Commit 380d6afcb3 for openssl.org

commit 380d6afcb3737da1e50709e84e538a9125cdb948
Author: Richard Levitte <levitte@openssl.foundation>
Date:   Tue Jul 14 11:34:56 2026 +0200

    keccak1600x4-avx512vl: fix undefined symbols on macOS

    The one-shot SHAKE x4 wrappers call the incremental absorb and squeeze
    routines through call_internal(), which on non-Win64 emitted a call to
    the public global symbol by its bare name.  These calls textually
    precede the callees' .globl declarations, so x86_64-xlate.pl never
    prepends the platform's leading underscore to the referenced symbol.

    On ELF (Linux) that is harmless since symbols carry no leading
    underscore, but on Mach-O (macOS) the call references the un-decorated
    SHA3_shake*_x4_inc_*_avx512vl while the defined symbol is
    _SHA3_shake*_x4_inc_*_avx512vl, leaving four undefined externals and
    breaking the darwin64-x86_64 link of libcrypto:

      SHA3_shake128_x4_inc_absorb_avx512vl
      SHA3_shake256_x4_inc_absorb_avx512vl
      SHA3_shake128_x4_inc_squeeze_avx512vl
      SHA3_shake256_x4_inc_squeeze_avx512vl

    Call the local .L_<name> entry label instead -- the same address as the
    public symbol and the pattern the finalize calls already use -- so the
    reference resolves locally and these internal routines cannot be
    interposed.  The Win64 path is unchanged.

    Fixes: https://github.com/openssl/openssl/issues/31941
    Fixes: a248ec771e ("ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integration")
    Assisted-by: Pi:z-ai/glm-5.2

    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    MergeDate: Tue Jul 14 12:33:50 2026
    (Merged from https://github.com/openssl/openssl/pull/31942)

diff --git a/crypto/sha/asm/keccak1600x4-avx512vl.pl b/crypto/sha/asm/keccak1600x4-avx512vl.pl
index b5a6ac7377..a7fc1814f5 100755
--- a/crypto/sha/asm/keccak1600x4-avx512vl.pl
+++ b/crypto/sha/asm/keccak1600x4-avx512vl.pl
@@ -85,7 +85,12 @@ $sf_size="856";       # 48 + 808 = 856 bytes
 # Emit an internal helper call used by one-shot wrappers.
 # - Win64: call the provided *_internal shim and bracket it with 32-byte
 #   shadow space so shim entry can use xlate-compatible [rsp+8]/[rsp+16].
-# - non-Win64: call the public API symbol (same base name without _internal).
+# - non-Win64: call the local function entry label (.L_<base name>), which
+#   sits at the same address as the public symbol.  Calling the public
+#   global symbol by name here would break Mach-O builds: the call textually
+#   precedes the symbol's .globl declaration, so x86_64-xlate.pl never gets
+#   a chance to prepend the platform's leading-underscore, leaving an
+#   undefined reference to the un-decorated name.
 # The argument must be the shim/internal symbol name, e.g.
 #   SHA3_shake128_x4_inc_squeeze_avx512vl_internal
 sub call_internal {
@@ -101,7 +106,7 @@ sub call_internal {
 ___

     return <<___;
-    call    $external_name
+    call    .L_$external_name
 ___
 }