On Tue, Aug 11, 2026 at 09:40:36AM +0800, Roberto Sassu wrote: > On 8/7/2026 7:42 PM, Roberto Sassu wrote: > > On Tue, 2026-08-04 at 16:07 -0400, Mimi Zohar wrote: > > > From: Daniel Hodges <[email protected]> > > > > > > The crypto_shash_update() and crypto_shash_final() functions can fail > > > and return error codes, but their return values were not being checked > > > in several places in security/integrity/evm/evm_crypto.c: > > > > > > - hmac_add_misc() ignored returns from crypto_shash_update() and > > > crypto_shash_final() > > > - evm_calc_hmac_or_hash() ignored returns from crypto_shash_update() > > > - evm_init_hmac() ignored returns from crypto_shash_update() > > > > > > If these hash operations fail silently, the resulting HMAC could be > > > invalid or incomplete, which could weaken the integrity verification > > > security that EVM provides. > > > > > > This patch converts hmac_add_misc() from void to int return type and > > > adds proper error checking and propagation for all crypto_shash_* > > > function calls. All callers are updated to handle the new return values. > > > Additionally, error messages are logged when cryptographic operations > > > fail to provide visibility into the failure rather than silently > > > returning error codes. > > > > > > Fixes: 66dbc325afce ("evm: re-release") > > > Signed-off-by: Daniel Hodges <[email protected]> > > > Reviewed-by: Roberto Sassu <[email protected]> > > > > Looks good to me. I confirm the Reviewed-by. > > We got a report from Sashiko. As it pointed out, we should not override the > error when calling hmac_add_misc() if no xattr is present > (-ENODATA). > > Roberto
Looks good to me, thanks for fix! Reviewed-by: Daniel Hodges <[email protected]>
