Re: [PATCH v4 11/13] lib/crypto: sha2: Provide functions for zeroizing SHA2 hmac_sha* structures

[Eric Biggers]

On Thu, Sep 24, 2026 at 10:58:06AM -0400, Nathan Chancellor wrote:
> Hi Thomas,
> 
> On Wed, Sep 16, 2026 at 11:50:13AM +0200, Thomas Huth wrote:
> > In certain cases crypto code functions need to zeroize their local SHA2
> > hmac_sha*_key or hmac_sha*_ctx structures after use to avoid leaking
> > sensitive material on the stack.
> > Provide hmac_sha*_zeroize_key() and hmac_sha*_zeroize_ctx() helper
> > functions that can be used with __cleanup() to automatically zeroize
> > the structure when it goes out of scope.
> > 
> > Reviewed-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
> > Signed-off-by: Thomas Huth <thuth@xxxxxxxxxx>
> > ---
> >  include/crypto/sha2.h | 73 +++++++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 73 insertions(+)
> > 
> > diff --git a/include/crypto/sha2.h b/include/crypto/sha2.h
> > index 7bb8fe169daf2..22fbc37ae8407 100644
> > --- a/include/crypto/sha2.h
> > +++ b/include/crypto/sha2.h
> > @@ -7,6 +7,7 @@
> >  #define _CRYPTO_SHA2_H
> >  
> >  #include <linux/types.h>
> > +#include <linux/string.h>
> 
> I am seeing a build failure with CONFIG_CFI=y after this patch landed in
> -next as commit 09eb210b7deb ("lib/crypto: sha2: Provide functions for
> zeroizing SHA2 hmac_sha* structures").
> 
>   $ printf 'CONFIG_%s=y\n' CFI KEXEC_FILE >kernel/configs/repro.config
> 
>   $ make -skj"$(nproc)" ARCH=x86_64 LLVM=1 mrproper defconfig repro.config arch/x86/purgatory/
>   ld.lld: error: undefined symbol: __memset
>   >>> referenced by string.c
>   >>>               arch/x86/purgatory/purgatory.ro:(__UNIQUE_ID_addressable___memset_5)
> 
>   ld.lld: error: undefined symbol: __memmove
>   >>> referenced by string.c
>   >>>               arch/x86/purgatory/purgatory.ro:(__UNIQUE_ID_addressable___memmove_6)
>   make[6]: *** [arch/x86/purgatory/Makefile:80: arch/x86/purgatory/purgatory.chk] Error 1
>   ...
> 
> This comes from the instances of KCFI_REFERENCE in
> arch/x86/include/asm/string_64.h. Maybe __DISABLE_EXPORTS should be set
> for the full purgatory to avoid this? I am juggling a lot of stuff at
> the moment so just this report instead of a full patch.

To fix linux-next, I dropped patches 10-12 of this series.  Thomas,
please resend just those once there is a solution.

We know that sha256.c (which is already built into purgatory) already
includes <linux/string.h> and uses memzero_explicit() with no problem.
So as a last resort we could make the new functions out-of-line, as that
will work.  But there should be a way to keep them in the header.  I
suspect purgatory.o (which includes <crypto/sha2.h>) just needs to be
built with the same -D__DISABLE_EXPORTS and -D__NO_FORTIFY flags as
sha256.o already is.

- Eric