FAILED: patch "[PATCH] arm64: kexec_file: use more system keyrings to verify kernel" failed to apply to 5.15-stable tree

The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 0d519cadf75184a24313568e7f489a7fc9b1be3b Mon Sep 17 00:00:00 2001
From: Coiby Xu <[email protected]>
Date: Thu, 14 Jul 2022 21:40:26 +0800
Subject: [PATCH] arm64: kexec_file: use more system keyrings to verify kernel image signature

Currently, when loading a kernel image via the kexec_file_load() system call, arm64 can only use the .builtin_trusted_keys keyring to verify a signature whereas x86 can use three more keyrings i.e. .secondary_trusted_keys, .machine and .platform keyrings. For example, one resulting problem is kexec'ing a kernel image would be rejected with the error "Lockdown: kexec: kexec of unsigned images is restricted; see man kernel_lockdown.7".

This patch set enables arm64 to make use of the same keyrings as x86 to verify the signature kexec'ed kernel image.

Fixes 732b7b93d849 ("arm64: kexec_file: add kernel signature verification support")

Cc [email protected] # 105e10e2cf1c: kexec_file: drop weak attribute from functions

Cc [email protected] # 34d5960af253: kexec: clean up arch_kexec_kernel_verify_sig

Cc [email protected] # 83b7bb2d49ae: kexec, KEYS: make the code in bzImage64_verify_sig generic

Acked-by Baoquan He <[email protected]>

Cc [email protected]

Cc [email protected]

Cc [email protected]

Co-developed-by Michal Suchanek <[email protected]>

Signed-off-by Michal Suchanek <[email protected]>

Acked-by Will Deacon <[email protected]>

Signed-off-by Coiby Xu <[email protected]>

Signed-off-by Mimi Zohar <[email protected]>

arch/arm64/kernel/kexec_image.c +1 -10

index 9ec34690e255..5ed6a585f21f 100644
@@ -14,7 +14,6 @@
 #include <linux/kexec.h>
 #include <linux/pe.h>
 #include <linux/string.h>
-#include <linux/verification.h>
 #include <asm/byteorder.h>
 #include <asm/cpufeature.h>
 #include <asm/image.h>

@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image,
 	return NULL;
 }
 
-#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-static int image_verify_sig(const char *kernel, unsigned long kernel_len)
-{
-	return verify_pefile_signature(kernel, kernel_len, NULL,
-				       VERIFYING_KEXEC_PE_SIGNATURE);
-}
-#endif
-
 const struct kexec_file_ops kexec_image_ops = {
 	.probe = image_probe,
 	.load = image_load,
 #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
-	.verify_sig = image_verify_sig,
+	.verify_sig = kexec_kernel_verify_pe_sig,
 #endif
 };

Hi Greg,

This patch depends on three prerequisites. This full list of commit ids should be backported is shown below,

1. 65d9a9a60fd7 ("kexec_file: drop weak attribute from functions")
2. 689a71493bd2 ("kexec: clean up arch_kexec_kernel_verify_sig")
3. c903dae8941d ("kexec, KEYS: make the code in bzImage64_verify_sig generic")
4. 0d519cadf751 ("arm64: kexec_file: use more system keyrings to verify kernel image signature")

And I can confirm they can be applied to linux-5.15.y branch successfully,

    $ git checkout -b arm_key_5.15.y stable/linux-5.15.y
    branch 'arm_key_5.15.y' set up to track 'stable/linux-5.15.y'.
    Switched to a new branch 'arm_key_5.15.y'
    $ git cherry-pick 65d9a9a60fd7 689a71493bd2 c903dae8941d 0d519cadf751
    Auto-merging arch/arm64/include/asm/kexec.h
    Auto-merging arch/powerpc/include/asm/kexec.h
    Auto-merging arch/s390/include/asm/kexec.h
    Auto-merging arch/x86/include/asm/kexec.h
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 7c7844771360] kexec_file: drop weak attribute from functions
     Author: Naveen N. Rao <[email protected]>
     Date: Fri Jul 1 13:04:04 2022 +0530
     6 files changed, 61 insertions(+), 40 deletions(-)
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 4283e2681d86] kexec: clean up arch_kexec_kernel_verify_sig
     Date: Thu Jul 14 21:40:24 2022 +0800
     2 files changed, 13 insertions(+), 25 deletions(-)

    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y c0cf50b9056f] kexec, KEYS: make the code in bzImage64_verify_sig generic
     Date: Thu Jul 14 21:40:25 2022 +0800
     3 files changed, 25 insertions(+), 19 deletions(-)
    [arm_key_5.15.y 40b98256cb89] arm64: kexec_file: use more system keyrings to verify kernel image signature
     Date: Thu Jul 14 21:40:26 2022 +0800
     1 file changed, 1 insertion(+), 10 deletions(-)

Quoted 31 lines · Coiby Xu

Hi Greg,

This patch depends on three prerequisites. This full list of commit ids should be backported is shown below,

1. 65d9a9a60fd7 ("kexec_file: drop weak attribute from functions")
2. 689a71493bd2 ("kexec: clean up arch_kexec_kernel_verify_sig")
3. c903dae8941d ("kexec, KEYS: make the code in bzImage64_verify_sig generic")
4. 0d519cadf751 ("arm64: kexec_file: use more system keyrings to verify kernel image signature")

And I can confirm they can be applied to linux-5.15.y branch successfully,

    $ git checkout -b arm_key_5.15.y stable/linux-5.15.y
    branch 'arm_key_5.15.y' set up to track 'stable/linux-5.15.y'.
    Switched to a new branch 'arm_key_5.15.y'
    $ git cherry-pick 65d9a9a60fd7 689a71493bd2 c903dae8941d 0d519cadf751
    Auto-merging arch/arm64/include/asm/kexec.h
    Auto-merging arch/powerpc/include/asm/kexec.h
    Auto-merging arch/s390/include/asm/kexec.h
    Auto-merging arch/x86/include/asm/kexec.h
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 7c7844771360] kexec_file: drop weak attribute from functions
     Author: Naveen N. Rao <[email protected]>
     Date: Fri Jul 1 13:04:04 2022 +0530
     6 files changed, 61 insertions(+), 40 deletions(-)
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 4283e2681d86] kexec: clean up arch_kexec_kernel_verify_sig
     Date: Thu Jul 14 21:40:24 2022 +0800
     2 files changed, 13 insertions(+), 25 deletions(-)

Quoted 8 lines

    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y c0cf50b9056f] kexec, KEYS: make the code in bzImage64_verify_sig generic
     Date: Thu Jul 14 21:40:25 2022 +0800
     3 files changed, 25 insertions(+), 19 deletions(-)
    [arm_key_5.15.y 40b98256cb89] arm64: kexec_file: use more system keyrings to verify kernel image signature
     Date: Thu Jul 14 21:40:26 2022 +0800
     1 file changed, 1 insertion(+), 10 deletions(-)

thanks, now queued up.

Quoted 41 lines · Greg KH

Quoted 39 lines · Coiby Xu

Hi Greg,

This patch depends on three prerequisites. This full list of commit ids should be backported is shown below,

1. 65d9a9a60fd7 ("kexec_file: drop weak attribute from functions")
2. 689a71493bd2 ("kexec: clean up arch_kexec_kernel_verify_sig")
3. c903dae8941d ("kexec, KEYS: make the code in bzImage64_verify_sig generic")
4. 0d519cadf751 ("arm64: kexec_file: use more system keyrings to verify kernel image signature")

And I can confirm they can be applied to linux-5.15.y branch successfully,

    $ git checkout -b arm_key_5.15.y stable/linux-5.15.y
    branch 'arm_key_5.15.y' set up to track 'stable/linux-5.15.y'.
    Switched to a new branch 'arm_key_5.15.y'
    $ git cherry-pick 65d9a9a60fd7 689a71493bd2 c903dae8941d 0d519cadf751
    Auto-merging arch/arm64/include/asm/kexec.h
    Auto-merging arch/powerpc/include/asm/kexec.h
    Auto-merging arch/s390/include/asm/kexec.h
    Auto-merging arch/x86/include/asm/kexec.h
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 7c7844771360] kexec_file: drop weak attribute from functions
     Author: Naveen N. Rao <[email protected]>
     Date: Fri Jul 1 13:04:04 2022 +0530
     6 files changed, 61 insertions(+), 40 deletions(-)
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 4283e2681d86] kexec: clean up arch_kexec_kernel_verify_sig
     Date: Thu Jul 14 21:40:24 2022 +0800
     2 files changed, 13 insertions(+), 25 deletions(-)
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y c0cf50b9056f] kexec, KEYS: make the code in bzImage64_verify_sig generic
     Date: Thu Jul 14 21:40:25 2022 +0800
     3 files changed, 25 insertions(+), 19 deletions(-)
    [arm_key_5.15.y 40b98256cb89] arm64: kexec_file: use more system keyrings to verify kernel image signature
     Date: Thu Jul 14 21:40:26 2022 +0800
     1 file changed, 1 insertion(+), 10 deletions(-)

Quoted 1 line

thanks, now queued up.

Nope, it causes build breakages in powerpc :(

See:
https://lore.kernel.org/r/YwC6eQjx8xC9y3LD@debian
and

	https://lore.kernel.org/r/CA+G9fYtXnZP2vdAi4eU_ApC_YFz6TqTd6Eh5Mumb2=0Y_dK5Yw@mail.gmail.com

for the reports. I'm dropping these from 5.15.y now, please fix this up and resend if you want them included.

Quoted 42 lines · Greg KH

Quoted 41 lines · Greg KH

Quoted 39 lines · Coiby Xu

Hi Greg,

This patch depends on three prerequisites. This full list of commit ids should be backported is shown below,

1. 65d9a9a60fd7 ("kexec_file: drop weak attribute from functions")
2. 689a71493bd2 ("kexec: clean up arch_kexec_kernel_verify_sig")
3. c903dae8941d ("kexec, KEYS: make the code in bzImage64_verify_sig generic")
4. 0d519cadf751 ("arm64: kexec_file: use more system keyrings to verify kernel image signature")

And I can confirm they can be applied to linux-5.15.y branch successfully,

    $ git checkout -b arm_key_5.15.y stable/linux-5.15.y
    branch 'arm_key_5.15.y' set up to track 'stable/linux-5.15.y'.
    Switched to a new branch 'arm_key_5.15.y'
    $ git cherry-pick 65d9a9a60fd7 689a71493bd2 c903dae8941d 0d519cadf751
    Auto-merging arch/arm64/include/asm/kexec.h
    Auto-merging arch/powerpc/include/asm/kexec.h
    Auto-merging arch/s390/include/asm/kexec.h
    Auto-merging arch/x86/include/asm/kexec.h
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 7c7844771360] kexec_file: drop weak attribute from functions
     Author: Naveen N. Rao <[email protected]>
     Date: Fri Jul 1 13:04:04 2022 +0530
     6 files changed, 61 insertions(+), 40 deletions(-)
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 4283e2681d86] kexec: clean up arch_kexec_kernel_verify_sig
     Date: Thu Jul 14 21:40:24 2022 +0800
     2 files changed, 13 insertions(+), 25 deletions(-)
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y c0cf50b9056f] kexec, KEYS: make the code in bzImage64_verify_sig generic
     Date: Thu Jul 14 21:40:25 2022 +0800
     3 files changed, 25 insertions(+), 19 deletions(-)
    [arm_key_5.15.y 40b98256cb89] arm64: kexec_file: use more system keyrings to verify kernel image signature
     Date: Thu Jul 14 21:40:26 2022 +0800
     1 file changed, 1 insertion(+), 10 deletions(-)

Quoted 3 lines

Quoted 1 line

thanks, now queued up.

Nope, it causes build breakages in powerpc :(

s390

Quoted 6 lines

See:
https://lore.kernel.org/r/YwC6eQjx8xC9y3LD@debian
and

	https://lore.kernel.org/r/CA+G9fYtXnZP2vdAi4eU_ApC_YFz6TqTd6Eh5Mumb2=0Y_dK5Yw@mail.gmail.com

Quoted 2 lines

for the reports. I'm dropping these from 5.15.y now, please fix this up and resend if you want them included.

The offending function was removed in 5.16 by
commit 277c8389386e ("s390/kexec_file: move kernel image size check")

Quoted 53 lines · Michal Suchánek

Quoted 42 lines · Greg KH

Quoted 41 lines · Greg KH

Quoted 39 lines · Coiby Xu

Hi Greg,

This patch depends on three prerequisites. This full list of commit ids should be backported is shown below,

1. 65d9a9a60fd7 ("kexec_file: drop weak attribute from functions")
2. 689a71493bd2 ("kexec: clean up arch_kexec_kernel_verify_sig")
3. c903dae8941d ("kexec, KEYS: make the code in bzImage64_verify_sig generic")
4. 0d519cadf751 ("arm64: kexec_file: use more system keyrings to verify kernel image signature")

And I can confirm they can be applied to linux-5.15.y branch successfully,

    $ git checkout -b arm_key_5.15.y stable/linux-5.15.y
    branch 'arm_key_5.15.y' set up to track 'stable/linux-5.15.y'.
    Switched to a new branch 'arm_key_5.15.y'
    $ git cherry-pick 65d9a9a60fd7 689a71493bd2 c903dae8941d 0d519cadf751
    Auto-merging arch/arm64/include/asm/kexec.h
    Auto-merging arch/powerpc/include/asm/kexec.h
    Auto-merging arch/s390/include/asm/kexec.h
    Auto-merging arch/x86/include/asm/kexec.h
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 7c7844771360] kexec_file: drop weak attribute from functions
     Author: Naveen N. Rao <[email protected]>
     Date: Fri Jul 1 13:04:04 2022 +0530
     6 files changed, 61 insertions(+), 40 deletions(-)
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y 4283e2681d86] kexec: clean up arch_kexec_kernel_verify_sig
     Date: Thu Jul 14 21:40:24 2022 +0800
     2 files changed, 13 insertions(+), 25 deletions(-)
    Auto-merging include/linux/kexec.h
    Auto-merging kernel/kexec_file.c
    [arm_key_5.15.y c0cf50b9056f] kexec, KEYS: make the code in bzImage64_verify_sig generic
     Date: Thu Jul 14 21:40:25 2022 +0800
     3 files changed, 25 insertions(+), 19 deletions(-)
    [arm_key_5.15.y 40b98256cb89] arm64: kexec_file: use more system keyrings to verify kernel image signature
     Date: Thu Jul 14 21:40:26 2022 +0800
     1 file changed, 1 insertion(+), 10 deletions(-)

Quoted 3 lines

Quoted 1 line

thanks, now queued up.

Nope, it causes build breakages in powerpc :(

s390

Quoted 6 lines

See:
https://lore.kernel.org/r/YwC6eQjx8xC9y3LD@debian
and

	https://lore.kernel.org/r/CA+G9fYtXnZP2vdAi4eU_ApC_YFz6TqTd6Eh5Mumb2=0Y_dK5Yw@mail.gmail.com

Quoted 5 lines

Quoted 2 lines

for the reports. I'm dropping these from 5.15.y now, please fix this up and resend if you want them included.

The offending function was removed in 5.16 by
commit 277c8389386e ("s390/kexec_file: move kernel image size check")

Great, then someone needs to send me a backported, and tested, set of patches and I will be glad to queue them up.