Skip to content

Commit ef5b52a

Browse files
Thore Sommerherbertx
authored andcommitted
X.509: if signature is unsupported skip validation
When the hash algorithm for the signature is not available the digest size is 0 and the signature in the certificate is marked as unsupported. When validating a self-signed certificate, this needs to be checked, because otherwise trying to validate the signature will fail with an warning: Loading compiled-in X.509 certificates WARNING: CPU: 0 PID: 1 at crypto/rsa-pkcs1pad.c:537 \ pkcs1pad_verify+0x46/0x12c ... Problem loading in-kernel X.509 certificate (-22) Signed-off-by: Thore Sommer <public@thson.de> Cc: stable@vger.kernel.org # v4.7+ Fixes: 6c2dc5a ("X.509: Extract signature digest and make self-signed cert checks earlier") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
1 parent fab9516 commit ef5b52a

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

crypto/asymmetric_keys/x509_public_key.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,11 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
130130
goto out;
131131
}
132132

133+
if (cert->unsupported_sig) {
134+
ret = 0;
135+
goto out;
136+
}
137+
133138
ret = public_key_verify_signature(cert->pub, cert->sig);
134139
if (ret < 0) {
135140
if (ret == -ENOPKG) {

0 commit comments

Comments
 (0)