FAILED: patch "[PATCH] kexec: clean up arch_kexec_kernel_verify_sig" failed to apply to 5.15-stable tree

FAILED: patch "[PATCH] kexec: clean up arch_kexec_kernel_verify_sig" failed to apply to 5.15-stable tree

[gregkh]

The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 689a71493bd2f31c024f8c0395f85a1fd4b2138e Mon Sep 17 00:00:00 2001
From: Coiby Xu <coxu@redhat.com>
Date: Thu, 14 Jul 2022 21:40:24 +0800
Subject: [PATCH] kexec: clean up arch_kexec_kernel_verify_sig

Before commit 105e10e2cf1c ("kexec_file: drop weak attribute from
functions"), there was already no arch-specific implementation
of arch_kexec_kernel_verify_sig. With weak attribute dropped by that
commit, arch_kexec_kernel_verify_sig is completely useless. So clean it
up.

Note later patches are dependent on this patch so it should be backported
to the stable tree as well.

Cc: stable@vger.kernel.org
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
[zohar@linux.ibm.com: reworded patch description "Note"]
Link: https://lore.kernel.org/linux-integrity/20220714134027.394370-1-coxu@redhat.com/
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 8107606ad1e8..7f710fb3712b 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -212,11 +212,6 @@ static inline void *arch_kexec_kernel_image_load(struct kimage *image)
 }
 #endif
 
-#ifdef CONFIG_KEXEC_SIG
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
-				 unsigned long buf_len);
-#endif
-
 extern int kexec_add_buffer(struct kexec_buf *kbuf);
 int kexec_locate_mem_hole(struct kexec_buf *kbuf);
 
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 0c27c81351ee..6dc1294c90fc 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -81,24 +81,6 @@ int kexec_image_post_load_cleanup_default(struct kimage *image)
 	return image->fops->cleanup(image->image_loader_data);
 }
 
-#ifdef CONFIG_KEXEC_SIG
-static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
-					  unsigned long buf_len)
-{
-	if (!image->fops || !image->fops->verify_sig) {
-		pr_debug("kernel loader does not support signature verification.\n");
-		return -EKEYREJECTED;
-	}
-
-	return image->fops->verify_sig(buf, buf_len);
-}
-
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf, unsigned long buf_len)
-{
-	return kexec_image_verify_sig_default(image, buf, buf_len);
-}
-#endif
-
 /*
  * Free up memory used by kernel, initrd, and command line. This is temporary
  * memory allocation which is not needed any more after these buffers have
@@ -141,13 +123,24 @@ void kimage_file_post_load_cleanup(struct kimage *image)
 }
 
 #ifdef CONFIG_KEXEC_SIG
+static int kexec_image_verify_sig(struct kimage *image, void *buf,
+				  unsigned long buf_len)
+{
+	if (!image->fops || !image->fops->verify_sig) {
+		pr_debug("kernel loader does not support signature verification.\n");
+		return -EKEYREJECTED;
+	}
+
+	return image->fops->verify_sig(buf, buf_len);
+}
+
 static int
 kimage_validate_signature(struct kimage *image)
 {
 	int ret;
 
-	ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
-					   image->kernel_buf_len);
+	ret = kexec_image_verify_sig(image, image->kernel_buf,
+				     image->kernel_buf_len);
 	if (ret) {
 
 		if (sig_enforce) {

Re: FAILED: patch "[PATCH] kexec: clean up arch_kexec_kernel_verify_sig" failed to apply to 5.15-stable tree

[Michal Suchánek]

Hello,

it applies on top of 105e10e2cf1c

Thanks

Michal

On Mon, Aug 15, 2022 at 01:48:04PM +0200, gregkh@linuxfoundation.org wrote:
> 
> The patch below does not apply to the 5.15-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
> 
> thanks,
> 
> greg k-h
> 
> ------------------ original commit in Linus's tree ------------------
> 
> From 689a71493bd2f31c024f8c0395f85a1fd4b2138e Mon Sep 17 00:00:00 2001
> From: Coiby Xu <coxu@redhat.com>
> Date: Thu, 14 Jul 2022 21:40:24 +0800
> Subject: [PATCH] kexec: clean up arch_kexec_kernel_verify_sig
> 
> Before commit 105e10e2cf1c ("kexec_file: drop weak attribute from
> functions"), there was already no arch-specific implementation
> of arch_kexec_kernel_verify_sig. With weak attribute dropped by that
> commit, arch_kexec_kernel_verify_sig is completely useless. So clean it
> up.
> 
> Note later patches are dependent on this patch so it should be backported
> to the stable tree as well.
> 
> Cc: stable@vger.kernel.org
> Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
> Reviewed-by: Michal Suchanek <msuchanek@suse.de>
> Acked-by: Baoquan He <bhe@redhat.com>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
> [zohar@linux.ibm.com: reworded patch description "Note"]
> Link: https://lore.kernel.org/linux-integrity/20220714134027.394370-1-coxu@redhat.com/
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> 
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index 8107606ad1e8..7f710fb3712b 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -212,11 +212,6 @@ static inline void *arch_kexec_kernel_image_load(struct kimage *image)
>  }
>  #endif
>  
> -#ifdef CONFIG_KEXEC_SIG
> -int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
> -				 unsigned long buf_len);
> -#endif
> -
>  extern int kexec_add_buffer(struct kexec_buf *kbuf);
>  int kexec_locate_mem_hole(struct kexec_buf *kbuf);
>  
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 0c27c81351ee..6dc1294c90fc 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -81,24 +81,6 @@ int kexec_image_post_load_cleanup_default(struct kimage *image)
>  	return image->fops->cleanup(image->image_loader_data);
>  }
>  
> -#ifdef CONFIG_KEXEC_SIG
> -static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
> -					  unsigned long buf_len)
> -{
> -	if (!image->fops || !image->fops->verify_sig) {
> -		pr_debug("kernel loader does not support signature verification.\n");
> -		return -EKEYREJECTED;
> -	}
> -
> -	return image->fops->verify_sig(buf, buf_len);
> -}
> -
> -int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf, unsigned long buf_len)
> -{
> -	return kexec_image_verify_sig_default(image, buf, buf_len);
> -}
> -#endif
> -
>  /*
>   * Free up memory used by kernel, initrd, and command line. This is temporary
>   * memory allocation which is not needed any more after these buffers have
> @@ -141,13 +123,24 @@ void kimage_file_post_load_cleanup(struct kimage *image)
>  }
>  
>  #ifdef CONFIG_KEXEC_SIG
> +static int kexec_image_verify_sig(struct kimage *image, void *buf,
> +				  unsigned long buf_len)
> +{
> +	if (!image->fops || !image->fops->verify_sig) {
> +		pr_debug("kernel loader does not support signature verification.\n");
> +		return -EKEYREJECTED;
> +	}
> +
> +	return image->fops->verify_sig(buf, buf_len);
> +}
> +
>  static int
>  kimage_validate_signature(struct kimage *image)
>  {
>  	int ret;
>  
> -	ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
> -					   image->kernel_buf_len);
> +	ret = kexec_image_verify_sig(image, image->kernel_buf,
> +				     image->kernel_buf_len);
>  	if (ret) {
>  
>  		if (sig_enforce) {
> 

Re: FAILED: patch "[PATCH] kexec: clean up arch_kexec_kernel_verify_sig" failed to apply to 5.15-stable tree

[Greg KH]

On Mon, Aug 15, 2022 at 02:41:25PM +0200, Michal Suchánek wrote:
> Hello,
> 
> it applies on top of 105e10e2cf1c

I see no such commit id in Linus's tree, what am I missing here?

confused,

greg k-h

Re: FAILED: patch "[PATCH] kexec: clean up arch_kexec_kernel_verify_sig" failed to apply to 5.15-stable tree

[Mimi Zohar]

On Mon, 2022-08-15 at 15:03 +0200, Greg KH wrote:
> On Mon, Aug 15, 2022 at 02:41:25PM +0200, Michal Suchánek wrote:
> > Hello,
> > 
> > it applies on top of 105e10e2cf1c
> 
> I see no such commit id in Linus's tree, what am I missing here?
> 
> confused,

0738eceb6201 kexec: drop weak attribute from functions
65d9a9a60fd7 kexec_file: drop weak attribute from functions

thanks,

Mimi

Re: FAILED: patch "[PATCH] kexec: clean up arch_kexec_kernel_verify_sig" failed to apply to 5.15-stable tree

[Greg KH]

On Mon, Aug 15, 2022 at 09:22:39AM -0400, Mimi Zohar wrote:
> On Mon, 2022-08-15 at 15:03 +0200, Greg KH wrote:
> > On Mon, Aug 15, 2022 at 02:41:25PM +0200, Michal Suchánek wrote:
> > > Hello,
> > > 
> > > it applies on top of 105e10e2cf1c
> > 
> > I see no such commit id in Linus's tree, what am I missing here?
> > 
> > confused,
> 
> 0738eceb6201 kexec: drop weak attribute from functions
> 65d9a9a60fd7 kexec_file: drop weak attribute from functions

That is 2 commit ids, not just one as Michal said, why?

I am totally confused here, sorry.  Can I have a list of the git ids
that need to be applied here, including the original git id of the patch
that started this whole thread off, so I know _EXACTLY_ what I need to
apply to the tree (and to what trees?)

thanks,

greg k-h

Re: FAILED: patch "[PATCH] kexec: clean up arch_kexec_kernel_verify_sig" failed to apply to 5.15-stable tree

[Coiby Xu]

On Wed, Aug 17, 2022 at 02:06:39PM +0200, Greg KH wrote:
>On Mon, Aug 15, 2022 at 09:22:39AM -0400, Mimi Zohar wrote:
>> On Mon, 2022-08-15 at 15:03 +0200, Greg KH wrote:
>> > On Mon, Aug 15, 2022 at 02:41:25PM +0200, Michal Suchánek wrote:
>> > > Hello,
>> > >
>> > > it applies on top of 105e10e2cf1c
>> >
>> > I see no such commit id in Linus's tree, what am I missing here?
>> >
>> > confused,
>>
>> 0738eceb6201 kexec: drop weak attribute from functions

The above one is actually not needed.

>> 65d9a9a60fd7 kexec_file: drop weak attribute from functions
>
>That is 2 commit ids, not just one as Michal said, why?
>
>I am totally confused here, sorry.  Can I have a list of the git ids
>that need to be applied here, including the original git id of the patch
>that started this whole thread off, so I know _EXACTLY_ what I need to
>apply to the tree (and to what trees?)

This patch i.e. "[PATCH] kexec: clean up arch_kexec_kernel_verify_sig"
is a prerequisite for "[PATCH Patch] arm64: kexec_file: use more system
keyrings to verify kernel image signature". I just replied to 'FAILED:
patch "[PATCH] arm64: kexec_file: use more system keyrings to verify
kernel" failed to apply to 5.15-stable tree' with a full list of the git
ids.

>
>thanks,
>
>greg k-h
>

-- 
Best regards,
Coiby

FAILED: patch "[PATCH] kexec: clean up arch_kexec_kernel_verify_sig" failed to apply to 5.15-stable tree

[gregkh]

The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 689a71493bd2f31c024f8c0395f85a1fd4b2138e Mon Sep 17 00:00:00 2001
From: Coiby Xu <coxu@redhat.com>
Date: Thu, 14 Jul 2022 21:40:24 +0800
Subject: [PATCH] kexec: clean up arch_kexec_kernel_verify_sig

Before commit 105e10e2cf1c ("kexec_file: drop weak attribute from
functions"), there was already no arch-specific implementation
of arch_kexec_kernel_verify_sig. With weak attribute dropped by that
commit, arch_kexec_kernel_verify_sig is completely useless. So clean it
up.

Note later patches are dependent on this patch so it should be backported
to the stable tree as well.

Cc: stable@vger.kernel.org
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Reviewed-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
[zohar@linux.ibm.com: reworded patch description "Note"]
Link: https://lore.kernel.org/linux-integrity/20220714134027.394370-1-coxu@redhat.com/
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 8107606ad1e8..7f710fb3712b 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -212,11 +212,6 @@ static inline void *arch_kexec_kernel_image_load(struct kimage *image)
 }
 #endif
 
-#ifdef CONFIG_KEXEC_SIG
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
-				 unsigned long buf_len);
-#endif
-
 extern int kexec_add_buffer(struct kexec_buf *kbuf);
 int kexec_locate_mem_hole(struct kexec_buf *kbuf);
 
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 0c27c81351ee..6dc1294c90fc 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -81,24 +81,6 @@ int kexec_image_post_load_cleanup_default(struct kimage *image)
 	return image->fops->cleanup(image->image_loader_data);
 }
 
-#ifdef CONFIG_KEXEC_SIG
-static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
-					  unsigned long buf_len)
-{
-	if (!image->fops || !image->fops->verify_sig) {
-		pr_debug("kernel loader does not support signature verification.\n");
-		return -EKEYREJECTED;
-	}
-
-	return image->fops->verify_sig(buf, buf_len);
-}
-
-int arch_kexec_kernel_verify_sig(struct kimage *image, void *buf, unsigned long buf_len)
-{
-	return kexec_image_verify_sig_default(image, buf, buf_len);
-}
-#endif
-
 /*
  * Free up memory used by kernel, initrd, and command line. This is temporary
  * memory allocation which is not needed any more after these buffers have
@@ -141,13 +123,24 @@ void kimage_file_post_load_cleanup(struct kimage *image)
 }
 
 #ifdef CONFIG_KEXEC_SIG
+static int kexec_image_verify_sig(struct kimage *image, void *buf,
+				  unsigned long buf_len)
+{
+	if (!image->fops || !image->fops->verify_sig) {
+		pr_debug("kernel loader does not support signature verification.\n");
+		return -EKEYREJECTED;
+	}
+
+	return image->fops->verify_sig(buf, buf_len);
+}
+
 static int
 kimage_validate_signature(struct kimage *image)
 {
 	int ret;
 
-	ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
-					   image->kernel_buf_len);
+	ret = kexec_image_verify_sig(image, image->kernel_buf,
+				     image->kernel_buf_len);
 	if (ret) {
 
 		if (sig_enforce) {