[PATCH v2] appendedsig: Fix grub-mkimage with an unaligned appended signature size

[Sudhakar Kuppusamy <sudhakar@linux.ibm.com>]

When creating the core image with an unaligned appended signature size (e.g., 479)
for PowerPC, the grub-mkimage aligns the appended signature size to a multiple of
4 bytes, but it does not find and add the padding needed to align a multiple of 4
bytes appended signature size in the appended signature ELF note. Therefore, After
signing and installing this core image, the firmware tries to read the magic string
"~Module signature appended~" from the appended signature ELF note but gets the
partial magic string like "Module signature appended~", and it leads to the appended
signature magic string matching failing.

Example:
grub-mkimage -O powerpc-ieee1275 -o core.elf -d grub-core -p /grub2 -x \
  kernel.der --appended-signature-size 479 ...

sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed

Without padding: hexdump -C ./core.elf.signed
.
.
00383550  00 00 00 13 00 00 01 e0  41 53 69 67 41 70 70 65  |........ASigAppe|
00383560  6e 64 65 64 2d 53 69 67  6e 61 74 75 72 65 00 00  |nded-Signature..|
.
.
003836f0  dd 47 cd ed 02 8e 15 af  5b 09 2e 44 6f da 67 88  |.G......[..Do.g.|
00383700  4d 94 17 31 26 9d 47 95  d8 7c ad 36 00 d2 9c 53  |M..1&.G..|.6...S|
00383710  20 e0 af 60 78 cd 22 e6  ed 45 1e b1 e7 7e cf b5  | ..`x."..E...~..|
00383720  fc 58 ec df 1b ab 7a 00  00 02 00 00 00 00 00 00  |.X....z.........|
00383730  00 01 b7 7e 4d 6f 64 75  6c 65 20 73 69 67 6e 61  |...~Module signa|
00383740  74 75 72 65 20 61 70 70  65 6e 64 65 64 7e 0a     |ture appended~.|

To fix this, find and include the padding required to align a multiple of 4 bytes of
appended signature size in the appended signature ELF note.

Example:
grub-mkimage -O powerpc-ieee1275 -o core.elf -d grub-core -p /grub2 -x \
  kernel.der --appended-signature-size 479 ...

sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed

With padding: hexdump -C ./core.elf.signed
.
.
00137460  62 00 00 00 00 00 00 13  00 00 01 ec 41 53 69 67  |b...........ASig|
00137470  41 70 70 65 6e 64 65 64  2d 53 69 67 6e 61 74 75  |Appended-Signatu|
.
.
00137610  b7 07 cd b6 c8 ca 9a 5b  7c 13 8c 75 1d 1c 54 81  |.......[|..u..T.|
00137620  7f c4 9a 8b bd d7 73 8d  2f 7d d2 e6 d1 3c 52 a9  |......s./}...<R.|
00137630  4e 0b e5 24 ba 0a 82 aa  8e c5 86 fa e1 19 50 ec  |N..$..........P.|
00137640  9f a7 9a ed e5 ed 13 35  00 00 02 00 00 00 00 00  |.......5........|
00137650  00 00 01 c2 7e 4d 6f 64  75 6c 65 20 73 69 67 6e  |....~Module sign|
00137660  61 74 75 72 65 20 61 70  70 65 6e 64 65 64 7e 0a  |ature appended~.|

Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
---
 util/grub-mkimagexx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
index 7fe2e35e6..1a453a5e8 100644
--- a/util/grub-mkimagexx.c
+++ b/util/grub-mkimagexx.c
@@ -249,6 +249,7 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc
     {
       phnum++;
       footer_size += ALIGN_UP (sizeof (struct grub_appended_signature_note), 4);
+      footer_size += ALIGN_UP_OVERHEAD (appsig_size, 4);
     }
 
   if (image_target->id != IMAGE_LOONGSON_ELF)
-- 
2.50.1 (Apple Git-155)


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel