From 24c70db4b912636d086a6aacf428edd77537e867 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 10 Jul 2026 07:51:10 +0200 Subject: [PATCH] aesni: Split plugin to avoid potential SIGILL Because the CFLAGS applied to the whole plugin, the compiler could "optimize" the boilerplate plugin code, which could then cause a SIGILL on hardware that doesn't support such instructions. This change makes sure only the actual AES implementation is compiled like that, which would then not get registered depending on the CPU feature detection. --- src/libstrongswan/plugins/aesni/Makefile.am | 28 +++++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/src/libstrongswan/plugins/aesni/Makefile.am b/src/libstrongswan/plugins/aesni/Makefile.am index 0faf90f62..51450bebe 100644 --- a/src/libstrongswan/plugins/aesni/Makefile.am +++ b/src/libstrongswan/plugins/aesni/Makefile.am @@ -2,18 +2,10 @@ AM_CPPFLAGS = \ -I$(top_srcdir)/src/libstrongswan AM_CFLAGS = \ - -maes \ - -mpclmul \ - -mssse3 \ $(PLUGIN_CFLAGS) -if MONOLITHIC -noinst_LTLIBRARIES = libstrongswan-aesni.la -else -plugin_LTLIBRARIES = libstrongswan-aesni.la -endif - -libstrongswan_aesni_la_SOURCES = \ +noinst_LTLIBRARIES = libaesni.la +libaesni_la_SOURCES = \ aesni_key.h aesni_key.c \ aesni_cbc.h aesni_cbc.c \ aesni_ecb.h aesni_ecb.c \ @@ -21,7 +13,21 @@ libstrongswan_aesni_la_SOURCES = \ aesni_ccm.h aesni_ccm.c \ aesni_gcm.h aesni_gcm.c \ aesni_xcbc.h aesni_xcbc.c \ - aesni_cmac.h aesni_cmac.c \ + aesni_cmac.h aesni_cmac.c + +libaesni_la_CFLAGS = \ + -maes \ + -mpclmul \ + -mssse3 + +if MONOLITHIC +noinst_LTLIBRARIES += libstrongswan-aesni.la +else +plugin_LTLIBRARIES = libstrongswan-aesni.la +endif + +libstrongswan_aesni_la_SOURCES = \ aesni_plugin.h aesni_plugin.c libstrongswan_aesni_la_LDFLAGS = -module -avoid-version +libstrongswan_aesni_la_LIBADD = libaesni.la