From: David Hildenbrand <david@redhat.com>
To: Javier Martinez Canillas <javierm@redhat.com>,
linux-kernel@vger.kernel.org
Cc: linux-efi@vger.kernel.org, Hans de Goede <hdegoede@redhat.com>,
Eric Richter <erichte@linux.ibm.com>,
James Morris <jmorris@namei.org>,
Michael Ellerman <mpe@ellerman.id.au>,
Mimi Zohar <zohar@linux.ibm.com>,
Nayna Jain <nayna@linux.ibm.com>,
"Serge E. Hallyn" <serge@hallyn.com>,
YueHaibing <yuehaibing@huawei.com>,
linux-security-module@vger.kernel.org
Subject: Re: [RESEND PATCH v2] efi: Only print errors about failing to get certs if EFI vars are found
Date: Fri, 28 Feb 2020 10:19:03 +0100 [thread overview]
Message-ID: <0fd1b499-3a5e-c78e-0279-186a4c424217@redhat.com> (raw)
In-Reply-To: <20200217113947.2070436-1-javierm@redhat.com>
On 17.02.20 12:39, Javier Martinez Canillas wrote:
> If CONFIG_LOAD_UEFI_KEYS is enabled, the kernel attempts to load the certs
> from the db, dbx and MokListRT EFI variables into the appropriate keyrings.
>
> But it just assumes that the variables will be present and prints an error
> if the certs can't be loaded, even when is possible that the variables may
> not exist. For example the MokListRT variable will only be present if shim
> is used.
>
> So only print an error message about failing to get the certs list from an
> EFI variable if this is found. Otherwise these printed errors just pollute
> the kernel log ring buffer with confusing messages like the following:
>
> [ 5.427251] Couldn't get size: 0x800000000000000e
> [ 5.427261] MODSIGN: Couldn't get UEFI db list
> [ 5.428012] Couldn't get size: 0x800000000000000e
> [ 5.428023] Couldn't get UEFI MokListRT
>
> Reported-by: Hans de Goede <hdegoede@redhat.com>
> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
> Tested-by: Hans de Goede <hdegoede@redhat.com>
This patch seems to break a very basic x86-64 QEMU setup (booting
upstream kernel with a F31 initrd - are you running basic boot tests?).
Luckily, it only took me 5 minutes to identify this patch. Reverting
this patch from linux-next fixes it for me.
[ 1.042766] Loaded X.509 cert 'Build time autogenerated kernel key: 6625d6e34255935276d2c9851e2458909a4bcd69'
[ 1.044314] zswap: loaded using pool lzo/zbud
[ 1.045663] Key type ._fscrypt registered
[ 1.046154] Key type .fscrypt registered
[ 1.046524] Key type fscrypt-provisioning registered
[ 1.051178] Key type big_key registered
[ 1.055108] Key type encrypted registered
[ 1.055513] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 1.056172] #PF: supervisor instruction fetch in kernel mode
[ 1.056706] #PF: error_code(0x0010) - not-present page
[ 1.057367] PGD 0 P4D 0
[ 1.057729] Oops: 0010 [#1] SMP NOPTI
[ 1.058249] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.6.0-rc3-next-20200228+ #79
[ 1.059167] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.4
[ 1.060230] RIP: 0010:0x0
[ 1.060478] Code: Bad RIP value.
[ 1.060786] RSP: 0018:ffffbc7880637d98 EFLAGS: 00010246
[ 1.061281] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffbc7880637dc8
[ 1.061954] RDX: 0000000000000000 RSI: ffffbc7880637df0 RDI: ffffffffa73c40be
[ 1.062611] RBP: ffffbc7880637e20 R08: ffffbc7880637dac R09: ffffa0238f4ba6c0
[ 1.063278] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
[ 1.063956] R13: ffffa024bdd6f660 R14: 0000000000000000 R15: 0000000000000000
[ 1.064609] FS: 0000000000000000(0000) GS:ffffa023fdd00000(0000) knlGS:0000000000000000
[ 1.065360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.065900] CR2: ffffffffffffffd6 CR3: 00000000b1610000 CR4: 00000000000006e0
[ 1.066562] Call Trace:
[ 1.066803] load_uefi_certs+0xc8/0x2bb
[ 1.067171] ? get_cert_list+0xfb/0xfb
[ 1.067523] do_one_initcall+0x5d/0x2f0
[ 1.067894] ? rcu_read_lock_sched_held+0x52/0x80
[ 1.068337] kernel_init_freeable+0x243/0x2c2
[ 1.068751] ? rest_init+0x23a/0x23a
[ 1.069095] kernel_init+0xa/0x106
[ 1.069416] ret_from_fork+0x27/0x50
[ 1.069759] Modules linked in:
[ 1.070050] CR2: 0000000000000000
[ 1.070361] ---[ end trace fcce9bb4feb21d99 ]---
--
Thanks,
David / dhildenb
next prev parent reply other threads:[~2020-02-28 9:19 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-17 11:39 [RESEND PATCH v2] efi: Only print errors about failing to get certs if EFI vars are found Javier Martinez Canillas
2020-02-17 13:37 ` Ard Biesheuvel
2020-02-28 9:19 ` David Hildenbrand [this message]
2020-02-28 9:31 ` David Hildenbrand
2020-02-28 9:35 ` Ard Biesheuvel
2020-02-28 9:35 ` David Hildenbrand
2020-02-28 9:39 ` Ard Biesheuvel
2020-02-28 9:43 ` David Hildenbrand
2020-02-28 9:44 ` Ard Biesheuvel
2020-02-28 9:58 ` David Hildenbrand
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0fd1b499-3a5e-c78e-0279-186a4c424217@redhat.com \
--to=david@redhat.com \
--cc=erichte@linux.ibm.com \
--cc=hdegoede@redhat.com \
--cc=javierm@redhat.com \
--cc=jmorris@namei.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mpe@ellerman.id.au \
--cc=nayna@linux.ibm.com \
--cc=serge@hallyn.com \
--cc=yuehaibing@huawei.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).