From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 87979FED2E4 for ; Thu, 12 Mar 2026 08:03:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=x9CSPUmZcb8cb0mxiCQcF+4DOMTVw4i4Nj1W6WrC42M=; b=qHwfAb52juluFjUyFx/T4t5JIW bknoXap4V6PGUiW0pf8/cw6SDCoD5Rd7No4sQbq7yfHIGiKdtENMtF4G0kELTAQjUHfMRiPPVV5uo 7gzZjBKHX3XLa3XZxFNLw5LhdgvVG+hySjB67abLGvAnmfKeNoIqigITrZLsaPbHvdRpJXETaXtK+ 0cuLCtAQFzlzCnCAxLxhpFzF+ts+244j5Kt6fkNsHBhmP1NjfHN8xgeUa6ZCRmevf7WVwy2iaBGwx ozc48lcm9cnmI2uuZAoqrE9qkFfsyc7o004Os/L7slVtF3W6nncUNy4EqM09plsBiBGHXVNmI1Jtg qJY03Zng==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1w0b0N-0000000DZZj-1uYk; Thu, 12 Mar 2026 08:02:51 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1w0b0L-0000000DZX1-1hgW for linux-arm-kernel@lists.infradead.org; Thu, 12 Mar 2026 08:02:51 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 05831408A4; Thu, 12 Mar 2026 08:02:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 740BDC2BC87; Thu, 12 Mar 2026 08:02:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1773302568; bh=ffDcIy1rll5TndwARYJlNX/u1R7dPKivglLlkq9yNX4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AuZK/d6nV1QqYVL/mEjm7FM/y2cM5OYjevf2ZE9HjLYN1A+Wq3Zzne/EQbNlknEnh 8MDc66yB+VK/ViUmJKV7K/oitN6hX2LZI5IGMHgnLVGek4L1oO65hspoTUR01N++hX rCCvaYXFB+3pmCUsj7gfaOb4o/QwJWbdDvcrpQXgVWIOitCcOkfP7hKi3hSpDcFqSL wZmtrvDILniubCUvdo2SrbtpvKSYXRzjBZ9WnQHJLC6L+Kd97QND4oi63+Ztj/KJl6 x1rqQv2JCRHcz9N3p5qhXNIiGkvkMc4yV2vGCipi+VWb8zMeKN5LLkeVLJrwlurLCP jByWmuAqWa2Jg== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org, Lukas Wunner , Dan Williams , Jonathan Cameron , "Aneesh Kumar K . V" Subject: [RFC PATCH v3 09/10] X.509: Move certificate length retrieval into new helper Date: Thu, 12 Mar 2026 13:31:28 +0530 Message-ID: <20260312080129.3483585-10-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260312080129.3483585-1-aneesh.kumar@kernel.org> References: <20260312080129.3483585-1-aneesh.kumar@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260312_010249_838024_DC74B8D4 X-CRM114-Status: GOOD ( 15.07 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Lukas Wunner The upcoming in-kernel SPDM library (Security Protocol and Data Model, https://www.dmtf.org/dsp/DSP0274) needs to retrieve the length from ASN.1 DER-encoded X.509 certificates. Such code already exists in x509_load_certificate_list(), so move it into a new helper for reuse by SPDM. Export the helper so that SPDM can be tristate. (Some upcoming users of the SPDM libray may be modular, such as SCSI and ATA.) No functional change intended. Signed-off-by: Lukas Wunner Reviewed-by: Dan Williams Reviewed-by: Jonathan Cameron Signed-off-by: Aneesh Kumar K.V (Arm) --- crypto/asymmetric_keys/x509_loader.c | 38 +++++++++++++++++++--------- include/keys/asymmetric-type.h | 2 ++ 2 files changed, 28 insertions(+), 12 deletions(-) diff --git a/crypto/asymmetric_keys/x509_loader.c b/crypto/asymmetric_keys/x509_loader.c index a41741326998..25ff027fad1d 100644 --- a/crypto/asymmetric_keys/x509_loader.c +++ b/crypto/asymmetric_keys/x509_loader.c @@ -4,28 +4,42 @@ #include #include +ssize_t x509_get_certificate_length(const u8 *p, unsigned long buflen) +{ + ssize_t plen; + + /* Each cert begins with an ASN.1 SEQUENCE tag and must be more + * than 256 bytes in size. + */ + if (buflen < 4) + return -EINVAL; + + if (p[0] != 0x30 && + p[1] != 0x82) + return -EINVAL; + + plen = (p[2] << 8) | p[3]; + plen += 4; + if (plen > buflen) + return -EINVAL; + + return plen; +} +EXPORT_SYMBOL_GPL(x509_get_certificate_length); + int x509_load_certificate_list(const u8 cert_list[], const unsigned long list_size, const struct key *keyring) { key_ref_t key; const u8 *p, *end; - size_t plen; + ssize_t plen; p = cert_list; end = p + list_size; while (p < end) { - /* Each cert begins with an ASN.1 SEQUENCE tag and must be more - * than 256 bytes in size. - */ - if (end - p < 4) - goto dodgy_cert; - if (p[0] != 0x30 && - p[1] != 0x82) - goto dodgy_cert; - plen = (p[2] << 8) | p[3]; - plen += 4; - if (plen > end - p) + plen = x509_get_certificate_length(p, end - p); + if (plen < 0) goto dodgy_cert; key = key_create_or_update(make_key_ref(keyring, 1), diff --git a/include/keys/asymmetric-type.h b/include/keys/asymmetric-type.h index 1b91c8f98688..301efa952e26 100644 --- a/include/keys/asymmetric-type.h +++ b/include/keys/asymmetric-type.h @@ -84,6 +84,8 @@ extern struct key *find_asymmetric_key(struct key *keyring, const struct asymmetric_key_id *id_2, bool partial); +ssize_t x509_get_certificate_length(const u8 *p, unsigned long buflen); + int x509_load_certificate_list(const u8 cert_list[], const unsigned long list_size, const struct key *keyring); -- 2.43.0