[PATCH v2] crypto: caam - guard HMAC key hex dumps in hash_digest_key

[PATCH v2] crypto: caam - guard HMAC key hex dumps in hash_digest_key

[Thorsten Blum]

Guard sensitive HMAC key hex dumps with DEBUG in hash_digest_key() to
avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

Fixes: 045e36780f11 ("crypto: caam - ahash hmac support")
Fixes: 3f16f6c9d632 ("crypto: caam/qi2 - add support for ahash algorithms")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
Changes in v2:
- Debug-guard key hex dumps instead of removing them entirely (Herbert)
- Use print_hex_dump() instead of print_hex_dump_debug() since the dumps
  are already guarded by DEBUG
- Link to v1: https://lore.kernel.org/lkml/20260306111204.302544-1-thorsten.blum@linux.dev/
---
 drivers/crypto/caam/caamalg_qi2.c | 13 ++++++++-----
 drivers/crypto/caam/caamhash.c    | 13 ++++++++-----
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
index 167372936ca7..3392070942ab 100644
--- a/drivers/crypto/caam/caamalg_qi2.c
+++ b/drivers/crypto/caam/caamalg_qi2.c
@@ -3269,8 +3269,10 @@ static int hash_digest_key(struct caam_hash_ctx *ctx, u32 *keylen, u8 *key,
 	dpaa2_fl_set_addr(out_fle, key_dma);
 	dpaa2_fl_set_len(out_fle, digestsize);
 
-	print_hex_dump_debug("key_in@" __stringify(__LINE__)": ",
-			     DUMP_PREFIX_ADDRESS, 16, 4, key, *keylen, 1);
+#ifdef DEBUG
+	print_hex_dump(KERN_DEBUG, "key_in@" __stringify(__LINE__)": ",
+		       DUMP_PREFIX_ADDRESS, 16, 4, key, *keylen, 1);
+#endif
 	print_hex_dump_debug("shdesc@" __stringify(__LINE__)": ",
 			     DUMP_PREFIX_ADDRESS, 16, 4, desc, desc_bytes(desc),
 			     1);
@@ -3289,9 +3291,10 @@ static int hash_digest_key(struct caam_hash_ctx *ctx, u32 *keylen, u8 *key,
 		/* in progress */
 		wait_for_completion(&result.completion);
 		ret = result.err;
-		print_hex_dump_debug("digested key@" __stringify(__LINE__)": ",
-				     DUMP_PREFIX_ADDRESS, 16, 4, key,
-				     digestsize, 1);
+#ifdef DEBUG
+		print_hex_dump(KERN_DEBUG, "digested key@" __stringify(__LINE__)": ",
+			       DUMP_PREFIX_ADDRESS, 16, 4, key, digestsize, 1);
+#endif
 	}
 
 	dma_unmap_single(ctx->dev, flc_dma, sizeof(flc->flc) + desc_bytes(desc),
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index 628c43a7efc4..0dad6fb6caeb 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -393,8 +393,10 @@ static int hash_digest_key(struct caam_hash_ctx *ctx, u32 *keylen, u8 *key,
 	append_seq_store(desc, digestsize, LDST_CLASS_2_CCB |
 			 LDST_SRCDST_BYTE_CONTEXT);
 
-	print_hex_dump_debug("key_in@"__stringify(__LINE__)": ",
-			     DUMP_PREFIX_ADDRESS, 16, 4, key, *keylen, 1);
+#ifdef DEBUG
+	print_hex_dump(KERN_DEBUG, "key_in@"__stringify(__LINE__)": ",
+		       DUMP_PREFIX_ADDRESS, 16, 4, key, *keylen, 1);
+#endif
 	print_hex_dump_debug("jobdesc@"__stringify(__LINE__)": ",
 			     DUMP_PREFIX_ADDRESS, 16, 4, desc, desc_bytes(desc),
 			     1);
@@ -408,9 +410,10 @@ static int hash_digest_key(struct caam_hash_ctx *ctx, u32 *keylen, u8 *key,
 		wait_for_completion(&result.completion);
 		ret = result.err;
 
-		print_hex_dump_debug("digested key@"__stringify(__LINE__)": ",
-				     DUMP_PREFIX_ADDRESS, 16, 4, key,
-				     digestsize, 1);
+#ifdef DEBUG
+		print_hex_dump(KERN_DEBUG, "digested key@"__stringify(__LINE__)": ",
+			       DUMP_PREFIX_ADDRESS, 16, 4, key, digestsize, 1);
+#endif
 	}
 	dma_unmap_single(jrdev, key_dma, *keylen, DMA_BIDIRECTIONAL);
 

Re: [PATCH v2] crypto: caam - guard HMAC key hex dumps in hash_digest_key

[Herbert Xu]

On Wed, Mar 18, 2026 at 08:46:50PM +0100, Thorsten Blum wrote:
>
> diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
> index 167372936ca7..3392070942ab 100644
> --- a/drivers/crypto/caam/caamalg_qi2.c
> +++ b/drivers/crypto/caam/caamalg_qi2.c
> @@ -3269,8 +3269,10 @@ static int hash_digest_key(struct caam_hash_ctx *ctx, u32 *keylen, u8 *key,
>  	dpaa2_fl_set_addr(out_fle, key_dma);
>  	dpaa2_fl_set_len(out_fle, digestsize);
>  
> -	print_hex_dump_debug("key_in@" __stringify(__LINE__)": ",
> -			     DUMP_PREFIX_ADDRESS, 16, 4, key, *keylen, 1);
> +#ifdef DEBUG
> +	print_hex_dump(KERN_DEBUG, "key_in@" __stringify(__LINE__)": ",
> +		       DUMP_PREFIX_ADDRESS, 16, 4, key, *keylen, 1);
> +#endif

I'd prefer to keep the compiler coverage when DEBUG is off.

Please add a new helper, either print_hex_dump_devel or
print_hex_dump_sensitive that only gets enabled when DEBUG is
defined.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt