5.18-stable patches

added patches:
	arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch

diff --git a/queue-5.18/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch b/queue-5.18/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch
new file mode 100644 (file)
index 0000000..1104243
--- /dev/null
+++ b/queue-5.18/arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch
@@ -0,0 +1,68 @@
+From 0d519cadf75184a24313568e7f489a7fc9b1be3b Mon Sep 17 00:00:00 2001
+From: Coiby Xu <coxu@redhat.com>
+Date: Thu, 14 Jul 2022 21:40:26 +0800
+Subject: arm64: kexec_file: use more system keyrings to verify kernel image signature
+
+From: Coiby Xu <coxu@redhat.com>
+
+commit 0d519cadf75184a24313568e7f489a7fc9b1be3b upstream.
+
+Currently, when loading a kernel image via the kexec_file_load() system
+call, arm64 can only use the .builtin_trusted_keys keyring to verify
+a signature whereas x86 can use three more keyrings i.e.
+.secondary_trusted_keys, .machine and .platform keyrings. For example,
+one resulting problem is kexec'ing a kernel image  would be rejected
+with the error "Lockdown: kexec: kexec of unsigned images is restricted;
+see man kernel_lockdown.7".
+
+This patch set enables arm64 to make use of the same keyrings as x86 to
+verify the signature kexec'ed kernel image.
+
+Fixes: 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")
+Cc: stable@vger.kernel.org # 105e10e2cf1c: kexec_file: drop weak attribute from functions
+Cc: stable@vger.kernel.org # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig
+Cc: stable@vger.kernel.org # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic
+Acked-by: Baoquan He <bhe@redhat.com>
+Cc: kexec@lists.infradead.org
+Cc: keyrings@vger.kernel.org
+Cc: linux-security-module@vger.kernel.org
+Co-developed-by: Michal Suchanek <msuchanek@suse.de>
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Acked-by: Will Deacon <will@kernel.org>
+Signed-off-by: Coiby Xu <coxu@redhat.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/kexec_image.c |   11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/arch/arm64/kernel/kexec_image.c
++++ b/arch/arm64/kernel/kexec_image.c
+@@ -14,7 +14,6 @@
+ #include <linux/kexec.h>
+ #include <linux/pe.h>
+ #include <linux/string.h>
+-#include <linux/verification.h>
+ #include <asm/byteorder.h>
+ #include <asm/cpufeature.h>
+ #include <asm/image.h>
+@@ -130,18 +129,10 @@ static void *image_load(struct kimage *i
+       return NULL;
+ }
+ 
+-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
+-static int image_verify_sig(const char *kernel, unsigned long kernel_len)
+-{
+-      return verify_pefile_signature(kernel, kernel_len, NULL,
+-                                     VERIFYING_KEXEC_PE_SIGNATURE);
+-}
+-#endif
+-
+ const struct kexec_file_ops kexec_image_ops = {
+       .probe = image_probe,
+       .load = image_load,
+ #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
+-      .verify_sig = image_verify_sig,
++      .verify_sig = kexec_kernel_verify_pe_sig,
+ #endif
+ };

diff --git a/queue-5.18/series b/queue-5.18/series
index cad0d7b65974aafd48d3bad1df2831fb0f4109e6..89b24103c0f4937f64a192d53d88f2abf3c85ae8 100644 (file)
--- a/queue-5.18/series
+++ b/queue-5.18/series
@@ -1083,3 +1083,4 @@ powerpc-fix-eh-field-when-calling-lwarx-on-ppc32.patch
 btrfs-join-running-log-transaction-when-logging-new-name.patch
 btrfs-convert-count_max_extents-to-use-fs_info-max_extent_size.patch
 net_sched-cls_route-remove-from-list-when-handle-is-0.patch
+arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch