From: "Jarkko Sakkinen" <jarkko@kernel.org>
To: "Nayna" <nayna@linux.vnet.ibm.com>,
"Nayna Jain" <nayna@linux.ibm.com>,
"linuxppc-dev" <linuxppc-dev@lists.ozlabs.org>,
"linux-integrity" <linux-integrity@vger.kernel.org>
Cc: Andrew Donnellan <ajd@linux.ibm.com>,
Nageswara R Sastry <rnsastry@linux.ibm.com>,
Mimi Zohar <zohar@linux.ibm.com>,
Russell Currey <ruscur@russell.cc>,
George Wilson <gcwilson@linux.ibm.com>
Subject: Re: [PATCH] security/integrity: fix pointer to ESL data and its size on pseries
Date: Wed, 07 Jun 2023 19:03:42 +0300 [thread overview]
Message-ID: <CT6JN8JJ18NJ.39MUF0A404TPF@suppilovahvero> (raw)
In-Reply-To: <6a4cac35-efa9-40f6-ae0f-ad3509ef7fbb@linux.vnet.ibm.com>
On Wed Jun 7, 2023 at 3:28 PM EEST, Nayna wrote:
>
> On 6/6/23 16:51, Jarkko Sakkinen wrote:
> > On Tue Jun 6, 2023 at 8:26 PM EEST, Nayna Jain wrote:
> >> On PowerVM guest, variable data is prefixed with 8 bytes of timestamp.
> >> Extract ESL by stripping off the timestamp before passing to ESL parser.
> >>
> > Cc: stable@vger.kenrnel.org # v6.3
> >
> > ?
>
> Aah yes. Missed that.. Thanks..
>
>
> >
> >> Fixes: 4b3e71e9a34c ("integrity/powerpc: Support loading keys from PLPKS")
> >> Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
> >> ---
> >> .../integrity/platform_certs/load_powerpc.c | 39 ++++++++++++-------
> >> 1 file changed, 26 insertions(+), 13 deletions(-)
> >>
> >> diff --git a/security/integrity/platform_certs/load_powerpc.c b/security/integrity/platform_certs/load_powerpc.c
> >> index b9de70b90826..57768cbf1fd3 100644
> >> --- a/security/integrity/platform_certs/load_powerpc.c
> >> +++ b/security/integrity/platform_certs/load_powerpc.c
> >> @@ -15,6 +15,9 @@
> >> #include "keyring_handler.h"
> >> #include "../integrity.h"
> >>
> >> +#define extract_data(db, data, size, offset) \
> >> + do { db = data + offset; size = size - offset; } while (0)
> >> +
> >> /*
> >> * Get a certificate list blob from the named secure variable.
> >> *
> >> @@ -55,8 +58,10 @@ static __init void *get_cert_list(u8 *key, unsigned long keylen, u64 *size)
> >> */
> >> static int __init load_powerpc_certs(void)
> >> {
> >> + void *data = NULL;
> >> + u64 dsize = 0;
> >> + u64 offset = 0;
> >> void *db = NULL, *dbx = NULL;
> > So... what do you need db still for?
> >
> > If you meant to rename 'db' to 'data', then you should not do it, since this is
> > a bug fix. It is zero gain, and a factor harder backport.
>
> In case of PowerVM guest, data points to timestamp + ESL. And then with
> offset of 8 bytes, db points to ESL.
>
> While db is used for parsing ESL, data is then later used to free
> (timestamp + ESL) memory.
>
> Hope it answers the question.
OK, cool. Only thing I have to add that it would be more consistent if
data was declared in the same line as db and dbx, given that they are
declared in the same line.
BR, Jarkko
prev parent reply other threads:[~2023-06-07 16:04 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-06 17:26 [PATCH] security/integrity: fix pointer to ESL data and its size on pseries Nayna Jain
2023-06-06 20:51 ` Jarkko Sakkinen
2023-06-07 12:28 ` Nayna
2023-06-07 16:03 ` Jarkko Sakkinen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CT6JN8JJ18NJ.39MUF0A404TPF@suppilovahvero \
--to=jarkko@kernel.org \
--cc=ajd@linux.ibm.com \
--cc=gcwilson@linux.ibm.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=nayna@linux.ibm.com \
--cc=nayna@linux.vnet.ibm.com \
--cc=rnsastry@linux.ibm.com \
--cc=ruscur@russell.cc \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).