[Buildroot] [git commit] package/libgcrypt: bump version to 1.12.3
From: Julien Olivain via buildroot <hidden>
Date: 2026-09-05 15:37:01
Subsystem:
the rest · Maintainer:
Linus Torvalds
commit: https://gitlab.com/buildroot.org/buildroot/-/commit/627c482434e12e8ada6fcb45d482ada09af61f73 branch: https://gitlab.com/buildroot.org/buildroot/-/tree/master Release notes: https://lists.gnupg.org/pipermail/gnupg-announce/2026q3/000508.html Contains a number of bugfixes, some of which may have (low severity) security impact. As stated by Werner Koch: All in all we received 26 reports alone from ANSSI but as even the reporter mentioned, the real world attack severity is not critical. Thus we don't consider 1.12.3 a security fix release. There are some bugs which should be fixed to avoid crashes, and thus may lead to DoS. However, 16384 bit RSA keys can also be used for a practical DoS; it all depends on your use case. https://www.openwall.com/lists/oss-security/2026/08/31/11 Added upstream patch to fix a build error introduced by this bump that was detected by the Gitlab pipelines: sm4-intel-avx512-amd64.S: Assembler messages: sm4-intel-avx512-amd64.S:138: Error: operand size mismatch for `vsm4rnds4' Signed-off-by: Bernd Kuhls <redacted> [Julien: add extra info in commit log from Peter original submission from https://lore.kernel.org/buildroot/20260901192724.1021544-1-peter@korsgaard.com/ (local) ] Signed-off-by: Julien Olivain <redacted> --- ...arate-configure-check-for-AVX512-SM4-inst.patch | 108 +++++++++++++++++++++ package/libgcrypt/libgcrypt.hash | 4 +- package/libgcrypt/libgcrypt.mk | 2 +- 3 files changed, 111 insertions(+), 3 deletions(-)
diff --git a/package/libgcrypt/0002-sm4-add-separate-configure-check-for-AVX512-SM4-inst.patch b/package/libgcrypt/0002-sm4-add-separate-configure-check-for-AVX512-SM4-inst.patch
new file mode 100644
index 0000000000..67bcf667f5
--- /dev/null
+++ b/package/libgcrypt/0002-sm4-add-separate-configure-check-for-AVX512-SM4-inst.patch@@ -0,0 +1,108 @@ +From f0bc379e0f3585908707095db5d3c505e664726f Mon Sep 17 00:00:00 2001 +From: Jussi Kivilinna <jussi.kivilinna@iki.fi> +Date: Sun, 30 Aug 2026 11:16:11 +0300 +Subject: [PATCH] sm4: add separate configure check for AVX512 SM4 instructions + +* cipher/sm4-intel-avx512-amd64.S: Check for +HAVE_GCC_INLINE_ASM_SM4_AVX512 instead of HAVE_GCC_INLINE_ASM_SM4. +* cipher/sm4.c (USE_INTEL_SM4_AVX512): Require USE_INTEL_SM4_AVX2 and +HAVE_GCC_INLINE_ASM_SM4_AVX512. +* configure.ac (gcry_cv_gcc_inline_asm_sm4_avx512) +(HAVE_GCC_INLINE_ASM_SM4_AVX512): New. +-- + +Toolchain may support VEX encoded SM4 instructions but not EVEX encoded +ones. Commit adds separate check for EVEX coding and gates SM4-AVX512 +implementation behind the new check. + +Reported in FreeBSD bugtracker: + https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297987 + +Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi> + +Upstream: https://github.com/gpg/libgcrypt/commit/f0bc379e0f3585908707095db5d3c505e664726f + +Signed-off-by: Bernd Kuhls <bernd@kuhls.net> +--- + cipher/sm4-intel-avx512-amd64.S | 4 ++-- + cipher/sm4.c | 8 +++----- + configure.ac | 24 ++++++++++++++++++++++++ + 3 files changed, 29 insertions(+), 7 deletions(-) + +diff --git a/cipher/sm4-intel-avx512-amd64.S b/cipher/sm4-intel-avx512-amd64.S +index c5eaa723..ac8076ec 100644 +--- a/cipher/sm4-intel-avx512-amd64.S ++++ b/cipher/sm4-intel-avx512-amd64.S +@@ -23,7 +23,7 @@ + #ifdef __x86_64 + #if (defined(HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS) || \ + defined(HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS)) && \ +- defined(ENABLE_AVX512_SUPPORT) && defined(HAVE_GCC_INLINE_ASM_SM4) ++ defined(ENABLE_AVX512_SUPPORT) && defined(HAVE_GCC_INLINE_ASM_SM4_AVX512) + + #include "asm-common-amd64.h" + +@@ -164,5 +164,5 @@ ELF(.size __sm4_intel_crypt_blk32,.-__sm4_intel_crypt_blk32;) + #define SM4_CRYPT_BLK32 __sm4_intel_crypt_blk32 + #include "sm4-avx512-amd64.h" + +-#endif /*defined(ENABLE_AVX512_SUPPORT) && defined(HAVE_GCC_INLINE_ASM_SM4)*/ ++#endif /*ENABLE_AVX512_SUPPORT && HAVE_GCC_INLINE_ASM_SM4_AVX512*/ + #endif /*__x86_64*/ +diff --git a/cipher/sm4.c b/cipher/sm4.c +index 482a7983..58aaea10 100644 +--- a/cipher/sm4.c ++++ b/cipher/sm4.c +@@ -87,11 +87,9 @@ + /* USE_INTEL_SM4_AVX512 indicates whether to compile with Intel SM4 + * instructions (VSM4RNDS4) based AVX512 code. */ + #undef USE_INTEL_SM4_AVX512 +-#if defined(ENABLE_AVX512_SUPPORT) && defined(HAVE_GCC_INLINE_ASM_SM4) +-# if defined(__x86_64__) && (defined(HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS) || \ +- defined(HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS)) +-# define USE_INTEL_SM4_AVX512 1 +-# endif ++#if defined(USE_INTEL_SM4_AVX2) && defined(ENABLE_AVX512_SUPPORT) && \ ++ defined(HAVE_GCC_INLINE_ASM_SM4_AVX512) ++# define USE_INTEL_SM4_AVX512 1 + #endif + + /* Assembly implementations use SystemV ABI, ABI conversion and additional +diff --git a/configure.ac b/configure.ac +index a5e8d683..ea7ea7ae 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1659,6 +1659,30 @@ if test "$gcry_cv_gcc_inline_asm_sm4" = "yes" ; then + fi + + ++# ++# Check whether GCC inline assembler supports EVEX encoded Intel SM4 ++# instructions. ++# ++AC_CACHE_CHECK([whether GCC inline assembler supports AVX512 Intel SM4 instructions], ++ [gcry_cv_gcc_inline_asm_sm4_avx512], ++ [if test "$mpi_cpu_arch" != "x86" || ++ test "$try_asm_modules" != "yes" ; then ++ gcry_cv_gcc_inline_asm_sm4_avx512="n/a" ++ else ++ gcry_cv_gcc_inline_asm_sm4_avx512=no ++ AC_LINK_IFELSE([AC_LANG_PROGRAM( ++ [[void a(void) { ++ __asm__("vsm4key4 %%zmm2, %%zmm1, %%zmm3\n\t":::"cc"); ++ __asm__("vsm4rnds4 %%zmm2, %%zmm1, %%zmm3\n\t":::"cc"); ++ }]], [ a(); ] )], ++ [gcry_cv_gcc_inline_asm_sm4_avx512=yes]) ++ fi]) ++if test "$gcry_cv_gcc_inline_asm_sm4_avx512" = "yes" ; then ++ AC_DEFINE(HAVE_GCC_INLINE_ASM_SM4_AVX512,1, ++ [Defined if inline assembler supports AVX512 Intel SM4 instructions]) ++fi ++ ++ + # + # Check whether GCC inline assembler supports SSE4.1 instructions. + # +-- +2.47.3 +
diff --git a/package/libgcrypt/libgcrypt.hash b/package/libgcrypt/libgcrypt.hash
index 7be6554d56..e76496a7e4 100644
--- a/package/libgcrypt/libgcrypt.hash
+++ b/package/libgcrypt/libgcrypt.hash@@ -1,5 +1,5 @@ # From https://www.gnupg.org/download/integrity_check.html -sha1 7b8ff21966a0b6e7a735466b9b9b55d9dac9fa87 libgcrypt-1.12.2.tar.bz2 -sha256 7ce33c2492221a0436f96a8500215e9f3e3dcb5fd26a757cd415e7a843babd5e libgcrypt-1.12.2.tar.bz2 +sha1 b4654d75f0e5d0850cc699f02c9b44a06367502f libgcrypt-1.12.3.tar.bz2 +sha256 98d1b0b3202d2b03fa754a35aa3cbbfcf526a3260d8d2ee213748001b1043006 libgcrypt-1.12.3.tar.bz2 # Locally calculated sha256 20e50fe7aae3e56378ebf0417d9de904f55a0e61e4df315333e632a4d3555d95 COPYING.LIB
diff --git a/package/libgcrypt/libgcrypt.mk b/package/libgcrypt/libgcrypt.mk
index 0bc281da42..a49897fd4f 100644
--- a/package/libgcrypt/libgcrypt.mk
+++ b/package/libgcrypt/libgcrypt.mk@@ -4,7 +4,7 @@ # ################################################################################ -LIBGCRYPT_VERSION = 1.12.2 +LIBGCRYPT_VERSION = 1.12.3 LIBGCRYPT_SOURCE = libgcrypt-$(LIBGCRYPT_VERSION).tar.bz2 LIBGCRYPT_LICENSE = LGPL-2.1+ LIBGCRYPT_LICENSE_FILES = COPYING.LIB
_______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot