Skip to content

20260610-linuxkm-fenrir#10676

Merged
dgarske merged 26 commits into
wolfSSL:masterfrom
douzzer:20260610-linuxkm-fenrir
Jun 13, 2026
Merged

20260610-linuxkm-fenrir#10676
dgarske merged 26 commits into
wolfSSL:masterfrom
douzzer:20260610-linuxkm-fenrir

Conversation

@douzzer

@douzzer douzzer commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

Fixes for numerous "low" Fenrir issues in linuxkm/. See commit messages for the details.

tested with

wolfssl-multi-test.sh ...
--exclude-scenario '.*linuxkm-defaults.*'
'.*linuxkm.*'
check-source-text

douzzer added 25 commits June 12, 2026 18:14
F-1880: Unsigned word32 dec_len Silently Wraps Negative wc_RsaSSL_Verify Error Codes, Returning Wrong Errno on RSA Signature Verification Failure
F-1881: word32 sig_len Silently Wraps Negative wc_RsaSSL_Sign Error in Self-Test Functions, Bypassing <= 0 Guard
F-1882: word32 priv_len / pub_len Silently Wrap Negative wc_RsaKeyToDer / wc_RsaKeyToPublicDer Errors Across Three RSA Self-Test Functions
also ForceZeros various other potentially sensitive allocations before freeing them, and uses unconditional free() per current libwolfssl best practice.
in AesGcmCrypt_1() and AesCcmCrypt_1(), check for overflow on assoclen+cryptlen in both encrypt and decrypt modes;

in linuxkm_test_kpp_driver(), return MEMORY_E, not -ENOMEM;

in km_direct_rsa_dec(), only update req->dst_len for -EOVERFLOW, not for -EINVAL.
F-1428: Missing ForceZero on sg_buf Containing Decrypted Plaintext in AES-GCM Non-Stream Path
F-3293: AES-CCM Non-Contiguous SG Path Missing ForceZero on sg_buf Containing Decrypted Plaintext
F-1433: AES CBC/CFB Self-Test Functions Silently Continue After enc2/dec2 Allocation Failure
F-1434: linuxkm_test_aesgcm Silently Returns Success on Kernel Crypto Allocation Failure
…ith Plain Assignment Instead of wc_ForceZero

@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fenrir Automated Review — PR #10676

Scan targets checked: linuxkm-bugs, linuxkm-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Comment thread linuxkm/module_hooks.c Outdated

@dgarske dgarske left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skoll Multi-Scan Review

Modes: review + review-securityOverall recommendation: REQUEST_CHANGES
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

  • [High] [review+review-security] wc_ForceZero() called with 3 arguments (compile error / broken entropy zeroization fix)linuxkm/module_hooks.c:475
  • [Low] [review] Trailing comma instead of period in error messagelinuxkm/lkcapi_aes_glue.c:3643
  • [Low] [review-security] km_direct_rsa_dec no longer reports required dst_len on -EINVAL pathlinuxkm/lkcapi_rsa_glue.c:799
  • [Info] [review-security] x86_vector_register_glue.c allocation-failure log size argument changedlinuxkm/x86_vector_register_glue.c:72

Review generated by Skoll

Comment thread linuxkm/module_hooks.c Outdated
Comment thread linuxkm/lkcapi_aes_glue.c
Comment thread linuxkm/lkcapi_rsa_glue.c
Comment thread linuxkm/x86_vector_register_glue.c
linuxkm/lkcapi_aes_glue.c: fix typo in linuxkm_test_aesgcm() error message.
@douzzer douzzer removed their assignment Jun 13, 2026
@douzzer douzzer requested a review from dgarske June 13, 2026 00:26
@douzzer

douzzer commented Jun 13, 2026

Copy link
Copy Markdown
Contributor Author

retest this please

FAIL: scripts/ocsp-stapling-with-wolfssl-responder.test

@dgarske dgarske merged commit 6b9949e into wolfSSL:master Jun 13, 2026
292 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

For This Release Release version 5.9.2

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants