Skip to contentSkip to conversation

crypto: certs: fix FIPS selftest depenency

PATCH In review Arnd Bergmann 3 participants 4 messages Dec 15, 2022 – Jan 4, 2023

Subsystems (3)
Crypto API Keys/keyrings Asymmetric keys
lore
Share & tools
lore

Arnd Bergmann

author
#0 lore raw

PATCH 1/1 crypto: certs: fix FIPS selftest depenency

From: Arnd Bergmann <[email protected]>

The selftest code is built into the x509_key_parser module, and depends on the pkcs7_message_parser module, which in turn has a dependency on the key parser, creating a dependency loop and a resulting link failure when the pkcs7 code is a loadable module:

ld: crypto/asymmetric_keys/selftest.o: in function `fips_signature_selftest':
crypto/asymmetric_keys/selftest.c:205: undefined reference to `pkcs7_parse_message'
ld: crypto/asymmetric_keys/selftest.c:209: undefined reference to `pkcs7_supply_detached_data'
ld: crypto/asymmetric_keys/selftest.c:211: undefined reference to `pkcs7_verify'
ld: crypto/asymmetric_keys/selftest.c:215: undefined reference to `pkcs7_validate_trust'
ld: crypto/asymmetric_keys/selftest.c:219: undefined reference to `pkcs7_free_message'

Avoid this by only allowing the selftest to be enabled when either both parts are loadable modules, or both are built-in.

Signed-off-by Arnd Bergmann <[email protected]>
---
 crypto/asymmetric_keys/Kconfig        | 2 +-
 crypto/asymmetric_keys/pkcs7_verify.c | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)
crypto/asymmetric_keys/Kconfig +1 -1
index 3df3fe4ed95f..1ef3b46d6f6e 100644
@@ -83,6 +83,6 @@ config FIPS_SIGNATURE_SELFTEST
 	  for FIPS.
 	depends on KEYS
 	depends on ASYMMETRIC_KEY_TYPE
-	depends on PKCS7_MESSAGE_PARSER
+	depends on PKCS7_MESSAGE_PARSER=X509_CERTIFICATE_PARSER
 
 endif # ASYMMETRIC_KEY_TYPE
crypto/asymmetric_keys/pkcs7_verify.c +1 -0
index f6321c785714..4fa769c4bcdb 100644
@@ -485,3 +485,4 @@ int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
 	pkcs7->data_len = datalen;
 	return 0;
 }
+EXPORT_SYMBOL_GPL(pkcs7_supply_detached_data);
Signature · 1 line
2.35.1
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 47 lines · Arnd Bergmann

From: Arnd Bergmann <[email protected]>

The selftest code is built into the x509_key_parser module, and depends on the pkcs7_message_parser module, which in turn has a dependency on the key parser, creating a dependency loop and a resulting link failure when the pkcs7 code is a loadable module:

ld: crypto/asymmetric_keys/selftest.o: in function `fips_signature_selftest':
crypto/asymmetric_keys/selftest.c:205: undefined reference to `pkcs7_parse_message'
ld: crypto/asymmetric_keys/selftest.c:209: undefined reference to `pkcs7_supply_detached_data'
ld: crypto/asymmetric_keys/selftest.c:211: undefined reference to `pkcs7_verify'
ld: crypto/asymmetric_keys/selftest.c:215: undefined reference to `pkcs7_validate_trust'
ld: crypto/asymmetric_keys/selftest.c:219: undefined reference to `pkcs7_free_message'

Avoid this by only allowing the selftest to be enabled when either both parts are loadable modules, or both are built-in.

Signed-off-by Arnd Bergmann <[email protected]>
---
 crypto/asymmetric_keys/Kconfig        | 2 +-
 crypto/asymmetric_keys/pkcs7_verify.c | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)
crypto/asymmetric_keys/Kconfig +1 -1
index 3df3fe4ed95f..1ef3b46d6f6e 100644
@@ -83,6 +83,6 @@ config FIPS_SIGNATURE_SELFTEST
 	  for FIPS.
 	depends on KEYS
 	depends on ASYMMETRIC_KEY_TYPE
-	depends on PKCS7_MESSAGE_PARSER
+	depends on PKCS7_MESSAGE_PARSER=X509_CERTIFICATE_PARSER
 
 endif # ASYMMETRIC_KEY_TYPE
crypto/asymmetric_keys/pkcs7_verify.c +1 -0
index f6321c785714..4fa769c4bcdb 100644
@@ -485,3 +485,4 @@ int pkcs7_supply_detached_data(struct pkcs7_message *pkcs7,
 	pkcs7->data_len = datalen;
 	return 0;
 }
+EXPORT_SYMBOL_GPL(pkcs7_supply_detached_data);
Signature · 1 line
2.35.1
Reviewed-by Jarkko Sakkinen <[email protected]>

BR, Jarkko

maintainer
#3 lore raw
Quoted 9 lines · Ben Boeckel
Quoted 1 line · Jarkko Sakkinen
Reviewed-by Jarkko Sakkinen <[email protected]>

Might want to fix this when picked:

Quoted 1 line

Subject: Re: [PATCH] crypto: certs: fix FIPS selftest depenency

                                             dependency ^^^^^^^^^

--Ben

Thank you! I updated the patch accordingly.

It should be soon available in linux-next tree.

BR, Jarkko