Commit fab634c4 authored by Eric Biggers's avatar Eric Biggers
Browse files

fs-verity: don't pass whole descriptor to fsverity_verify_signature() 

Now that fsverity_get_descriptor() validates the sig_size field,
fsverity_verify_signature() doesn't need to do it.

Just change the prototype of fsverity_verify_signature() to take the
signature directly rather than take a fsverity_descriptor.

Link: https://lore.kernel.org/r/20210115181819.34732-3-ebiggers@kernel.org


Reviewed-by: default avatarVictor Hsieh <victorhsieh@google.com>
Reviewed-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
Reviewed-by: default avatarAmy Parker <enbyamy@gmail.com>
Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
parent c2c82611

fs/verity/fsverity_private.h

+2 −4
Original line number Diff line number Diff line
@@ -140,15 +140,13 @@ void __init fsverity_exit_info_cache(void); 


#ifdef CONFIG_FS_VERITY_BUILTIN_SIGNATURES

int fsverity_verify_signature(const struct fsverity_info *vi,

			      const struct fsverity_descriptor *desc,

			      size_t desc_size);

			      const u8 *signature, size_t sig_size);



int __init fsverity_init_signature(void);

#else /* !CONFIG_FS_VERITY_BUILTIN_SIGNATURES */

static inline int

fsverity_verify_signature(const struct fsverity_info *vi,

			  const struct fsverity_descriptor *desc,

			  size_t desc_size)

			  const u8 *signature, size_t sig_size)

{

	return 0;

}

fs/verity/open.c

+2 −1
Original line number Diff line number Diff line
@@ -181,7 +181,8 @@ struct fsverity_info *fsverity_create_info(const struct inode *inode, 
		 vi->tree_params.hash_alg->name,

		 vi->tree_params.digest_size, vi->file_digest);



	err = fsverity_verify_signature(vi, desc, desc_size);

	err = fsverity_verify_signature(vi, desc->signature,

					le32_to_cpu(desc->sig_size));

out:

	if (err) {

		fsverity_free_info(vi);

fs/verity/signature.c

+6 −14
Original line number Diff line number Diff line
@@ -29,21 +29,19 @@ static struct key *fsverity_keyring; 
/**

 * fsverity_verify_signature() - check a verity file's signature

 * @vi: the file's fsverity_info

 * @desc: the file's fsverity_descriptor

 * @desc_size: size of @desc

 * @signature: the file's built-in signature

 * @sig_size: size of signature in bytes, or 0 if no signature

 *

 * If the file's fs-verity descriptor includes a signature of the file digest,

 * verify it against the certificates in the fs-verity keyring.

 * If the file includes a signature of its fs-verity file digest, verify it

 * against the certificates in the fs-verity keyring.

 *

 * Return: 0 on success (signature valid or not required); -errno on failure

 */

int fsverity_verify_signature(const struct fsverity_info *vi,

			      const struct fsverity_descriptor *desc,

			      size_t desc_size)

			      const u8 *signature, size_t sig_size)

{

	const struct inode *inode = vi->inode;

	const struct fsverity_hash_alg *hash_alg = vi->tree_params.hash_alg;

	const u32 sig_size = le32_to_cpu(desc->sig_size);

	struct fsverity_formatted_digest *d;

	int err;
@@ -56,11 +54,6 @@ int fsverity_verify_signature(const struct fsverity_info *vi, 
		return 0;

	}



	if (sig_size > desc_size - sizeof(*desc)) {

		fsverity_err(inode, "Signature overflows verity descriptor");

		return -EBADMSG;

	}



	d = kzalloc(sizeof(*d) + hash_alg->digest_size, GFP_KERNEL);

	if (!d)

		return -ENOMEM;
@@ -70,8 +63,7 @@ int fsverity_verify_signature(const struct fsverity_info *vi, 
	memcpy(d->digest, vi->file_digest, hash_alg->digest_size);



	err = verify_pkcs7_signature(d, sizeof(*d) + hash_alg->digest_size,

				     desc->signature, sig_size,

				     fsverity_keyring,

				     signature, sig_size, fsverity_keyring,

				     VERIFYING_UNSPECIFIED_SIGNATURE,

				     NULL, NULL);

	kfree(d);