20260727-fips-dev-no-post

[douzzer]

tested with

wolfssl-multi-test.sh ... all

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 201,046 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 175,121 B / 262,144 B, total: 67% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +128 B (+0.0%, 771,540 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 214,037 B / 262,144 B, total: 82% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +128 B (+0.0%, 280,128 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata +128 B (+0.0%, 326,232 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B, .text +64 B (+0.1%, 236,808 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 200,982 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +128 B, .text +64 B (+0.1%, 280,704 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .rodata.CSWTCH.1 +8 B, .rodata.str1.1 +121 B (+0.1%, 236,808 B / 262,144 B, total: 90% used)

stm32-sim-stm32h753

• FLASH: .text +68 B (+0.0%, 185,752 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• linuxkm-pie
• linuxkm-standard

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11031

Scan targets checked: linuxkm-bugs, linuxkm-src, wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 5
4 finding(s) posted as inline comments (see file-level comments below)

Medium (1)

Unguarded verifyCore reference in non-PIE FIPS seg_map under WOLFSSL_FIPS_DEV_NO_POST

File: linuxkm/module_hooks.c:1291
Function: seg_map (file-scope, #elif defined(HAVE_FIPS) branch)
Category: Incorrect error handling

The extern declaration of verifyCore (line 119) is now gated with !defined(WOLFSSL_FIPS_DEV_NO_POST), and the primary seg_map initializer (line 1223) got the matching && !defined(WOLFSSL_FIPS_DEV_NO_POST) guard, but the parallel seg_map used when WC_SYM_RELOC_TABLES is undefined (line 1290) was not updated to match, so it references the undeclared verifyCore symbol when building with --enable-fips=dev-no-post and PIE reloc tables disabled.

Recommendation: Add && !defined(WOLFSSL_FIPS_DEV_NO_POST) to the #if at line 1290, matching line 1223.

Referenced code: linuxkm/module_hooks.c:1291-1294 (4 lines)

---

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

🟠 [Medium] sizeof(pointer) used instead of sizeof(struct) for falcon sampler context · Incorrect sizeof/type usage

spc is declared via WC_DECLARE_VAR, which expands to a pointer under WOLFSSL_SMALL_STACK. sizeof(spc) there yields the pointer size, not sizeof(falcon_sampler_ctx), so the pre-zero and wc_MemZero_Add registration only cover a few bytes instead of the whole struct.

Fix: Use sizeof(*spc) in both calls, matching the correct usage later at ForceZero(spc, sizeof(*spc)).

[wolfSSL-Fenrir-bot]

🔵 [Low] Non-atomic global enable/disable flag for DH runtime enablement · Race conditions

wc_dh_enabled is a plain volatile int read-then-written without synchronization in wc_dh_enable/wc_dh_disable, so concurrent callers can both observe it disabled, both enable it, and later independently disable it out from under one another.

Fix: Protect the flag with an atomic compare-and-swap or mutex, or convert it to a reference count.

[wolfSSL-Fenrir-bot]

🔴 [High] wc_InitDhKey_ex leaves mp_ints uninitialized on runtime-disabled DH path, causing invalid free in wc_FreeDhKey · Incorrect error handling

When WC_DH_INITIAL_RUNTIME_ENABLEMENT is defined and DH is runtime-disabled, wc_InitDhKey_ex returns FIPS_NOT_ALLOWED_E before calling mp_init_multi(), leaving key->p, key->g, key->q, key->pub, and key->priv as raw uninitialized memory. Callers such as AllocKey/FreeKey in src/internal.c allocate the DhKey with a non-zeroing XMALLOC and unconditionally call wc_FreeDhKey() on init failure, which calls mp_clear() on these uninitialized mp_ints, dereferencing/freeing garbage pointers.

Fix: Call mp_init_multi() (or XMEMSET-zero the mp_int fields) before checking wc_dh_enabled, so a disabled-DH failure still leaves the key in a state safe to free.

[wolfSSL-Fenrir-bot]

🟠 [Medium] FIPS short-nonce rejection wrongly applied to streaming GCM decryption · Cryptographic correctness

wc_AesGcmInit now rejects ivSz < GCM_NONCE_MID_SZ with FIPS_BAD_VALUE_E, but wc_AesGcmDecryptInit forwards directly to it, so streaming decryption of legitimately short (8-byte) nonces now fails, contradicting the explicit decrypt-side exception documented in wc_AesGcmDecrypt in the same PR.

Fix: Skip the short-nonce FIPS check in wc_AesGcmInit when called via wc_AesGcmDecryptInit, mirroring the exemption in wc_AesGcmDecrypt.