Commit f1ce8643 authored by Ben Hutchings's avatar Ben Hutchings Committed by Jiri Slaby

module: Invalidate signatures on force-loaded modules

commit bca014ca upstream.

Signing a module should only make it trusted by the specific kernel it
was built for, not anything else.  Loading a signed module meant for a
kernel with a different ABI could have interesting effects.
Therefore, treat all signatures as invalid when a module is
force-loaded.
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
parent 8a00d8db
......@@ -2491,13 +2491,18 @@ static inline void kmemleak_load_module(const struct module *mod,
#endif
#ifdef CONFIG_MODULE_SIG
static int module_sig_check(struct load_info *info)
static int module_sig_check(struct load_info *info, int flags)
{
int err = -ENOKEY;
const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1;
const void *mod = info->hdr;
if (info->len > markerlen &&
/*
* Require flags == 0, as a module with version information
* removed is no longer the module that was signed
*/
if (flags == 0 &&
info->len > markerlen &&
memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {
/* We truncate the module to discard the signature */
info->len -= markerlen;
......@@ -2519,7 +2524,7 @@ static int module_sig_check(struct load_info *info)
return err;
}
#else /* !CONFIG_MODULE_SIG */
static int module_sig_check(struct load_info *info)
static int module_sig_check(struct load_info *info, int flags)
{
return 0;
}
......@@ -3247,7 +3252,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
struct module *mod;
long err;
err = module_sig_check(info);
err = module_sig_check(info, flags);
if (err)
goto free_copy;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment