linux/security
Linus Torvalds 95615dd9ff Crypto library updates for 7.4
- Migrate the x86 and riscv optimized implementations of various AES
   modes (ECB, CBC, CBC-CTS, CTR, XCTR, XTS) into lib/crypto/.
 
   This makes the library APIs be properly accelerated on these
   architectures, while still accelerating crypto_skcipher as well.
 
   It removes a lot of redundant glue code, since the crypto API
   boilerplate no longer needs to be duplicated for these architectures.
 
   It also fixes the longstanding issue where optimizations for these
   AES modes were disabled by default on these architectures.
 
 - Optimize AES-XTS on SPARC64 using the SPARC crypto opcodes
 
 - Move the SipHash code into lib/crypto/
 
 - Update the ChaCha and Poly1305 functions to take size_t lengths,
   resolving issues where lengths over INT_MAX were mishandled
 
 - Make frame pointer unwinding work properly in some of the x86
   assembly functions, by following the standard %rbp convention
 
 - Add helper functions for zeroizing structs
 
 - Make a few documentation improvements
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCatTfbBQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOK9yhAP0RU5ofTuvc8jj2o02JlXnnxwzda+zh
 tpJYOIHfW6+2UwD/XjbNgngca3ByRL2f3rt2xdSaqSIjmRMP4Blkgeazsw4=
 =zs1E
 -----END PGP SIGNATURE-----

Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Pull crypto library updates from Eric Biggers:

 - Migrate the x86 and riscv optimized implementations of various AES
   modes (ECB, CBC, CBC-CTS, CTR, XCTR, XTS) into lib/crypto/.

   This makes the library APIs be properly accelerated on these
   architectures, while still accelerating crypto_skcipher as well.

   It removes a lot of redundant glue code, since the crypto API
   boilerplate no longer needs to be duplicated for these architectures.

   It also fixes the longstanding issue where optimizations for these
   AES modes were disabled by default on these architectures.

 - Optimize AES-XTS on SPARC64 using the SPARC crypto opcodes

 - Move the SipHash code into lib/crypto/

 - Update the ChaCha and Poly1305 functions to take size_t lengths,
   resolving issues where lengths over INT_MAX were mishandled

 - Make frame pointer unwinding work properly in some of the x86
   assembly functions, by following the standard %rbp convention

 - Add helper functions for zeroizing structs

 - Make a few documentation improvements

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (49 commits)
  lib/crypto: md5: remove unused header
  lib/crypto: mips/chacha: Handle lengths of 2 GiB or more
  lib/crypto: arm/chacha: Handle lengths of 2 GiB or more in scalar code
  lib/crypto: chacha: Use size_t length
  lib/crypto: poly1305: Use size_t length
  lib/crypto: x86/sha512: Follow the normal %rbp convention
  lib/crypto: x86/sha256: Follow the normal %rbp convention
  lib/crypto: x86/sha1: Follow the normal %rbp convention
  lib/crypto: chacha20poly1305: zeroize state in __chacha20poly1305_decrypt
  lib/crypto: sparc/aes-xts: Add optimization using the AES opcodes
  lib: Move SipHash into lib/crypto/
  lib/crypto: x86/aes-ctr: Remove some unreachable code
  crypto: x86/aesni-intel - Add transitional selections
  crypto: aes - Boost priority of encryption modes further
  lib/crypto: x86/aes: Set RNDKEY in aes_cbc_encrypt_aesni()
  lib/crypto: riscv/aes-xts: Migrate optimized code into library
  lib/crypto: riscv/aes-ctr: Migrate optimized code into library
  lib/crypto: riscv/aes-cbc: Migrate optimized code into library
  lib/crypto: riscv/aes-ecb: Migrate optimized code into library
  lib/crypto: riscv/aes: Pass key struct to assembly code
  ...
2026-10-20 15:38:53 -10:00
..
apparmor fs: port mnt_idmap() and file_mnt_idmap() to const mnt_idmap 2026-09-23 09:19:51 +02:00
bpf bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized 2026-06-30 16:31:56 +02:00
integrity vfs-7.4-rc1.idmap 2026-10-19 17:57:49 -10:00
ipe ipe: protect the dm-verity root hash with RCU 2026-09-25 13:30:27 -07:00
keys Crypto library updates for 7.4 2026-10-20 15:38:53 -10:00
landlock landlock: Drop __counted_by from landlock_domain.handled_masks 2026-10-11 17:54:21 +02:00
loadpin Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
lockdown lockdown: move initcalls to the LSM framework 2025-10-22 19:24:27 -04:00
safesetid Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
selinux vfs-7.4-rc1.idmap 2026-10-19 17:57:49 -10:00
smack fs: port ->setattr() to pass const mnt_idmap 2026-09-23 09:19:51 +02:00
tomoyo tomoyo: use u64 for holding inode->i_ino value 2026-04-15 00:00:10 +09:00
yama Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
commoncap_test.c security: Add KUnit tests for kuid_root_in_ns and vfsuid_root_in_currentns 2026-01-09 11:28:28 -06:00
commoncap.c fs: port xattr to const mnt_idmap 2026-09-23 09:19:49 +02:00
device_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
inode.c securityfs: use kstrdup_const() to manage symlink targets 2026-03-17 17:13:36 -04:00
Kconfig proc: make PROC_MEM_FORCE_PTRACE the Kconfig default 2026-04-13 09:12:37 -07:00
Kconfig.hardening hardening: Default randstruct off with rust for better allmodconfig support 2026-09-01 16:01:35 -07:00
lsm_audit.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
lsm_init.c security: lsm: allow LSMs to register for late_initcall_sync init 2026-08-04 12:35:02 -04:00
lsm_notifier.c lsm: split the notifier code out into lsm_notifier.c 2025-10-22 19:24:15 -04:00
lsm_syscalls.c lsm: hold cred_guard_mutex for lsm_set_self_attr() 2026-05-14 16:47:59 -04:00
lsm.h lsm: add backing_file LSM hooks 2026-04-03 16:53:50 -04:00
Makefile lsm: split the init code out into lsm_init.c 2025-10-22 19:24:16 -04:00
min_addr.c lsm: preserve /proc/sys/vm/mmap_min_addr when !CONFIG_SECURITY 2026-01-29 13:56:53 -05:00
security.c fs: port ->setattr() to pass const mnt_idmap 2026-09-23 09:19:51 +02:00