Re: [PATCH v2 04/18] certs: Create blacklist keyring earlier
From: Alistair Francis <hidden>
Date: 2024-07-10 02:53:03
Also in:
keyrings, linux-crypto, linux-cxl, linux-pci
On Sun, 2024-06-30 at 21:39 +0200, Lukas Wunner wrote:
The upcoming support for PCI device authentication with CMA-SPDM (PCIe r6.2 sec 6.31) requires parsing X.509 certificates upon device enumeration, which happens in a subsys_initcall(). Parsing X.509 certificates accesses the blacklist keyring: x509_cert_parse() x509_get_sig_params() is_hash_blacklisted() keyring_search() So far the keyring is created much later in a device_initcall(). Avoid a NULL pointer dereference on access to the keyring by creating it one initcall level earlier than PCI device enumeration, i.e. in an arch_initcall(). Signed-off-by: Lukas Wunner <lukas@wunner.de> Reviewed-by: Dan Williams <redacted> Reviewed-by: Wilfred Mallawa <redacted> Reviewed-by: Alistair Francis <redacted> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alistair Francis <redacted> Alistair
quoted hunk ↗ jump to hunk
--- certs/blacklist.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/certs/blacklist.c b/certs/blacklist.c index 675dd7a8f07a..34185415d451 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c@@ -311,7 +311,7 @@ static int restrict_link_for_blacklist(struct key*dest_keyring, * Initialise the blacklist * * The blacklist_init() function is registered as an initcall via - * device_initcall(). As a result if the blacklist_init() function fails for + * arch_initcall(). As a result if the blacklist_init() function fails for * any reason the kernel continues to execute. While cleanly returning -ENODEV * could be acceptable for some non-critical kernel parts, if the blacklist * keyring fails to load it defeats the certificate/key based deny list for@@ -356,7 +356,7 @@ static int __init blacklist_init(void)/* * Must be initialised before we try and load the keys into the keyring. */ -device_initcall(blacklist_init); +arch_initcall(blacklist_init); #ifdef CONFIG_SYSTEM_REVOCATION_LIST /*