[openssl/openssl] 723e44: s390x: Fix return code handling in HMAC_Init_ex()

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: 723e44f02fe6ca6549e78f5556d031e06e9ee717
      https://github.com/openssl/openssl/commit/723e44f02fe6ca6549e78f5556d031e06e9ee717
  Author: Ingo Franzki <[email protected]>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M crypto/hmac/hmac.c

  Log Message:
  -----------
  s390x: Fix return code handling in HMAC_Init_ex()

When running on the s390x platform HMAC_Init_ex() calls s390x_HMAC_init()
to optionally allow hardware acceleration of the HMAC operation. In case
the hardware acceleration is not available, s390x_HMAC_init() returns -1
to indicate that. In this case the software path is continued.

The problem is that rv was set to -1 by s390x_HMAC_init() and stays at
this until the end of the function. In case the software path detects an
error it goes to the 'err' label which just returns rv as is, and thus
HMAC_Init_ex() now returns -1 instead of 0 (rv was initialized to 0 at
declaration).

The wrong return value might then be propagated through all layers, i.e.
to EVP_MAC_init() which also returns -1 in this case. However, EVP_MAC_init()
is defined as returning 1 on success, or 0 on error, i.e. a boolean kind of
return value.

Typically, callers will do something like 'if (!EVP_MAC_init(s....))' to
check for errors. A return value of -1 is non-zero, and thus it is treated
as successful return.

Fix this by setting rv back to 0 when s390x_HMAC_init() returned -1.

Fixes: 0499de5adda2 "s390x: Add hardware acceleration for HMAC"
Resolves: https://github.com/openssl/openssl/issues/31706
Signed-off-by: Ingo Franzki <[email protected]>

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Jun 30 20:49:52 2026
(Merged from https://github.com/openssl/openssl/pull/31723)

(cherry picked from commit f0ca416976ac5b6761bf45e28fa42f1981edbe2c)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/6542fa-723e44%40github.com.