Skip to contentSkip to conversation

nfsd: Use MD5 library instead of crypto_shash

PATCH In review Eric Biggers 2 participants 5 messages Oct 16, 2025

Subsystems (3)
NFS client NFS server Crypto API
lore
Share & tools
lore

Eric Biggers

author
#0 lore raw

PATCH v2 1/1 nfsd: Use MD5 library instead of crypto_shash

Update NFSD's support for "legacy client tracking" (which uses MD5) to use the MD5 library instead of crypto_shash. This has several benefits:

- Simpler code. Notably, much of the error-handling code is no longer needed, since the library functions can't fail.

- Improved performance due to reduced overhead. A microbenchmark of nfs4_make_rec_clidname() shows a speedup from 1455 cycles to 425.

- The MD5 code can now safely be built as a loadable module when nfsd is built as a loadable module. (Previously, nfsd forced the MD5 code to built-in, presumably to work around the unreliability of the name-based loading.) Thus select MD5 from the tristate option NFSD if NFSD_LEGACY_CLIENT_TRACKING, instead of from the bool option NFSD_V4.

- Fixes a bug where legacy client tracking was not supported on kernels booted with "fips=1", due to crypto_shash not allowing MD5 to be used. This particular use of MD5 is not for a cryptographic purpose, though, so it is acceptable even when fips=1 (see
https://lore.kernel.org/r/[email protected]/).

Signed-off-by Eric Biggers <[email protected]>

---

Changed in v2:
- Removed the fips_enabled check.
- Added 'select CRYPTO' back to NFSD_V4.

 fs/nfsd/Kconfig       |  4 +--
 fs/nfsd/nfs4recover.c | 76 +++++--------------------------------------
 2 files changed, 11 insertions(+), 69 deletions(-)
fs/nfsd/Kconfig +2 -2
index e134dce45e350..94ab9e5bf930e 100644
@@ -3,10 +3,11 @@ config NFSD
 	tristate "NFS server support"
 	depends on INET
 	depends on FILE_LOCKING
 	depends on FSNOTIFY
 	select CRC32
+	select CRYPTO_LIB_MD5 if NFSD_LEGACY_CLIENT_TRACKING
 	select CRYPTO_LIB_SHA256 if NFSD_V4
 	select LOCKD
 	select SUNRPC
 	select EXPORTFS
 	select NFS_COMMON

@@ -75,12 +76,11 @@ config NFSD_V3_ACL
 config NFSD_V4
 	bool "NFS server support for NFS version 4"
 	depends on NFSD && PROC_FS
 	select FS_POSIX_ACL
 	select RPCSEC_GSS_KRB5
-	select CRYPTO
-	select CRYPTO_MD5
+	select CRYPTO # required by RPCSEC_GSS_KRB5
 	select GRACE_PERIOD
 	select NFS_V4_2_SSC_HELPER if NFS_V4_2
 	help
 	  This option enables support in your system's NFS server for
 	  version 4 of the NFS protocol (RFC 3530).
fs/nfsd/nfs4recover.c +9 -67

179 lines not on this page · raw message

base-commit: 3a8660878839faadb4f1a6dd72c3179c1df56787

Signature · 1 line
2.51.0
author Acked-by Ard Biesheuvel Acked-by Jeff Layton Reviewed-by Scott Mayhew on v2 1/1
#1 lore raw
Quoted 15 lines · Eric Biggers

Update NFSD's support for "legacy client tracking" (which uses MD5) to use the MD5 library instead of crypto_shash. This has several benefits:

- Simpler code. Notably, much of the error-handling code is no longer needed, since the library functions can't fail.

- Improved performance due to reduced overhead. A microbenchmark of nfs4_make_rec_clidname() shows a speedup from 1455 cycles to 425.

- The MD5 code can now safely be built as a loadable module when nfsd is built as a loadable module. (Previously, nfsd forced the MD5 code to built-in, presumably to work around the unreliability of the name-based loading.) Thus select MD5 from the tristate option NFSD if NFSD_LEGACY_CLIENT_TRACKING, instead of from the bool option NFSD_V4.

Quoted 7 lines

- Fixes a bug where legacy client tracking was not supported on kernels booted with "fips=1", due to crypto_shash not allowing MD5 to be used. This particular use of MD5 is not for a cryptographic purpose, though, so it is acceptable even when fips=1 (see
https://lore.kernel.org/r/[email protected]/).

Signed-off-by Eric Biggers <[email protected]>

I forgot the tags from v1. Please add when applying:

Acked-by Ard Biesheuvel <[email protected]>
Acked-by Jeff Layton <[email protected]>
Reviewed-by Scott Mayhew <[email protected]>

- Eric

maintainer
#2 lore raw
In reply to Eric Biggers

From: Chuck Lever <[email protected]>

Quoted 10 lines · Eric Biggers

Update NFSD's support for "legacy client tracking" (which uses MD5) to use the MD5 library instead of crypto_shash. This has several benefits:

- Simpler code. Notably, much of the error-handling code is no longer needed, since the library functions can't fail.

- Improved performance due to reduced overhead. A microbenchmark of nfs4_make_rec_clidname() shows a speedup from 1455 cycles to 425.

[...]

Applied to nfsd-testing, thanks!

Note that the posted version of this patch does not apply cleanly to the nfsd-testing branch here:

https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git/log/?h=nfsd-testing

Be sure to rebase on that branch when posting subsequence patches that target NFSD.

[1/1] nfsd: Use MD5 library instead of crypto_shash

      commit: 4a8d4b1d4b8abcc0d73b924d4d15828dd2ead301

--
Chuck Lever

author
#3 lore raw
Quoted 16 lines · Chuck Lever

From: Chuck Lever <[email protected]>

Quoted 10 lines · Eric Biggers

Update NFSD's support for "legacy client tracking" (which uses MD5) to use the MD5 library instead of crypto_shash. This has several benefits:

- Simpler code. Notably, much of the error-handling code is no longer needed, since the library functions can't fail.

- Improved performance due to reduced overhead. A microbenchmark of nfs4_make_rec_clidname() shows a speedup from 1455 cycles to 425.

[...]

Applied to nfsd-testing, thanks!

Quoted 7 lines

Note that the posted version of this patch does not apply cleanly to the nfsd-testing branch here:

https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git/log/?h=nfsd-testing

Be sure to rebase on that branch when posting subsequence patches that target NFSD.

Sorry, I had just based it on v6.18-rc1. It did also apply cleanly to nfsd-testing f59a20b8390dd with either 'git am -3' or 'git cherry-pick'.

I noticed you changed the author to yourself when applying. Could you fix that?

Thanks,

- Eric

maintainer
#4 lore raw
Quoted 22 lines · Eric Biggers
Quoted 21 lines · Chuck Lever

From: Chuck Lever <[email protected]>

Quoted 10 lines · Eric Biggers

Update NFSD's support for "legacy client tracking" (which uses MD5) to use the MD5 library instead of crypto_shash. This has several benefits:

- Simpler code. Notably, much of the error-handling code is no longer needed, since the library functions can't fail.

- Improved performance due to reduced overhead. A microbenchmark of nfs4_make_rec_clidname() shows a speedup from 1455 cycles to 425.

[...]

Applied to nfsd-testing, thanks!

Note that the posted version of this patch does not apply cleanly to the nfsd-testing branch here:

https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git/log/?h=nfsd-testing

Quoted 8 lines
Quoted 2 lines

Be sure to rebase on that branch when posting subsequence patches that target NFSD.

Sorry, I had just based it on v6.18-rc1. It did also apply cleanly to nfsd-testing f59a20b8390dd with either 'git am -3' or 'git cherry-pick'.

I noticed you changed the author to yourself when applying. Could you fix that?

That was unintentional, due to applying the patch by hand. Fixed.

Signature · 1 line
Chuck Lever