[PATCH] integrity: support including firmware ".platform" keys at build time

kernel test robot lkp at intel.com
Sat Sep 11 16:29:33 UTC 2021


Hi Nayna,

I love your patch! Yet something to improve:

[auto build test ERROR on integrity/next-integrity]
[also build test ERROR on linus/master v5.14 next-20210910]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Nayna-Jain/integrity-support-including-firmware-platform-keys-at-build-time/20210911-012617
base:   https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
config: arc-randconfig-r015-20210911 (attached as .config)
compiler: arceb-elf-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/fb58bf03a2f9965a2e0cfdcb16d1bad2fc5f083a
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Nayna-Jain/integrity-support-including-firmware-platform-keys-at-build-time/20210911-012617
        git checkout fb58bf03a2f9965a2e0cfdcb16d1bad2fc5f083a
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=arc 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp at intel.com>

All error/warnings (new ones prefixed by >>):

   certs/common.c: In function 'load_certificate_list':
   certs/common.c:11:9: error: unknown type name 'key_ref_t'; did you mean 'key_ref_put'?
      11 |         key_ref_t key;
         |         ^~~~~~~~~
         |         key_ref_put
>> certs/common.c:31:23: error: implicit declaration of function 'key_create_or_update' [-Werror=implicit-function-declaration]
      31 |                 key = key_create_or_update(make_key_ref(keyring, 1),
         |                       ^~~~~~~~~~~~~~~~~~~~
>> certs/common.c:36:46: error: 'KEY_POS_ALL' undeclared (first use in this function)
      36 |                                            ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
         |                                              ^~~~~~~~~~~
   certs/common.c:36:46: note: each undeclared identifier is reported only once for each function it appears in
>> certs/common.c:36:61: error: 'KEY_POS_SETATTR' undeclared (first use in this function)
      36 |                                            ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
         |                                                             ^~~~~~~~~~~~~~~
>> certs/common.c:37:44: error: 'KEY_USR_VIEW' undeclared (first use in this function)
      37 |                                            KEY_USR_VIEW | KEY_USR_READ),
         |                                            ^~~~~~~~~~~~
>> certs/common.c:37:59: error: 'KEY_USR_READ' undeclared (first use in this function)
      37 |                                            KEY_USR_VIEW | KEY_USR_READ),
         |                                                           ^~~~~~~~~~~~
>> certs/common.c:38:44: error: 'KEY_ALLOC_NOT_IN_QUOTA' undeclared (first use in this function)
      38 |                                            KEY_ALLOC_NOT_IN_QUOTA |
         |                                            ^~~~~~~~~~~~~~~~~~~~~~
>> certs/common.c:39:44: error: 'KEY_ALLOC_BUILT_IN' undeclared (first use in this function)
      39 |                                            KEY_ALLOC_BUILT_IN |
         |                                            ^~~~~~~~~~~~~~~~~~
>> certs/common.c:40:44: error: 'KEY_ALLOC_BYPASS_RESTRICTION' undeclared (first use in this function)
      40 |                                            KEY_ALLOC_BYPASS_RESTRICTION);
         |                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> certs/common.c:41:28: warning: passing argument 1 of 'IS_ERR' makes pointer from integer without a cast [-Wint-conversion]
      41 |                 if (IS_ERR(key)) {
         |                            ^~~
         |                            |
         |                            int
   In file included from include/linux/rwsem.h:18,
                    from include/linux/key.h:18,
                    from certs/common.c:4:
   include/linux/err.h:34:60: note: expected 'const void *' but argument is of type 'int'
      34 | static inline bool __must_check IS_ERR(__force const void *ptr)
         |                                                ~~~~~~~~~~~~^~~
   In file included from include/linux/kernel.h:19,
                    from certs/common.c:3:
>> certs/common.c:43:40: warning: passing argument 1 of 'PTR_ERR' makes pointer from integer without a cast [-Wint-conversion]
      43 |                                PTR_ERR(key));
         |                                        ^~~
         |                                        |
         |                                        int
   include/linux/printk.h:390:40: note: in definition of macro 'pr_err'
     390 |         printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
         |                                        ^~~~~~~~~~~
   In file included from include/linux/rwsem.h:18,
                    from include/linux/key.h:18,
                    from certs/common.c:4:
   include/linux/err.h:29:61: note: expected 'const void *' but argument is of type 'int'
      29 | static inline long __must_check PTR_ERR(__force const void *ptr)
         |                                                 ~~~~~~~~~~~~^~~
   In file included from include/linux/kernel.h:19,
                    from certs/common.c:3:
>> certs/common.c:46:54: warning: dereferencing 'void *' pointer
      46 |                                   key_ref_to_ptr(key)->description);
         |                                                      ^~
   include/linux/printk.h:410:43: note: in definition of macro 'pr_notice'
     410 |         printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
         |                                           ^~~~~~~~~~~
>> certs/common.c:46:54: error: request for member 'description' in something not a structure or union
      46 |                                   key_ref_to_ptr(key)->description);
         |                                                      ^~
   include/linux/printk.h:410:43: note: in definition of macro 'pr_notice'
     410 |         printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
         |                                           ^~~~~~~~~~~
   cc1: some warnings being treated as errors


vim +/key_create_or_update +31 certs/common.c

2565ca7f5ec1a9 Eric Snowberg 2021-01-22   6  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   7  int load_certificate_list(const u8 cert_list[],
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   8  			  const unsigned long list_size,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22   9  			  const struct key *keyring)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  10  {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  11  	key_ref_t key;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  12  	const u8 *p, *end;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  13  	size_t plen;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  14  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  15  	p = cert_list;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  16  	end = p + list_size;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  17  	while (p < end) {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  18  		/* Each cert begins with an ASN.1 SEQUENCE tag and must be more
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  19  		 * than 256 bytes in size.
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  20  		 */
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  21  		if (end - p < 4)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  22  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  23  		if (p[0] != 0x30 &&
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  24  		    p[1] != 0x82)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  25  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  26  		plen = (p[2] << 8) | p[3];
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  27  		plen += 4;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  28  		if (plen > end - p)
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  29  			goto dodgy_cert;
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  30  
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @31  		key = key_create_or_update(make_key_ref(keyring, 1),
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  32  					   "asymmetric",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  33  					   NULL,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  34  					   p,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  35  					   plen,
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @36  					   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @37  					   KEY_USR_VIEW | KEY_USR_READ),
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @38  					   KEY_ALLOC_NOT_IN_QUOTA |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @39  					   KEY_ALLOC_BUILT_IN |
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @40  					   KEY_ALLOC_BYPASS_RESTRICTION);
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @41  		if (IS_ERR(key)) {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  42  			pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @43  			       PTR_ERR(key));
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  44  		} else {
2565ca7f5ec1a9 Eric Snowberg 2021-01-22  45  			pr_notice("Loaded X.509 cert '%s'\n",
2565ca7f5ec1a9 Eric Snowberg 2021-01-22 @46  				  key_ref_to_ptr(key)->description);

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org


More information about the Linux-security-module-archive mailing list