修改内核路径

hc

2024-05-14 bedbef8ad3e75a304af6361af235302bcc61d06b

 kernel/crypto/asymmetric_keys/verify_pefile.c
..
..
@@ -74,7 +74,7 @@
74
74
 		break;
75
75
 
76
76
 	default:
77
-		pr_debug("Unknown PEOPT magic = %04hx\n", pe32->magic);
77
+		pr_warn("Unknown PEOPT magic = %04hx\n", pe32->magic);
78
78
 		return -ELIBBAD;
79
79
 	}
80
80
 
..
..
@@ -95,7 +95,7 @@
95
95
 	ctx->certs_size = ddir->certs.size;
96
96
 
97
97
 	if (!ddir->certs.virtual_address || !ddir->certs.size) {
98
-		pr_debug("Unsigned PE binary\n");
98
+		pr_warn("Unsigned PE binary\n");
99
99
 		return -ENODATA;
100
100
 	}
101
101
 
..
..
@@ -127,7 +127,7 @@
127
127
 	unsigned len;
128
128
 
129
129
 	if (ctx->sig_len < sizeof(wrapper)) {
130
-		pr_debug("Signature wrapper too short\n");
130
+		pr_warn("Signature wrapper too short\n");
131
131
 		return -ELIBBAD;
132
132
 	}
133
133
 
..
..
@@ -135,19 +135,23 @@
135
135
 	pr_debug("sig wrapper = { %x, %x, %x }\n",
136
136
 		 wrapper.length, wrapper.revision, wrapper.cert_type);
137
137
 
138
-	/* Both pesign and sbsign round up the length of certificate table
139
-	 * (in optional header data directories) to 8 byte alignment.
138
+	/* sbsign rounds up the length of certificate table (in optional
139
+	 * header data directories) to 8 byte alignment.  However, the PE
140
+	 * specification states that while entries are 8-byte aligned, this is
141
+	 * not included in their length, and as a result, pesign has not
142
+	 * rounded up since 0.110.
140
143
 	 */
141
-	if (round_up(wrapper.length, 8) != ctx->sig_len) {
142
-		pr_debug("Signature wrapper len wrong\n");
144
+	if (wrapper.length > ctx->sig_len) {
145
+		pr_warn("Signature wrapper bigger than sig len (%x > %x)\n",
146
+			ctx->sig_len, wrapper.length);
143
147
 		return -ELIBBAD;
144
148
 	}
145
149
 	if (wrapper.revision != WIN_CERT_REVISION_2_0) {
146
-		pr_debug("Signature is not revision 2.0\n");
150
+		pr_warn("Signature is not revision 2.0\n");
147
151
 		return -ENOTSUPP;
148
152
 	}
149
153
 	if (wrapper.cert_type != WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
150
-		pr_debug("Signature certificate type is not PKCS\n");
154
+		pr_warn("Signature certificate type is not PKCS\n");
151
155
 		return -ENOTSUPP;
152
156
 	}
153
157
 
..
..
@@ -160,7 +164,7 @@
160
164
 	ctx->sig_offset += sizeof(wrapper);
161
165
 	ctx->sig_len -= sizeof(wrapper);
162
166
 	if (ctx->sig_len < 4) {
163
-		pr_debug("Signature data missing\n");
167
+		pr_warn("Signature data missing\n");
164
168
 		return -EKEYREJECTED;
165
169
 	}
166
170
 
..
..
@@ -194,7 +198,7 @@
194
198
 		return 0;
195
199
 	}
196
200
 not_pkcs7:
197
-	pr_debug("Signature data not PKCS#7\n");
201
+	pr_warn("Signature data not PKCS#7\n");
198
202
 	return -ELIBBAD;
199
203
 }
200
204
 
..
..
@@ -337,8 +341,8 @@
337
341
 	digest_size = crypto_shash_digestsize(tfm);
338
342
 
339
343
 	if (digest_size != ctx->digest_len) {
340
-		pr_debug("Digest size mismatch (%zx != %x)\n",
341
-			 digest_size, ctx->digest_len);
344
+		pr_warn("Digest size mismatch (%zx != %x)\n",
345
+			digest_size, ctx->digest_len);
342
346
 		ret = -EBADMSG;
343
347
 		goto error_no_desc;
344
348
 	}
..
..
@@ -369,7 +373,7 @@
369
373
 	 * PKCS#7 certificate.
370
374
 	 */
371
375
 	if (memcmp(digest, ctx->digest, ctx->digest_len) != 0) {
372
-		pr_debug("Digest mismatch\n");
376
+		pr_warn("Digest mismatch\n");
373
377
 		ret = -EKEYREJECTED;
374
378
 	} else {
375
379
 		pr_debug("The digests match!\n");