4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thore Sommer public@thson.de
commit ef5b52a631f8c18353e80ccab8408b963305510c upstream.
When the hash algorithm for the signature is not available the digest size is 0 and the signature in the certificate is marked as unsupported.
When validating a self-signed certificate, this needs to be checked, because otherwise trying to validate the signature will fail with an warning:
Loading compiled-in X.509 certificates WARNING: CPU: 0 PID: 1 at crypto/rsa-pkcs1pad.c:537 \ pkcs1pad_verify+0x46/0x12c ... Problem loading in-kernel X.509 certificate (-22)
Signed-off-by: Thore Sommer public@thson.de Cc: stable@vger.kernel.org # v4.7+ Fixes: 6c2dc5ae4ab7 ("X.509: Extract signature digest and make self-signed cert checks earlier") Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- crypto/asymmetric_keys/x509_public_key.c | 5 +++++ 1 file changed, 5 insertions(+)
--- a/crypto/asymmetric_keys/x509_public_key.c +++ b/crypto/asymmetric_keys/x509_public_key.c @@ -138,6 +138,11 @@ int x509_check_for_self_signed(struct x5 if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0) goto out;
+ if (cert->unsupported_sig) { + ret = 0; + goto out; + } + ret = public_key_verify_signature(cert->pub, cert->sig); if (ret < 0) { if (ret == -ENOPKG) {