[PATCH bpf-next v3] bpf: Remove inclusions of crypto/sha1.h

[PATCH bpf-next v3] bpf: Remove inclusions of crypto/sha1.h

[Eric Biggers]

Since commit 603b44162325 ("bpf: Update the bpf_prog_calc_tag to use
SHA256") made BPF program tags use SHA-256 instead of SHA-1, the header
<crypto/sha1.h> no longer needs to be included.  Remove the relevant
inclusions so that they no longer unnecessarily come up in searches for
which kernel code is still using the obsolete SHA-1 algorithm.

Since net/ipv6/addrconf.c was relying on the transitive inclusion of
<crypto/sha1.h> (for an unrelated purpose) via <linux/filter.h>, make it
include <crypto/sha1.h> explicitly in order to keep that file building.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---

v3: update net/ipv6/addrconf.c to fix transitive inclusion
v2: update include/linux/filter.h too

 include/linux/filter.h | 1 -
 kernel/bpf/core.c      | 1 -
 net/ipv6/addrconf.c    | 1 +
 3 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 44d7ae95ddbcc..e40d4071a3455 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -19,11 +19,10 @@
 #include <linux/set_memory.h>
 #include <linux/kallsyms.h>
 #include <linux/if_vlan.h>
 #include <linux/vmalloc.h>
 #include <linux/sockptr.h>
-#include <crypto/sha1.h>
 #include <linux/u64_stats_sync.h>
 
 #include <net/sch_generic.h>
 
 #include <asm/byteorder.h>
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 3ece2da55625c..f11ab6f354e2e 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -16,11 +16,10 @@
  * Andi Kleen - Fix a few bad bugs and races.
  * Kris Katterjohn - Added many additional checks in bpf_check_classic()
  */
 
 #include <uapi/linux/btf.h>
-#include <crypto/sha1.h>
 #include <linux/filter.h>
 #include <linux/skbuff.h>
 #include <linux/vmalloc.h>
 #include <linux/prandom.h>
 #include <linux/bpf.h>
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 0e55f139e05d5..04c1e856bf7fc 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -34,10 +34,11 @@
  *						status etc.
  */
 
 #define pr_fmt(fmt) "IPv6: " fmt
 
+#include <crypto/sha1.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/sched/signal.h>
 #include <linux/socket.h>

base-commit: 1c9982b4961334c1edb0745a04cabd34bc2de675
-- 
2.53.0

Re: [PATCH bpf-next v3] bpf: Remove inclusions of crypto/sha1.h

[Paul Chaignon]

On Sat, Mar 14, 2026 at 02:45:55PM -0700, Eric Biggers wrote:
> Since commit 603b44162325 ("bpf: Update the bpf_prog_calc_tag to use
> SHA256") made BPF program tags use SHA-256 instead of SHA-1, the header
> <crypto/sha1.h> no longer needs to be included.  Remove the relevant
> inclusions so that they no longer unnecessarily come up in searches for
> which kernel code is still using the obsolete SHA-1 algorithm.
> 
> Since net/ipv6/addrconf.c was relying on the transitive inclusion of
> <crypto/sha1.h> (for an unrelated purpose) via <linux/filter.h>, make it
> include <crypto/sha1.h> explicitly in order to keep that file building.
> 
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---

Acked-by: Paul Chaignon <paul.chaignon@gmail.com>

> 
> v3: update net/ipv6/addrconf.c to fix transitive inclusion
> v2: update include/linux/filter.h too
> 
>  include/linux/filter.h | 1 -
>  kernel/bpf/core.c      | 1 -
>  net/ipv6/addrconf.c    | 1 +
>  3 files changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/include/linux/filter.h b/include/linux/filter.h
> index 44d7ae95ddbcc..e40d4071a3455 100644
> --- a/include/linux/filter.h
> +++ b/include/linux/filter.h
> @@ -19,11 +19,10 @@
>  #include <linux/set_memory.h>
>  #include <linux/kallsyms.h>
>  #include <linux/if_vlan.h>
>  #include <linux/vmalloc.h>
>  #include <linux/sockptr.h>
> -#include <crypto/sha1.h>
>  #include <linux/u64_stats_sync.h>
>  
>  #include <net/sch_generic.h>
>  
>  #include <asm/byteorder.h>
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 3ece2da55625c..f11ab6f354e2e 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -16,11 +16,10 @@
>   * Andi Kleen - Fix a few bad bugs and races.
>   * Kris Katterjohn - Added many additional checks in bpf_check_classic()
>   */
>  
>  #include <uapi/linux/btf.h>
> -#include <crypto/sha1.h>
>  #include <linux/filter.h>
>  #include <linux/skbuff.h>
>  #include <linux/vmalloc.h>
>  #include <linux/prandom.h>
>  #include <linux/bpf.h>
> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> index 0e55f139e05d5..04c1e856bf7fc 100644
> --- a/net/ipv6/addrconf.c
> +++ b/net/ipv6/addrconf.c
> @@ -34,10 +34,11 @@
>   *						status etc.
>   */
>  
>  #define pr_fmt(fmt) "IPv6: " fmt
>  
> +#include <crypto/sha1.h>
>  #include <linux/errno.h>
>  #include <linux/types.h>
>  #include <linux/kernel.h>
>  #include <linux/sched/signal.h>
>  #include <linux/socket.h>
> 
> base-commit: 1c9982b4961334c1edb0745a04cabd34bc2de675
> -- 
> 2.53.0
> 
>