lkml.org 
[lkml]   [2017]   [Dec]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 045/164] X.509: fix comparisons of ->pkey_algo
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Biggers <ebiggers@google.com>

    commit 54c1fb39fe0495f846539ab765925b008f86801c upstream.

    ->pkey_algo used to be an enum, but was changed to a string by commit
    4e8ae72a75aa ("X.509: Make algo identifiers text instead of enum"). But
    two comparisons were not updated. Fix them to use strcmp().

    This bug broke signature verification in certain configurations,
    depending on whether the string constants were deduplicated or not.

    Fixes: 4e8ae72a75aa ("X.509: Make algo identifiers text instead of enum")
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    crypto/asymmetric_keys/pkcs7_verify.c | 2 +-
    crypto/asymmetric_keys/x509_public_key.c | 2 +-
    2 files changed, 2 insertions(+), 2 deletions(-)

    --- a/crypto/asymmetric_keys/pkcs7_verify.c
    +++ b/crypto/asymmetric_keys/pkcs7_verify.c
    @@ -150,7 +150,7 @@ static int pkcs7_find_key(struct pkcs7_m
    pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
    sinfo->index, certix);

    - if (x509->pub->pkey_algo != sinfo->sig->pkey_algo) {
    + if (strcmp(x509->pub->pkey_algo, sinfo->sig->pkey_algo) != 0) {
    pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
    sinfo->index);
    continue;
    --- a/crypto/asymmetric_keys/x509_public_key.c
    +++ b/crypto/asymmetric_keys/x509_public_key.c
    @@ -135,7 +135,7 @@ int x509_check_for_self_signed(struct x5
    }

    ret = -EKEYREJECTED;
    - if (cert->pub->pkey_algo != cert->sig->pkey_algo)
    + if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0)
    goto out;

    ret = public_key_verify_signature(cert->pub, cert->sig);

    \
     
     \ /
      Last update: 2017-12-12 13:48    [W:2.480 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site