20260727-fips-dev-no-post

[douzzer]

tested with

wolfssl-multi-test.sh ... all

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 201,046 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 175,121 B / 262,144 B, total: 67% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +128 B (+0.0%, 771,540 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 214,037 B / 262,144 B, total: 82% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +128 B (+0.0%, 280,128 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata +128 B (+0.0%, 326,232 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B, .text +64 B (+0.1%, 236,808 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 200,982 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +128 B, .text +64 B (+0.1%, 280,704 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 236,808 B / 262,144 B, total: 90% used)

stm32-sim-stm32h753

• FLASH: .text +68 B (+0.0%, 185,752 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• linuxkm-pie
• linuxkm-standard

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11031

Scan targets checked: linuxkm-bugs, linuxkm-src, wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 5
4 finding(s) posted as inline comments (see file-level comments below)

Medium (1)

Unguarded verifyCore reference in non-PIE FIPS seg_map under WOLFSSL_FIPS_DEV_NO_POST

File: linuxkm/module_hooks.c:1291
Function: seg_map (file-scope, #elif defined(HAVE_FIPS) branch)
Category: Incorrect error handling

The extern declaration of verifyCore (line 119) is now gated with !defined(WOLFSSL_FIPS_DEV_NO_POST), and the primary seg_map initializer (line 1223) got the matching && !defined(WOLFSSL_FIPS_DEV_NO_POST) guard, but the parallel seg_map used when WC_SYM_RELOC_TABLES is undefined (line 1290) was not updated to match, so it references the undeclared verifyCore symbol when building with --enable-fips=dev-no-post and PIE reloc tables disabled.

Recommendation: Add && !defined(WOLFSSL_FIPS_DEV_NO_POST) to the #if at line 1290, matching line 1223.

Referenced code: linuxkm/module_hooks.c:1291-1294 (4 lines)

---

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11031

Scan targets checked: linuxkm-bugs, linuxkm-src, wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

🟠 [Medium] Default-RNG NO_VECTOR_OPS protection dropped for non-FIPS/FIPS-v7+ builds · Vector register state corruption

WC_RNG_BANK_FLAG_NO_VECTOR_OPS is now only set #if defined(HAVE_FIPS) && FIPS_VERSION3_LT(7,0,0), so for non-FIPS and FIPS v7+ linuxkm builds the default system DRBG bank (comment: wc_linuxkm_rng_initing_default_bank_flag, "forbidden from irq handlers") no longer forces vector-op-free SHA-256, letting its future wc_rng_bank_checkout()/generate calls attempt vector-register SHA-256 from softirq/hardirq contexts.

Fix: Set WC_RNG_BANK_FLAG_NO_VECTOR_OPS for the default bank unconditionally (or gate strictly on the actual dynamic-switch capability), not solely on old-FIPS version.

[douzzer]

False positive. SHA-2 now (with this PR) dynamically falls back to C on a call-by-call basis.

[wolfSSL-Fenrir-bot]

🟠 [Medium] wc_AesGcmInit() always applies encrypt-only FIPS short-nonce check, even for decrypt reinit · Logic errors

wc_AesGcmInit() is documented as usable "for encryption or decryption" but hardcodes decrypt_p=0 when calling wc_AesGcmInit_local, so the new FIPS short-IV rejection (ivSz < GCM_NONCE_MID_SZ → FIPS_BAD_VALUE_E) is wrongly applied on decrypt paths too. evp.c calls wc_AesGcmInit() to reinitialize the cipher after both encrypt and decrypt Final, and wolfSSL_EVP_CIPHER_CTX_set_iv_length() lets callers set ctx->ivSz below 12 bytes, so a legitimate short-IV decrypt will now fail spuriously in FIPS builds.

Fix: Either drop the generic wc_AesGcmInit() FIPS short-nonce check or have it accept/propagate a decrypt flag instead of hardcoding 0.

[wolfSSL-Fenrir-bot]

🔴 [High] AllocKey leaks XMALLOC'd key struct when wc_XXX_init_ex() itself fails · Resource leaks on error paths

key_inited is set only when the init call itself returns 0; if wc_InitRsaKey_ex/wc_ecc_init_ex/etc. fail directly, key_inited stays 0 so FreeKey() is skipped, leaking the XMALLOC'd struct and leaving *pKey non-NULL and unfreed.

Fix: Free the allocated *pKey buffer on any ret != 0 (via XFREE/FreeKey), regardless of key_inited, and reset *pKey to NULL.