1. 09 Sep, 2018 1 commit
  2. 25 Jun, 2018 1 commit
    • Maciej S. Szmigiero's avatar
      X.509: unpack RSA signatureValue field from BIT STRING · b65c32ec
      Maciej S. Szmigiero authored
      The signatureValue field of a X.509 certificate is encoded as a BIT STRING.
      For RSA signatures this BIT STRING is of so-called primitive subtype, which
      contains a u8 prefix indicating a count of unused bits in the encoding.
      We have to strip this prefix from signature data, just as we already do for
      key data in x509_extract_key_data() function.
      This wasn't noticed earlier because this prefix byte is zero for RSA key
      sizes divisible by 8. Since BIT STRING is a big-endian encoding adding zero
      prefixes has no bearing on its value.
      The signature length, however was incorrect, which is a problem for RSA
      implementations that need it to be exactly correct (like AMD CCP).
      Signed-off-by: 's avatarMaciej S. Szmigiero <mail@maciej.szmigiero.name>
      Fixes: c26fd69f ("X.509: Add a crypto key parser for binary (DER) X.509 certificates")
      Cc: stable@vger.kernel.org
      Signed-off-by: 's avatarJames Morris <james.morris@microsoft.com>
  3. 15 Jun, 2018 1 commit
  4. 07 Apr, 2018 3 commits
  5. 22 Feb, 2018 5 commits
    • Eric Biggers's avatar
      X.509: fix NULL dereference when restricting key with unsupported_sig · 4b34968e
      Eric Biggers authored
      The asymmetric key type allows an X.509 certificate to be added even if
      its signature's hash algorithm is not available in the crypto API.  In
      that case 'payload.data[asym_auth]' will be NULL.  But the key
      restriction code failed to check for this case before trying to use the
      signature, resulting in a NULL pointer dereference in
      key_or_keyring_common() or in restrict_link_by_signature().
      Fix this by returning -ENOPKG when the signature is unsupported.
      Reproducer when all the CONFIG_CRYPTO_SHA512* options are disabled and
      keyctl has support for the 'restrict_keyring' command:
          keyctl new_session
          keyctl restrict_keyring @s asymmetric builtin_trusted
          openssl req -new -sha512 -x509 -batch -nodes -outform der \
              | keyctl padd asymmetric desc @s
      Fixes: a511e1af ("KEYS: Move the point of trust determination to __key_link()")
      Cc: <stable@vger.kernel.org> # v4.7+
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    • Eric Biggers's avatar
      X.509: fix BUG_ON() when hash algorithm is unsupported · 437499ee
      Eric Biggers authored
      The X.509 parser mishandles the case where the certificate's signature's
      hash algorithm is not available in the crypto API.  In this case,
      x509_get_sig_params() doesn't allocate the cert->sig->digest buffer;
      this part seems to be intentional.  However,
      public_key_verify_signature() is still called via
      x509_check_for_self_signed(), which triggers the 'BUG_ON(!sig->digest)'.
      Fix this by making public_key_verify_signature() return -ENOPKG if the
      hash buffer has not been allocated.
      Reproducer when all the CONFIG_CRYPTO_SHA512* options are disabled:
          openssl req -new -sha512 -x509 -batch -nodes -outform der \
              | keyctl padd asymmetric desc @s
      Fixes: 6c2dc5ae ("X.509: Extract signature digest and make self-signed cert checks earlier")
      Reported-by: 's avatarPaolo Valente <paolo.valente@linaro.org>
      Cc: Paolo Valente <paolo.valente@linaro.org>
      Cc: <stable@vger.kernel.org> # v4.7+
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    • Eric Biggers's avatar
      PKCS#7: fix direct verification of SignerInfo signature · 6459ae38
      Eric Biggers authored
      If none of the certificates in a SignerInfo's certificate chain match a
      trusted key, nor is the last certificate signed by a trusted key, then
      pkcs7_validate_trust_one() tries to check whether the SignerInfo's
      signature was made directly by a trusted key.  But, it actually fails to
      set the 'sig' variable correctly, so it actually verifies the last
      signature seen.  That will only be the SignerInfo's signature if the
      certificate chain is empty; otherwise it will actually be the last
      certificate's signature.
      This is not by itself a security problem, since verifying any of the
      certificates in the chain should be sufficient to verify the SignerInfo.
      Still, it's not working as intended so it should be fixed.
      Fix it by setting 'sig' correctly for the direct verification case.
      Fixes: 757932e6 ("PKCS#7: Handle PKCS#7 messages that contain no X.509 certs")
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    • Eric Biggers's avatar
      PKCS#7: fix certificate blacklisting · 29f4a67c
      Eric Biggers authored
      If there is a blacklisted certificate in a SignerInfo's certificate
      chain, then pkcs7_verify_sig_chain() sets sinfo->blacklisted and returns
      0.  But, pkcs7_verify() fails to handle this case appropriately, as it
      actually continues on to the line 'actual_ret = 0;', indicating that the
      SignerInfo has passed verification.  Consequently, PKCS#7 signature
      verification ignores the certificate blacklist.
      Fix this by not considering blacklisted SignerInfos to have passed
      Also fix the function comment with regards to when 0 is returned.
      Fixes: 03bb7931 ("PKCS#7: Handle blacklisted certificates")
      Cc: <stable@vger.kernel.org> # v4.12+
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    • Eric Biggers's avatar
      PKCS#7: fix certificate chain verification · 971b42c0
      Eric Biggers authored
      When pkcs7_verify_sig_chain() is building the certificate chain for a
      SignerInfo using the certificates in the PKCS#7 message, it is passing
      the wrong arguments to public_key_verify_signature().  Consequently,
      when the next certificate is supposed to be used to verify the previous
      certificate, the next certificate is actually used to verify itself.
      An attacker can use this bug to create a bogus certificate chain that
      has no cryptographic relationship between the beginning and end.
      Fortunately I couldn't quite find a way to use this to bypass the
      overall signature verification, though it comes very close.  Here's the
      reasoning: due to the bug, every certificate in the chain beyond the
      first actually has to be self-signed (where "self-signed" here refers to
      the actual key and signature; an attacker might still manipulate the
      certificate fields such that the self_signed flag doesn't actually get
      set, and thus the chain doesn't end immediately).  But to pass trust
      validation (pkcs7_validate_trust()), either the SignerInfo or one of the
      certificates has to actually be signed by a trusted key.  Since only
      self-signed certificates can be added to the chain, the only way for an
      attacker to introduce a trusted signature is to include a self-signed
      trusted certificate.
      But, when pkcs7_validate_trust_one() reaches that certificate, instead
      of trying to verify the signature on that certificate, it will actually
      look up the corresponding trusted key, which will succeed, and then try
      to verify the *previous* certificate, which will fail.  Thus, disaster
      is narrowly averted (as far as I could tell).
      Fixes: 6c2dc5ae ("X.509: Extract signature digest and make self-signed cert checks earlier")
      Cc: <stable@vger.kernel.org> # v4.7+
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
  6. 08 Dec, 2017 7 commits
    • Eric Biggers's avatar
      X.509: fix comparisons of ->pkey_algo · 54c1fb39
      Eric Biggers authored
      ->pkey_algo used to be an enum, but was changed to a string by commit
      4e8ae72a ("X.509: Make algo identifiers text instead of enum").  But
      two comparisons were not updated.  Fix them to use strcmp().
      This bug broke signature verification in certain configurations,
      depending on whether the string constants were deduplicated or not.
      Fixes: 4e8ae72a ("X.509: Make algo identifiers text instead of enum")
      Cc: <stable@vger.kernel.org> # v4.6+
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    • Eric Biggers's avatar
      X.509: use crypto_shash_digest() · aa330036
      Eric Biggers authored
      Use crypto_shash_digest() instead of crypto_shash_init() followed by
      crypto_shash_finup().  (For simplicity only; they are equivalent.)
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    • Eric Biggers's avatar
      KEYS: be careful with error codes in public_key_verify_signature() · 72f9a07b
      Eric Biggers authored
      In public_key_verify_signature(), if akcipher_request_alloc() fails, we
      return -ENOMEM.  But that error code was set 25 lines above, and by
      accident someone could easily insert new code in between that assigns to
      'ret', which would introduce a signature verification bypass.  Make the
      code clearer by moving the -ENOMEM down to where it is used.
      Additionally, the callers of public_key_verify_signature() only consider
      a negative return value to be an error.  This means that if any positive
      return value is accidentally introduced deeper in the call stack (e.g.
      'return EBADMSG' instead of 'return -EBADMSG' somewhere in RSA),
      signature verification will be bypassed.  Make things more robust by
      having public_key_verify_signature() warn about positive errors and
      translate them into -EINVAL.
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    • Eric Biggers's avatar
      pkcs7: use crypto_shash_digest() · a80745a6
      Eric Biggers authored
      Use crypto_shash_digest() instead of crypto_shash_init() followed by
      crypto_shash_finup().  (For simplicity only; they are equivalent.)
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    • Eric Biggers's avatar
      pkcs7: fix check for self-signed certificate · 7204eb85
      Eric Biggers authored
      pkcs7_validate_trust_one() used 'x509->next == x509' to identify a
      self-signed certificate.  That's wrong; ->next is simply the link in the
      linked list of certificates in the PKCS#7 message.  It should be
      checking ->signer instead.  Fix it.
      Fortunately this didn't actually matter because when we re-visited
      'x509' on the next iteration via 'x509->signer', it was already seen and
      not verified, so we returned -ENOKEY anyway.
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: 's avatarJames Morris <james.l.morris@oracle.com>
    • Eric Biggers's avatar
      pkcs7: return correct error code if pkcs7_check_authattrs() fails · 8ecb506d
      Eric Biggers authored
      If pkcs7_check_authattrs() returns an error code, we should pass that
      error code on, rather than using ENOMEM.
      Fixes: 99db4435 ("PKCS#7: Appropriately restrict authenticated attributes and content type")
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: 's avatarJames Morris <james.l.morris@oracle.com>
    • Eric Biggers's avatar
      X.509: reject invalid BIT STRING for subjectPublicKey · 0f30cbea
      Eric Biggers authored
      Adding a specially crafted X.509 certificate whose subjectPublicKey
      ASN.1 value is zero-length caused x509_extract_key_data() to set the
      public key size to SIZE_MAX, as it subtracted the nonexistent BIT STRING
      metadata byte.  Then, x509_cert_parse() called kmemdup() with that bogus
      size, triggering the WARN_ON_ONCE() in kmalloc_slab().
      This appears to be harmless, but it still must be fixed since WARNs are
      never supposed to be user-triggerable.
      Fix it by updating x509_cert_parse() to validate that the value has a
      BIT STRING metadata byte, and that the byte is 0 which indicates that
      the number of bits in the bitstring is a multiple of 8.
      It would be nice to handle the metadata byte in asn1_ber_decoder()
      instead.  But that would be tricky because in the general case a BIT
      STRING could be implicitly tagged, and/or could legitimately have a
      length that is not a whole number of bytes.
      Here was the WARN (cleaned up slightly):
          WARNING: CPU: 1 PID: 202 at mm/slab_common.c:971 kmalloc_slab+0x5d/0x70 mm/slab_common.c:971
          Modules linked in:
          CPU: 1 PID: 202 Comm: keyctl Tainted: G    B            4.14.0-09238-g1d3b78bb #26
          Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
          task: ffff880033014180 task.stack: ffff8800305c8000
          Call Trace:
           __do_kmalloc mm/slab.c:3706 [inline]
           __kmalloc_track_caller+0x22/0x2e0 mm/slab.c:3726
           kmemdup+0x17/0x40 mm/util.c:118
           kmemdup include/linux/string.h:414 [inline]
           x509_cert_parse+0x2cb/0x620 crypto/asymmetric_keys/x509_cert_parser.c:106
           x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174
           asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388
           key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850
           SYSC_add_key security/keys/keyctl.c:122 [inline]
           SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62
      Fixes: 42d5ec27 ("X.509: Add an ASN.1 decoder")
      Cc: <stable@vger.kernel.org> # v3.7+
      Signed-off-by: 's avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: 's avatarJames Morris <james.l.morris@oracle.com>
  7. 15 Nov, 2017 1 commit
  8. 03 Nov, 2017 1 commit
  9. 02 Nov, 2017 1 commit
    • Greg Kroah-Hartman's avatar
      License cleanup: add SPDX GPL-2.0 license identifier to files with no license · b2441318
      Greg Kroah-Hartman authored
      Many source files in the tree are missing licensing information, which
      makes it harder for compliance tools to determine the correct license.
      By default all files without license information are under the default
      license of the kernel, which is GPL version 2.
      Update the files which contain no license information with the 'GPL-2.0'
      SPDX license identifier.  The SPDX identifier is a legally binding
      shorthand, which can be used instead of the full boiler plate text.
      This patch is based on work done by Thomas Gleixner and Kate Stewart and
      Philippe Ombredanne.
      How this work was done:
      Patches were generated and checked against linux-4.14-rc6 for a subset of
      the use cases:
       - file had no licensing information it it.
       - file was a */uapi/* one with no licensing information in it,
       - file was a */uapi/* one with existing licensing information,
      Further patches will be generated in subsequent months to fix up cases
      where non-standard license headers were used, and references to license
      had to be inferred by heuristics based on keywords.
      The analysis to determine which SPDX License Identifier to be applied to
      a file was done in a spreadsheet of side by side results from of the
      output of two independent scanners (ScanCode & Windriver) producing SPDX
      tag:value files created by Philippe Ombredanne.  Philippe prepared the
      base worksheet, and did an initial spot review of a few 1000 files.
      The 4.13 kernel was the starting point of the analysis with 60,537 files
      assessed.  Kate Stewart did a file by file comparison of the scanner
      results in the spreadsheet to determine which SPDX license identifier(s)
      to be applied to the file. She confirmed any determination that was not
      immediately clear with lawyers working with the Linux Foundation.
      Criteria used to select files for SPDX license identifier tagging was:
       - Files considered eligible had to be source code files.
       - Make and config files were included as candidates if they contained >5
         lines of source
       - File already had some variant of a license header in it (even if <5
      All documentation files were explicitly excluded.
      The following heuristics were used to determine which SPDX license
      identifiers to apply.
       - when both scanners couldn't find any license traces, file was
         considered to have no license information in it, and the top level
         COPYING file license applied.
         For non */uapi/* files that summary was:
         SPDX license identifier                            # files
         GPL-2.0                                              11139
         and resulted in the first patch in this series.
         If that file was a */uapi/* path one, it was "GPL-2.0 WITH
         Linux-syscall-note" otherwise it was "GPL-2.0".  Results of that was:
         SPDX license identifier                            # files
         GPL-2.0 WITH Linux-syscall-note                        930
         and resulted in the second patch in this series.
       - if a file had some form of licensing information in it, and was one
         of the */uapi/* ones, it was denoted with the Linux-syscall-note if
         any GPL family license was found in the file or had no licensing in
         it (per prior point).  Results summary:
         SPDX license identifier                            # files
         GPL-2.0 WITH Linux-syscall-note                       270
         GPL-2.0+ WITH Linux-syscall-note                      169
         ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause)    21
         ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)    17
         LGPL-2.1+ WITH Linux-syscall-note                      15
         GPL-1.0+ WITH Linux-syscall-note                       14
         ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause)    5
         LGPL-2.0+ WITH Linux-syscall-note                       4
         LGPL-2.1 WITH Linux-syscall-note                        3
         ((GPL-2.0 WITH Linux-syscall-note) OR MIT)              3
         ((GPL-2.0 WITH Linux-syscall-note) AND MIT)             1
         and that resulted in the third patch in this series.
       - when the two scanners agreed on the detected license(s), that became
         the concluded license(s).
       - when there was disagreement between the two scanners (one detected a
         license but the other didn't, or they both detected different
         licenses) a manual inspection of the file occurred.
       - In most cases a manual inspection of the information in the file
         resulted in a clear resolution of the license that should apply (and
         which scanner probably needed to revisit its heuristics).
       - When it was not immediately clear, the license identifier was
         confirmed with lawyers working with the Linux Foundation.
       - If there was any question as to the appropriate license identifier,
         the file was flagged for further research and to be revisited later
         in time.
      In total, over 70 hours of logged manual review was done on the
      spreadsheet to determine the SPDX license identifiers to apply to the
      source files by Kate, Philippe, Thomas and, in some cases, confirmation
      by lawyers working with the Linux Foundation.
      Kate also obtained a third independent scan of the 4.13 code base from
      FOSSology, and compared selected files where the other two scanners
      disagreed against that SPDX file, to see if there was new insights.  The
      Windriver scanner is based on an older version of FOSSology in part, so
      they are related.
      Thomas did random spot checks in about 500 files from the spreadsheets
      for the uapi headers and agreed with SPDX license identifier in the
      files he inspected. For the non-uapi files Thomas did random spot checks
      in about 15000 files.
      In initial set of patches against 4.14-rc6, 3 files were found to have
      copy/paste license identifier errors, and have been fixed to reflect the
      correct identifier.
      Additionally Philippe spent 10 hours this week doing a detailed manual
      inspection and review of the 12,461 patched files from the initial patch
      version early this week with:
       - a full scancode scan run, collecting the matched texts, detected
         license ids and scores
       - reviewing anything where there was a license detected (about 500+
         files) to ensure that the applied SPDX license was correct
       - reviewing anything where there was no detection but the patch license
         was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied
         SPDX license was correct
      This produced a worksheet with 20 files needing minor correction.  This
      worksheet was then exported into 3 different .csv files for the
      different types of files to be modified.
      These .csv files were then reviewed by Greg.  Thomas wrote a script to
      parse the csv files and add the proper SPDX tag to the file, in the
      format that the file expected.  This script was further refined by Greg
      based on the output to detect more types of files automatically and to
      distinguish between header and source .c files (which need different
      comment types.)  Finally Greg ran the script using the .csv files to
      generate the patches.
      Reviewed-by: 's avatarKate Stewart <kstewart@linuxfoundation.org>
      Reviewed-by: 's avatarPhilippe Ombredanne <pombredanne@nexb.com>
      Reviewed-by: 's avatarThomas Gleixner <tglx@linutronix.de>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
  10. 18 Oct, 2017 3 commits
  11. 10 Jun, 2017 1 commit
  12. 09 Jun, 2017 2 commits
  13. 23 May, 2017 1 commit
  14. 04 Apr, 2017 3 commits
  15. 03 Apr, 2017 3 commits
    • Mat Martineau's avatar
      KEYS: Split role of the keyring pointer for keyring restrict functions · aaf66c88
      Mat Martineau authored
      The first argument to the restrict_link_func_t functions was a keyring
      pointer. These functions are called by the key subsystem with this
      argument set to the destination keyring, but restrict_link_by_signature
      expects a pointer to the relevant trusted keyring.
      Restrict functions may need something other than a single struct key
      pointer to allow or reject key linkage, so the data used to make that
      decision (such as the trust keyring) is moved to a new, fourth
      argument. The first argument is now always the destination keyring.
      Signed-off-by: 's avatarMat Martineau <mathew.j.martineau@linux.intel.com>
    • David Howells's avatar
      PKCS#7: Handle blacklisted certificates · 03bb7931
      David Howells authored
      PKCS#7: Handle certificates that are blacklisted when verifying the chain
      of trust on the signatures on a PKCS#7 message.
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    • David Howells's avatar
      X.509: Allow X.509 certs to be blacklisted · 43652956
      David Howells authored
      Allow X.509 certs to be blacklisted based on their TBSCertificate hash.
      This is convenient since we have to determine this anyway to be able to
      check the signature on an X.509 certificate.  This is also what UEFI uses
      in its blacklist.
      If a certificate built into the kernel is blacklisted, something like the
      following might then be seen during boot:
      	X.509: Cert 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 is blacklisted
      	Problem loading in-kernel X.509 certificate (-129)
      where the hex string shown is the blacklisted hash.
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
  16. 14 Dec, 2016 1 commit
  17. 25 Nov, 2016 1 commit
    • Andrey Ryabinin's avatar
      X.509: Fix double free in x509_cert_parse() [ver #3] · 2b95fda2
      Andrey Ryabinin authored
      We shouldn't free cert->pub->key in x509_cert_parse() because
      x509_free_certificate() also does this:
      	BUG: Double free or freeing an invalid pointer
      	Call Trace:
      	 [<ffffffff81896c20>] dump_stack+0x63/0x83
      	 [<ffffffff81356571>] kasan_object_err+0x21/0x70
      	 [<ffffffff81356ed9>] kasan_report_double_free+0x49/0x60
      	 [<ffffffff813561ad>] kasan_slab_free+0x9d/0xc0
      	 [<ffffffff81350b7a>] kfree+0x8a/0x1a0
      	 [<ffffffff81844fbf>] public_key_free+0x1f/0x30
      	 [<ffffffff818455d4>] x509_free_certificate+0x24/0x90
      	 [<ffffffff818460bc>] x509_cert_parse+0x2bc/0x300
      	 [<ffffffff81846cae>] x509_key_preparse+0x3e/0x330
      	 [<ffffffff818444cf>] asymmetric_key_preparse+0x6f/0x100
      	 [<ffffffff8178bec0>] key_create_or_update+0x260/0x5f0
      	 [<ffffffff8178e6d9>] SyS_add_key+0x199/0x2a0
      	 [<ffffffff821d823b>] entry_SYSCALL_64_fastpath+0x1e/0xad
      	Object at ffff880110bd1900, in cache kmalloc-512 size: 512
      	PID = 2579
      	[<ffffffff8104283b>] save_stack_trace+0x1b/0x20
      	[<ffffffff813558f6>] save_stack+0x46/0xd0
      	[<ffffffff81356183>] kasan_slab_free+0x73/0xc0
      	[<ffffffff81350b7a>] kfree+0x8a/0x1a0
      	[<ffffffff818460a3>] x509_cert_parse+0x2a3/0x300
      	[<ffffffff81846cae>] x509_key_preparse+0x3e/0x330
      	[<ffffffff818444cf>] asymmetric_key_preparse+0x6f/0x100
      	[<ffffffff8178bec0>] key_create_or_update+0x260/0x5f0
      	[<ffffffff8178e6d9>] SyS_add_key+0x199/0x2a0
      	[<ffffffff821d823b>] entry_SYSCALL_64_fastpath+0x1e/0xad
      Fixes: db6c43bd ("crypto: KEYS: convert public key and digsig asym to the akcipher api")
      Signed-off-by: 's avatarAndrey Ryabinin <aryabinin@virtuozzo.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: 's avatarJames Morris <james.l.morris@oracle.com>
  18. 18 Jul, 2016 3 commits
    • Mat Martineau's avatar
      KEYS: Fix for erroneous trust of incorrectly signed X.509 certs · acddc720
      Mat Martineau authored
      Arbitrary X.509 certificates without authority key identifiers (AKIs)
      can be added to "trusted" keyrings, including IMA or EVM certs loaded
      from the filesystem. Signature verification is currently bypassed for
      certs without AKIs.
      Trusted keys were recently refactored, and this bug is not present in
      restrict_link_by_signature should return -ENOKEY (no matching parent
      certificate found) if the certificate being evaluated has no AKIs,
      instead of bypassing signature checks and returning 0 (new certificate
      Reported-by: 's avatarPetko Manolov <petkan@mip-labs.com>
      Signed-off-by: 's avatarMat Martineau <mathew.j.martineau@linux.intel.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: 's avatarJames Morris <james.l.morris@oracle.com>
    • Lans Zhang's avatar
      pefile: Fix the failure of calculation for digest · d128471a
      Lans Zhang authored
      Commit e68503bd forgot to set digest_len and thus cause the following
      error reported by kexec when launching a crash kernel:
      	kexec_file_load failed: Bad message
      Fixes: e68503bd (KEYS: Generalise system_verify_data() to provide access to internal content)
      Signed-off-by: 's avatarLans Zhang <jia.zhang@windriver.com>
      Tested-by: 's avatarDave Young <dyoung@redhat.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Cc: Baoquan He <bhe@redhat.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      cc: kexec@lists.infradead.org
      cc: linux-crypto@vger.kernel.org
      Signed-off-by: 's avatarJames Morris <james.l.morris@oracle.com>
    • Lans Zhang's avatar
      PKCS#7: Fix panic when referring to the empty AKID when DEBUG defined · a46e6678
      Lans Zhang authored
      This fix resolves the following kernel panic if an empty or missing
      AuthorityKeyIdentifier is encountered and DEBUG is defined in
      [  459.041989] PKEY: <==public_key_verify_signature() = 0
      [  459.041993] PKCS7: Verified signature 1
      [  459.041995] PKCS7: ==> pkcs7_verify_sig_chain()
      [  459.041999] PKCS7: verify Sample DB Certificate for SCP: 01
      [  459.042002] PKCS7: - issuer Sample KEK Certificate for SCP
      [  459.042014] BUG: unable to handle kernel NULL pointer dereference at           (null)
      [  459.042135] IP: [<ffffffff813e7b4c>] pkcs7_verify+0x72c/0x7f0
      [  459.042217] PGD 739e6067 PUD 77719067 PMD 0
      [  459.042286] Oops: 0000 [#1] PREEMPT SMP
      [  459.042328] Modules linked in:
      [  459.042368] CPU: 0 PID: 474 Comm: kexec Not tainted 4.7.0-rc7-WR8.0.0.0_standard+ #18
      [  459.042462] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 10/09/2014
      [  459.042586] task: ffff880073a50000 ti: ffff8800738e8000 task.ti: ffff8800738e8000
      [  459.042675] RIP: 0010:[<ffffffff813e7b4c>]  [<ffffffff813e7b4c>] pkcs7_verify+0x72c/0x7f0
      [  459.042784] RSP: 0018:ffff8800738ebd58  EFLAGS: 00010246
      [  459.042845] RAX: 0000000000000000 RBX: ffff880076b7da80 RCX: 0000000000000006
      [  459.042929] RDX: 0000000000000001 RSI: ffffffff81c85001 RDI: ffffffff81ca00a9
      [  459.043014] RBP: ffff8800738ebd98 R08: 0000000000000400 R09: ffff8800788a304c
      [  459.043098] R10: 0000000000000000 R11: 00000000000060ca R12: ffff8800769a2bc0
      [  459.043182] R13: ffff880077358300 R14: 0000000000000000 R15: ffff8800769a2dc0
      [  459.043268] FS:  00007f24cc741700(0000) GS:ffff880074e00000(0000) knlGS:0000000000000000
      [  459.043365] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  459.043431] CR2: 0000000000000000 CR3: 0000000073a36000 CR4: 00000000001006f0
      [  459.043514] Stack:
      [  459.043530]  0000000000000000 ffffffbf00000020 31ffffff813e68b0 0000000000000002
      [  459.043644]  ffff8800769a2bc0 0000000000000000 00000000007197b8 0000000000000002
      [  459.043756]  ffff8800738ebdd8 ffffffff81153fb1 0000000000000000 0000000000000000
      [  459.043869] Call Trace:
      [  459.043898]  [<ffffffff81153fb1>] verify_pkcs7_signature+0x61/0x140
      [  459.043974]  [<ffffffff813e7f0b>] verify_pefile_signature+0x2cb/0x830
      [  459.044052]  [<ffffffff813e8470>] ? verify_pefile_signature+0x830/0x830
      [  459.044134]  [<ffffffff81048e25>] bzImage64_verify_sig+0x15/0x20
      [  459.046332]  [<ffffffff81046e09>] arch_kexec_kernel_verify_sig+0x29/0x40
      [  459.048552]  [<ffffffff810f10e4>] SyS_kexec_file_load+0x1f4/0x6c0
      [  459.050768]  [<ffffffff81050e36>] ? __do_page_fault+0x1b6/0x550
      [  459.052996]  [<ffffffff8199241f>] entry_SYSCALL_64_fastpath+0x17/0x93
      [  459.055242] Code: e8 0a d6 ff ff 85 c0 0f 88 7a fb ff ff 4d 39 fd 4d 89 7d 08 74 45 4d 89 fd e9 14 fe ff ff 4d 8b 76 08 31 c0 48 c7 c7 a9 00 ca 81 <41> 0f b7 36 49 8d 56 02 e8 d0 91 d6 ff 4d 8b 3c 24 4d 85 ff 0f
      [  459.060535] RIP  [<ffffffff813e7b4c>] pkcs7_verify+0x72c/0x7f0
      [  459.063040]  RSP <ffff8800738ebd58>
      [  459.065456] CR2: 0000000000000000
      [  459.075998] ---[ end trace c15f0e897cda28dc ]---
      Signed-off-by: 's avatarLans Zhang <jia.zhang@windriver.com>
      Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
      Cc: Dave Young <dyoung@redhat.com>
      Cc: Baoquan He <bhe@redhat.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      cc: linux-crypto@vger.kernel.org
      cc: kexec@lists.infradead.org
      Signed-off-by: 's avatarJames Morris <james.l.morris@oracle.com>
  19. 19 May, 2016 1 commit
    • Arnd Bergmann's avatar
      crypto: public_key: select CRYPTO_AKCIPHER · bad6a185
      Arnd Bergmann authored
      In some rare randconfig builds, we can end up with
      which fails to link because of the reference to crypto_alloc_akcipher:
      crypto/built-in.o: In function `public_key_verify_signature':
      :(.text+0x110e4): undefined reference to `crypto_alloc_akcipher'
      This adds a Kconfig 'select' statement to ensure the dependency
      is always there.
      Cc: <stable@vger.kernel.org>
      Signed-off-by: 's avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: 's avatarHerbert Xu <herbert@gondor.apana.org.au>