20261110-linuxkm-stdrng-purge-etc by douzzer · Pull Request #12107 · wolfSSL/wolfssl

douzzer · 2026-11-12T03:31:27Z

linuxkm/linuxkm_wc_port.h linuxkm/lkcapi_sha_glue.c linuxkm/simd_hammer/simd_hammer.c .wolfssl_known_macro_extras: fixes for removal of stdrng alg from the LKCAPI.

gate crypto/internal/rng.h inclusion and "stdrng" alg registration on kernel
<7.5 (<linux-next of 20261110).
add WOLFSSL_LINUXKM_LKCAPI_HAVE_STDRNG with override
WOLFSSL_LINUXKM_LKCAPI_NO_STDRNG.
add dummy macro variant of wc_linux_kernel_rng_is_wolfcrypt().
add gating on WOLFSSL_LINUXKM_LKCAPI_HAVE_STDRNG as needed throughout
linuxkm/lkcapi_sha_glue.c.
add a HAVE_STDRNG indicator macro to linuxkm/simd_hammer/simd_hammer.c and
gate the "rng" probe on it. also add a runtime report of the instantiated RNG
driver name, and a warning if it isn't wolfCrypt.
note, on !WOLFSSL_LINUXKM_LKCAPI_HAVE_STDRNG builds, there’s no longer a
deinstall_algs prerequisite before rmmod.

wolfcrypt/src/asn.c wolfcrypt/src/asn_orig.c wolfcrypt/src/signature.c wolfcrypt/test/test.c doc/dox_comments/header_files/asn_public.h:

bound the digSz in wc_EncodeSignature(), and catch zero (error) return from it
in wc_SignatureDerEncode(). Add test coverage to rsa_sig_test().

linuxkm/lkcapi_rsa_glue.c: add digest length checks to the pkcs1 sign callbacks,
matching those in the verify callbacks since ff93e6d and 8fef82c, by
factoring the common argument validation into km_pkcs1_check_digest_len().

tests/api/test_tls.c: skip test_tls_unset_fd_no_stdin_io() if defined(HAVE_VALGRIND).

tested with

wolfssl-multi-test.sh ...
check-source-text
defaults-gcc-latest-valgrind
'.*linuxkm-next.*'
linuxkm-fips-dev-insmod-cust-kernel-1
linuxkm-fips-dev-insmod-wolfguard-cust-kernel-3 linuxkm-fips-dev-insmod-cust-kernel-1
linuxkm-fips-v5-vanilla-insmod-wolfguard-cust-kernel-6
linuxkm-fips-v5-strict-dist-insmod-cust-kernel-2-amdrdseed
linuxkm-6.15-all-cryptonly-quantum-safe-allintelasm-LKCAPI-insmod-crypto-fuzzer-kmemleak-no-stdrng
linuxkm-6.15-all-cryptonly-quantum-safe-noasm-LKCAPI-insmod-crypto-fuzzer-ksan-no-stdrng

…er/simd_hammer.c .wolfssl_known_macro_extras: fixes for removal of stdrng alg from the LKCAPI. * gate crypto/internal/rng.h inclusion and "stdrng" alg registration on kernel <7.5 (<linux-next of 20261110). * add WOLFSSL_LINUXKM_LKCAPI_HAVE_STDRNG with override WOLFSSL_LINUXKM_LKCAPI_NO_STDRNG. * add dummy macro variant of wc_linux_kernel_rng_is_wolfcrypt(). * add gating on WOLFSSL_LINUXKM_LKCAPI_HAVE_STDRNG as needed throughout linuxkm/lkcapi_sha_glue.c. * add a HAVE_STDRNG indicator macro to linuxkm/simd_hammer/simd_hammer.c and gate the "rng" probe on it. also add a runtime report of the instantiated RNG driver name, and a warning if it isn't wolfCrypt. * note, on !WOLFSSL_LINUXKM_LKCAPI_HAVE_STDRNG builds, there’s no longer a deinstall_algs prerequisite before rmmod.

…c wolfcrypt/test/test.c doc/dox_comments/header_files/asn_public.h: bound the digSz in wc_EncodeSignature(), and catch zero (error) return from it in wc_SignatureDerEncode(). Add test coverage to rsa_sig_test().

… callbacks, matching those in the verify callbacks since ff93e6d and 8fef82c, by factoring the common argument validation into km_pkcs1_check_digest_len().

…(HAVE_VALGRIND).

github-actions · 2026-11-12T03:35:50Z

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m3

FLASH: .text +8 B (+0.0%, 132,221 B / 262,144 B, total: 50% used)

stm32-sim-stm32h753

FLASH: .text +64 B (+0.0%, 205,484 B / 2,097,152 B, total: 10% used)

No memory changes detected for:

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

Copilot

🟡 Changes recommended

Active issues include a compilation failure in the kprobe configuration without stdrng, phantom registration accounting that blocks deinstallation, and a header guard that prevents wolfCrypt RNG recognition.

3 open issues

What changed in this PR

This PR updates wolfSSL’s Linux kernel integration for removal of stdrng and strengthens RSA digest-length validation.

Changes:

Gate stdrng registration and probes by kernel support, with an explicit disable override.
Bound signature digest encoding, share RSA callback validation, and add regression tests.
Document encoding limits and skip the unset-file-descriptor TLS test under Valgrind.

File	Description
`wolfcrypt/test/test.c`	Test oversized digest rejection for in-place and separate-buffer encoding.
`wolfcrypt/src/signature.c`	Handle signature-encoding failure.
`wolfcrypt/src/asn.c`	Bound digest size in template-based encoding.
`wolfcrypt/src/asn_orig.c`	Bound digest size in legacy encoding.
`tests/api/test_tls.c`	Skip the unset-descriptor test under Valgrind.
`linuxkm/simd_hammer/simd_hammer.c`	Gate RNG probes and report the selected driver.
`linuxkm/lkcapi_sha_glue.c`	Adapt RNG registration and cleanup for builds without `stdrng`.
`linuxkm/lkcapi_rsa_glue.c`	Share digest validation, advertise digest sizes, and extend tests.
`linuxkm/linuxkm_wc_port.h`	Add `stdrng` feature gating and a fallback RNG detector macro.
`doc/dox_comments/header_files/asn_public.h`	Document digest-size limits and error returns.
`.wolfssl_known_macro_extras`	Register the new `stdrng` disable macro.

_{Review effort: Balanced}

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #12107

Scan targets checked: linuxkm-src, linuxkm-bugs, wolfcrypt-src, wolfcrypt-bugs, wolfssl-bugs
Not reviewed (no scan target covers them): .wolfssl_known_macro_extras, doc/dox_comments/header_files/asn_public.h
Coverage: 9 of 9 in-scope changed file(s) opened by the reviewer

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Max

linuxkm/linuxkm_wc_port.h and linuxkm/lkcapi_sha_glue.c: fix scoping of wc_linux_kernel_rng_is_wolfcrypt(); linuxkm/lkcapi_sha_glue.c: fix dummy call to wc_linuxkm_drbg_startup() to leave wc_linuxkm_drbg_loaded defined; wolfcrypt/src/asn_orig.c: check digSz against actual size of digArray.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #12107

Scan targets checked: linuxkm-src, linuxkm-bugs, wolfcrypt-src, wolfcrypt-bugs
Unchanged since last review (not re-run): wolfssl-bugs
Not reviewed (no scan target covers them): .wolfssl_known_macro_extras, doc/dox_comments/header_files/asn_public.h
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: wolfcrypt/src/asn_orig.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

Copilot

🔵 Needs a closer look

The unload notice is hidden for no-STDRNG builds with random-bytes callbacks, although those builds still require deinstall_algs to release the module reference and allow rmmod; the PR description also needs qualification.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Keep the unload notice for callback-backed no-STDRNG builds

linuxkm/lkcapi_sha_glue.c:5828

With WOLFSSL_LINUXKM_LKCAPI_NO_STDRNG and random-bytes callbacks enabled, rmmod still fails because the supplied kernel patches retain a module reference until the callbacks are unregistered. This guard hides the deinstall_algs instruction needed to release that reference. Retain the unload notice for callback-backed builds too, and qualify the PR description's claim that no-STDRNG builds no longer require this step.

3 resolved since last review

_{Review effort: Balanced}

douzzer added 5 commits November 11, 2026 21:23

linuxkm/lkcapi_rsa_glue.c: add digest length checks to the pkcs1 sign…

0d3c30a

… callbacks, matching those in the verify callbacks since ff93e6d and 8fef82c, by factoring the common argument validation into km_pkcs1_check_digest_len().

tests/api/test_tls.c: skip test_tls_unset_fd_no_stdin_io() if defined…

ede279e

…(HAVE_VALGRIND).

linuxkm/lkcapi_sha_glue.c: fix UTF-8 in comment.

c258ef3

douzzer requested review from wolfSSL-Bot and wolfSSL-Fenrir-bot November 12, 2026 03:31

douzzer assigned wolfSSL-Bot Nov 12, 2026

Copilot AI balanced review requested due to automatic review settings November 12, 2026 03:31

Copilot started reviewing on behalf of douzzer November 12, 2026 03:32

View session

Copilot AI reviewed Nov 12, 2026

View reviewed changes

Comment thread linuxkm/lkcapi_sha_glue.c Resolved

Comment thread linuxkm/lkcapi_sha_glue.c Resolved

Comment thread linuxkm/linuxkm_wc_port.h Resolved

wolfSSL-Fenrir-bot previously requested changes Nov 12, 2026

View reviewed changes

douzzer requested review from wolfSSL-Fenrir-bot and a balanced review from Copilot November 12, 2026 04:43

Copilot started reviewing on behalf of douzzer November 12, 2026 04:43

View session

wolfSSL-Fenrir-bot reviewed Nov 12, 2026

View reviewed changes

Copilot AI reviewed Nov 12, 2026

View reviewed changes

Navigation Menu

Repository navigation

20261110-linuxkm-stdrng-purge-etc - #12107

20261110-linuxkm-stdrng-purge-etc#12107
douzzer wants to merge 6 commits into
wolfSSL:masterfrom
douzzer:20261110-linuxkm-stdrng-purge-etc

douzzer commented Nov 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 12, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Uh oh!

wolfSSL-Fenrir-bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

douzzer commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m3

stm32-sim-stm32h753

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #12107

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #12107

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

douzzer commented Nov 12, 2026 •

edited

Loading

github-actions Bot commented Nov 12, 2026 •

edited

Loading