Your message dated Fri, 16 Oct 2026 03:34:29 +0000
with message-id <[email protected]>
and subject line Bug#1150677: fixed in linux 7.3~rc7-1~exp1
has caused the Debian Bug report #1150677,
regarding linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)`
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150677: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150677
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: src:linux
Version: 7.2.9-1
Severity: minor
Dear Debian folks,
On a Dell XPS 13 7390, BIOS 1.29.0, Nuvoton TPM 2.0 NTC0702, Linux
7.2.9-1 (*linux-image-7.2.9+deb14-amd64* 7.2.9-1) logs the error below:
[ 0.546039] ima: Allocated hash algorithm: sha256
[ 0.548233] ima: Can not allocate sha384 (reason: -2)
sha384 is provided by `CONFIG_CRYPTO_SHA512` (`crypto/sha512.c`), which
`debian/config/config` sets to m:
$ grep SHA512 /boot/config-7.2.9+deb14-amd64
# CONFIG_MODULE_SIG_SHA512 is not set
CONFIG_CRYPTO_SHA512=m
CONFIG_CRYPTO_LIB_SHA512=y
CONFIG_CRYPTO_LIB_SHA512_ARCH=y
SHA-1 works because IMA selects `CRYPTO_SHA1` resulting in:
$ grep CRYPTO_SHA1 /boot/config-7.2.9+deb14-amd64
CONFIG_CRYPTO_SHA1=y
SHA-256 works because `debian/config/config` already builds it in “for
IMA_DEFAULT_HASH_SHA256”.
$ grep CRYPTO_SHA256 /boot/config-7.2.9+deb14-amd64
CONFIG_CRYPTO_SHA256=y
SHA-384 gets -ENOENT.
Please consider setting
CONFIG_CRYPTO_SHA512=y
next to `CONFIG_CRYPTO_SHA256=y`. `CONFIG_CRYPTO_LIB_SHA512` is already
built in, so only the crypto API glue moves into vmlinux.
Tested on Dell XPS 13 7390.
Kind regards,
Paul
PS: `ima_init_crypto()` runs as a late initcall. It allocates a shash
for every PCR bank, the TPM reports as active.
`tpm2_get_pcr_allocation()` skips banks without selected PCRs. With the
default ima_hash and no policy loaded yet, that loop is the only place
requesting sha384, so this TPM has an active SHA-384 bank.
The effect is more than a log message. For a bank without a tfm, IMA
extends PCR 10 with the zero-padded SHA-1 template digest (see the
comment “for unmapped TPM algorithms digest is still a padded SHA1” in
`ima_calc_field_array_hash()`). So the SHA-384 bank of PCR 10 does not
contain SHA-384 measurements.
PPS: Related to bug report #1144056 [1].
https://bugs.debian.org/1144056
--- End Message ---
--- Begin Message ---
Source: linux
Source-Version: 7.3~rc7-1~exp1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated linux package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 16 Oct 2026 04:51:48 +0200
Source: linux
Architecture: source
Version: 7.3~rc7-1~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Kernel Team <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1148364 1149564 1149840 1150677
Changes:
linux (7.3~rc7-1~exp1) experimental; urgency=medium
.
* New upstream release candidate.
- bnxt_en: fix DMA mapping length for padded small packets
(Closes: #1149564)
- riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
(Closes: #1148364)
.
[ Salvatore Bonaccorso ]
* drivers/hwmon: Enable SENSORS_ARCTIC_FAN_CONTROLLER as module
(Closes: #1149840)
* Change CRYPTO_SHA512 from module to built-in, as required by IMA
(Closes: #1150677)
Checksums-Sha1:
943670ca7abe2d423d70f196aa82709d0c239a29 180429 linux_7.3~rc7-1~exp1.dsc
06a651adf41b1ebf4fb6226296890023a876044c 165730924 linux_7.3~rc7.orig.tar.xz
34b655852b6bd35170dc89ac489ed2d72068efcd 1457708
linux_7.3~rc7-1~exp1.debian.tar.xz
46c600e45d8dcfb131e4f06ac4f795a271b80778 5925
linux_7.3~rc7-1~exp1_source.buildinfo
Checksums-Sha256:
8a806f5233f53f783999343d648e288af0ea37845c0bf61bd9e7f3e18465474b 180429
linux_7.3~rc7-1~exp1.dsc
b002bfc898de459a40f47f216393f5489427ab2e4dd095b1ed510ace0a42f9f0 165730924
linux_7.3~rc7.orig.tar.xz
f6bc8ab6213a40bd624b02d0a493449c1d2c327dbea1ef01863ad9e95bf0f30c 1457708
linux_7.3~rc7-1~exp1.debian.tar.xz
5b3176154fff07790e0390be622d25bfcd61c7cd1dc386464f3218be4ee4b14c 5925
linux_7.3~rc7-1~exp1_source.buildinfo
Files:
620c7e6773f3ce71c3053573ce45bae4 180429 kernel optional
linux_7.3~rc7-1~exp1.dsc
df638a7abe9f4e77c147bcad6038322a 165730924 kernel optional
linux_7.3~rc7.orig.tar.xz
9b4ba411c608da86083e8c4c6c99fdf4 1457708 kernel optional
linux_7.3~rc7-1~exp1.debian.tar.xz
9c45ee193ed103a452b2204f87ba5abc 5925 kernel optional
linux_7.3~rc7-1~exp1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrRlslfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EChEP/iGWQM0am1AGCzCrLOZycZYBFEZVv9C7
BLVMWalwmvDCEQlzDY+IfenMMU5WPKouZPS2Iy6dm4BPWFbRB51gh30Gn4DaEr21
7ToWV6O7XufPWVh8BfdMUKgo82VcCN2UlyigjrZmTAhYVJKF6q91B8daKkkjKySV
efCX1tVAreP8pvtbDVTx1o0pQa2lTyPGTAE+fMI2be+Qz6qo2LzQWX5wd4dRZN2m
EYYQjvBeJY8Xrmt45u2gk3dUM1q0RdlLZh2RJOxvxuKx3Ogo0fo3GJyez1BvIb3y
YtJyVh2RO/JZC1sILdk6al3/76Fs2ixqwndt02Mp1+YCCwemKcW3Jlfqd1jPonB2
brwm5JR3XDWsdBq6Gs7ZsOJpd63AGzgoZYioViRyf6h8Io2iZuuOBydtQafMPRTI
G/ftOVl5aGSYqkWSbHiBFiGDyQeIGDs9nPV3gX1utdCdCKS82/Arp7H7tRQSlt0p
0xzbrCLlnxMxpg4Nlww6/cXGG6p1xSTrTc8kUELWtBm5jBuv9/YGtWrg/cM9lQ2W
33KBl/3kzRJPGyJtTi0fIGcycpcVlX/HxDV/SgjvzE8P6Mn7D6Yom0tKAv8EJKjc
ikUubGcKQyEgA3UE07oAsyUjs/iter5qztmJV7mm2pbOzllQdYAnNDlkskkTUwIM
njWrcnth2L5g
=Eyi+
-----END PGP SIGNATURE-----
pgp_juspRGyDx.pgp
Description: PGP signature
--- End Message ---
