Re: [PATCH v5 01/10] crypto: pkcs7: add flag for validated trust on a signed info block

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Low] `verify_pkcs7_message_sig` is exported using `EXPORT_SYMBOL` but requires a GPL-only structure, creating an inconsistent API boundary.
--

commit 6419b567f8141f60cbee1c62c6b8f2a8760edbda
Author: James Bottomley <James.Bottomley@HansenPartnership.com>

crypto: pkcs7: add flag for validated trust on a signed info block

This commit allows consumers to check if a PKCS#7 signed info block has
passed trust validation by adding a verified flag. It also exports
verify_pkcs7_message_sig so other modules can obtain a trusted PKCS#7
object.

> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index e0761436ec7f4..9bda49295bd02 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -380,6 +380,7 @@ int verify_pkcs7_message_sig(const void *data, size_t len,
>  	pr_devel("<==%s() = %d\n", __func__, ret);
>  	return ret;
>  }
> +EXPORT_SYMBOL(verify_pkcs7_message_sig);

Is this intended to be EXPORT_SYMBOL instead of EXPORT_SYMBOL_GPL? 

The function requires a parsed struct pkcs7_message as an argument, but the
only function that parses and allocates this structure, pkcs7_parse_message(),
is exported as EXPORT_SYMBOL_GPL. 

This seems to create an inconsistent API boundary where non-GPL modules are
permitted to use this function but cannot legitimately obtain the necessary
input object to do so. Other related APIs in the PKCS#7 and keyring
verification subsystems also use EXPORT_SYMBOL_GPL.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260420212653.438685-1-bboscaccy@linux.microsoft.com?part=1