Skip to content

Commit

Permalink
modsign: log module name in the event of an error
Browse files Browse the repository at this point in the history
Now that we have the load_info struct all initialized (including
info->name, which contains the name of the module) before
module_sig_check(), make the load_info struct and hence module name
available to mod_verify_sig() so that we can log the module name in the
event of an error.

Signed-off-by: Jessica Yu <jeyu@kernel.org>
  • Loading branch information
Jessica Yu committed Jul 2, 2018
1 parent 996302c commit f314dfe
Show file tree
Hide file tree
Showing 3 changed files with 32 additions and 27 deletions.
25 changes: 24 additions & 1 deletion kernel/module-internal.h
Original file line number Diff line number Diff line change
Expand Up @@ -9,4 +9,27 @@
* 2 of the Licence, or (at your option) any later version.
*/

extern int mod_verify_sig(const void *mod, unsigned long *_modlen);
#include <linux/elf.h>
#include <asm/module.h>

struct load_info {
const char *name;
/* pointer to module in temporary copy, freed at end of load_module() */
struct module *mod;
Elf_Ehdr *hdr;
unsigned long len;
Elf_Shdr *sechdrs;
char *secstrings, *strtab;
unsigned long symoffs, stroffs;
struct _ddebug *debug;
unsigned int num_debug;
bool sig_ok;
#ifdef CONFIG_KALLSYMS
unsigned long mod_kallsyms_init_off;
#endif
struct {
unsigned int sym, str, mod, vers, info, pcpu;
} index;
};

extern int mod_verify_sig(const void *mod, struct load_info *info);
22 changes: 1 addition & 21 deletions kernel/module.c
Original file line number Diff line number Diff line change
Expand Up @@ -307,26 +307,6 @@ int unregister_module_notifier(struct notifier_block *nb)
}
EXPORT_SYMBOL(unregister_module_notifier);

struct load_info {
const char *name;
/* pointer to module in temporary copy, freed at end of load_module() */
struct module *mod;
Elf_Ehdr *hdr;
unsigned long len;
Elf_Shdr *sechdrs;
char *secstrings, *strtab;
unsigned long symoffs, stroffs;
struct _ddebug *debug;
unsigned int num_debug;
bool sig_ok;
#ifdef CONFIG_KALLSYMS
unsigned long mod_kallsyms_init_off;
#endif
struct {
unsigned int sym, str, mod, vers, info, pcpu;
} index;
};

/*
* We require a truly strong try_module_get(): 0 means success.
* Otherwise an error is returned due to ongoing or failed
Expand Down Expand Up @@ -2778,7 +2758,7 @@ static int module_sig_check(struct load_info *info, int flags)
memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {
/* We truncate the module to discard the signature */
info->len -= markerlen;
err = mod_verify_sig(mod, &info->len);
err = mod_verify_sig(mod, info);
}

if (!err) {
Expand Down
12 changes: 7 additions & 5 deletions kernel/module_signing.c
Original file line number Diff line number Diff line change
Expand Up @@ -45,10 +45,10 @@ struct module_signature {
/*
* Verify the signature on a module.
*/
int mod_verify_sig(const void *mod, unsigned long *_modlen)
int mod_verify_sig(const void *mod, struct load_info *info)
{
struct module_signature ms;
size_t modlen = *_modlen, sig_len;
size_t sig_len, modlen = info->len;

pr_devel("==>%s(,%zu)\n", __func__, modlen);

Expand All @@ -62,10 +62,11 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen)
if (sig_len >= modlen)
return -EBADMSG;
modlen -= sig_len;
*_modlen = modlen;
info->len = modlen;

if (ms.id_type != PKEY_ID_PKCS7) {
pr_err("Module is not signed with expected PKCS#7 message\n");
pr_err("%s: Module is not signed with expected PKCS#7 message\n",
info->name);
return -ENOPKG;
}

Expand All @@ -76,7 +77,8 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen)
ms.__pad[0] != 0 ||
ms.__pad[1] != 0 ||
ms.__pad[2] != 0) {
pr_err("PKCS#7 signature info has unexpected non-zero params\n");
pr_err("%s: PKCS#7 signature info has unexpected non-zero params\n",
info->name);
return -EBADMSG;
}

Expand Down

0 comments on commit f314dfe

Please sign in to comment.