History

modsign: log module name in the event of an error

Now that we have the load_info struct all initialized (including info->name, which contains the name of the module) before module_sig_check(), make the load_info struct and hence module name available to mod_verify_sig() so that we can log the module name in the event of an error.

Jessica Yu committed 8 years ago

Commit f314dfe1 parent 996302c3 files · +32 −27Browse files

Unified · Split

3 files
  1. kernel/module-internal.h +24 −1
  2. kernel/module.c +1 −21
  3. kernel/module_signing.c +7 −5
kernel/module-internal.h+24−1
@@ -9,4 +9,27 @@ · 8 unmodified lines
9 * 2 of the Licence, or (at your option) any later version.9 * 2 of the Licence, or (at your option) any later version.
10 */10 */
11 11
12extern int mod_verify_sig(const void *mod, unsigned long *_modlen);12#include <linux/elf.h>
13#include <asm/module.h>
14
15struct load_info {
16 const char *name;
17 /* pointer to module in temporary copy, freed at end of load_module() */
18 struct module *mod;
19 Elf_Ehdr *hdr;
20 unsigned long len;
21 Elf_Shdr *sechdrs;
22 char *secstrings, *strtab;
23 unsigned long symoffs, stroffs;
24 struct _ddebug *debug;
25 unsigned int num_debug;
26 bool sig_ok;
27#ifdef CONFIG_KALLSYMS
28 unsigned long mod_kallsyms_init_off;
29#endif
30 struct {
31 unsigned int sym, str, mod, vers, info, pcpu;
32 } index;
33};
34
35extern int mod_verify_sig(const void *mod, struct load_info *info);
kernel/module.c+1−21
@@ -307,26 +307,6 @@ int unregister_module_notifier(struct notifier_block *nb) · 306 unmodified lines
307}307}
308EXPORT_SYMBOL(unregister_module_notifier);308EXPORT_SYMBOL(unregister_module_notifier);
309 309
310struct load_info {
311 const char *name;
312 /* pointer to module in temporary copy, freed at end of load_module() */
313 struct module *mod;
314 Elf_Ehdr *hdr;
315 unsigned long len;
316 Elf_Shdr *sechdrs;
317 char *secstrings, *strtab;
318 unsigned long symoffs, stroffs;
319 struct _ddebug *debug;
320 unsigned int num_debug;
321 bool sig_ok;
322#ifdef CONFIG_KALLSYMS
323 unsigned long mod_kallsyms_init_off;
324#endif
325 struct {
326 unsigned int sym, str, mod, vers, info, pcpu;
327 } index;
328};
329
330/*310/*
331 * We require a truly strong try_module_get(): 0 means success.311 * We require a truly strong try_module_get(): 0 means success.
332 * Otherwise an error is returned due to ongoing or failed312 * Otherwise an error is returned due to ongoing or failed
@@ -2778,7 +2758,7 @@ static int module_sig_check(struct load_info *info, int flags) · 2445 unmodified lines
2778 memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {2758 memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {
2779 /* We truncate the module to discard the signature */2759 /* We truncate the module to discard the signature */
2780 info->len -= markerlen;2760 info->len -= markerlen;
2781 err = mod_verify_sig(mod, &info->len);2761 err = mod_verify_sig(mod, info);
2782 }2762 }
2783 2763
2784 if (!err) {2764 if (!err) {
kernel/module_signing.c+7−5
@@ -45,10 +45,10 @@ struct module_signature { · 44 unmodified lines
45/*45/*
46 * Verify the signature on a module.46 * Verify the signature on a module.
47 */47 */
48int mod_verify_sig(const void *mod, unsigned long *_modlen)48int mod_verify_sig(const void *mod, struct load_info *info)
49{49{
50 struct module_signature ms;50 struct module_signature ms;
51 size_t modlen = *_modlen, sig_len;51 size_t sig_len, modlen = info->len;
52 52
53 pr_devel("==>%s(,%zu)\n", __func__, modlen);53 pr_devel("==>%s(,%zu)\n", __func__, modlen);
54 54
@@ -62,10 +62,11 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen) · 7 unmodified lines
62 if (sig_len >= modlen)62 if (sig_len >= modlen)
63 return -EBADMSG;63 return -EBADMSG;
64 modlen -= sig_len;64 modlen -= sig_len;
65 *_modlen = modlen;65 info->len = modlen;
66 66
67 if (ms.id_type != PKEY_ID_PKCS7) {67 if (ms.id_type != PKEY_ID_PKCS7) {
68 pr_err("Module is not signed with expected PKCS#7 message\n");68 pr_err("%s: Module is not signed with expected PKCS#7 message\n",
69 info->name);
69 return -ENOPKG;70 return -ENOPKG;
70 }71 }
71 72
@@ -76,7 +77,8 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen) · 4 unmodified lines
76 ms.__pad[0] != 0 ||77 ms.__pad[0] != 0 ||
77 ms.__pad[1] != 0 ||78 ms.__pad[1] != 0 ||
78 ms.__pad[2] != 0) {79 ms.__pad[2] != 0) {
79 pr_err("PKCS#7 signature info has unexpected non-zero params\n");80 pr_err("%s: PKCS#7 signature info has unexpected non-zero params\n",
81 info->name);
80 return -EBADMSG;82 return -EBADMSG;
81 }83 }
82 84