkcs7.c: in wc_PKCS7_DecodeAuthEnvelopedData(), accommodate AES*GCMb with !HAVE_AESGCM, and add AES-CCM authTagSz check.
douzzer
committed
wolfcrypt/src/aes.c: don't use explicit inline attribute on wc_local_AesGcmCheckTagSz() with C++ (namespace breakage).
douzzer
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

20260615-linuxkm-fixes#10696

20260615-linuxkm-fixes#10696
douzzer wants to merge 22 commits into
wolfSSL:masterfrom
douzzer:20260615-linuxkm-fixes

Commits on Jun 26, 2026

fixes for false positives on linuxkm CONFIG_FORTIFY_SOURCE builds on gcc-16:

linuxkm/lkcapi_sha_glue.c: refactor error code handling in wc_linuxkm_drbg_generate() (followup to 3c9996efe0 in #10688).

Commits on Jun 27, 2026

wolfcrypt/src/aes.c: fix performance regressions on GMAC and AES-CFB decrypt:

src/include.am: remove wolfcrypt/src/aes_x86_64_asm.S from AESNI source lists in FIPS v2/v5/v6 sections.

in all FIPS-relevant C sources, add a "#define _WC_BUILDING_foo" first (where foo is a stylization of the filename), before including libwolfssl_sources.h, to allow future file-specific suppression…

wolfcrypt/src/aes.c, wolfcrypt/src/port/, wolfssl/wolfcrypt/aes.h, wolfcrypt/src/pkcs7.c, wolfcrypt/test/test.c:

wolfcrypt/test/test.c:

linuxkm/x86_vector_register_glue.c, linuxkm/linuxkm_wc_port.h, wolfssl/wolfcrypt/memory.h: add WC_SVR_FLAG_FUZZ, implement support for DEBUG_VECTOR_REGISTER_ACCESS_FUZZING directly in the save/rest…

wolfcrypt/src/sha3.c: refactor WC_C_DYNAMIC_FALLBACK using SAVE_VECTOR_REGISTERS2().

clean up setup code for kernel modules:

* add hard compile-time assert in settings.h for FIPS v7+ asserting that WOLFSSL_MIN_AUTH_TAG_SZ meets SP 800-38D Rev 1 requirements.

linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: add linuxkm-pie support for CheckOcspResponder() (WOLFSSL_NO_OCSP_ISSUER_CHECK is no longer implied by KERNEL_MODE_DEFAULTS).

linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: on kernel >= 7.2, remove indirect symbol support for strncpy and add backward-compat implementation wc_linuxkm_strncpy().

replace several nonconformant uses of FUNCTION with func (linuxkm/linuxkm_memory.c, wolfcrypt/src/random.c, wolfcrypt/test/test.c, wolfssl/wolfcrypt/mem_track.h, wolfssl/wolfcrypt/memory.h,…

wolfcrypt/src/port/riscv/riscv-64-aes.c: in GHASH(), remove runtime nullness check for arg 1 (matching nonnull attribute to arg 1 added to prototype in earlier commit).

wolfcrypt/src/wc_slhdsa.c:

linuxkm-related loose ends:

tweaks for linuxkm targeting clang-built kernels:

wolfcrypt/src/pkcs7.c: in wc_PKCS7_DecodeAuthEnvelopedData(), accommodate AES*GCMb with !HAVE_AESGCM, and add AES-CCM authTagSz check.

wolfcrypt/src/aes.c: don't use explicit inline attribute on wc_local_AesGcmCheckTagSz() with C++ (namespace breakage).

Commits on Jun 28, 2026

wolfcrypt/src/pkcs7.c: in wc_PKCS7_DecodeAuthEnvelopedData(), accommodate old FIPS using old authTagSz check.

wolfssl/wolfcrypt/wc_port.h: keep #define INLINE WC_INLINE even for latest FIPS;