Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

Pull module signing support from Rusty Russell:
 "module signing is the highlight, but it's an all-over David Howells frenzy..."

Hmm "Magrathea: Glacier signing key". Somebody has been reading too much HHGTTG.

* 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: (37 commits)
  X.509: Fix indefinite length element skip error handling
  X.509: Convert some printk calls to pr_devel
  asymmetric keys: fix printk format warning
  MODSIGN: Fix 32-bit overflow in X.509 certificate validity date checking
  MODSIGN: Make mrproper should remove generated files.
  MODSIGN: Use utf8 strings in signer's name in autogenerated X.509 certs
  MODSIGN: Use the same digest for the autogen key sig as for the module sig
  MODSIGN: Sign modules during the build process
  MODSIGN: Provide a script for generating a key ID from an X.509 cert
  MODSIGN: Implement module signature checking
  MODSIGN: Provide module signing public keys to the kernel
  MODSIGN: Automatically generate module signing keys if missing
  MODSIGN: Provide Kconfig options
  MODSIGN: Provide gitignore and make clean rules for extra files
  MODSIGN: Add FIPS policy
  module: signature checking hook
  X.509: Add a crypto key parser for binary (DER) X.509 certificates
  MPILIB: Provide a function to read raw data into an MPI
  X.509: Add an ASN.1 decoder
  X.509: Add simple ASN.1 grammar compiler
  ...

7 files changed, 129 insertions, 63 deletions

diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 2d1bb8af7696..9e1e005c7596 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -773,8 +773,8 @@ static int encrypted_init(struct encrypted_key_payload *epayload,
  *
  * On success, return 0. Otherwise return errno.
  */
-static int encrypted_instantiate(struct key *key, const void *data,
-                                 size_t datalen)
+static int encrypted_instantiate(struct key *key,
+                                 struct key_preparsed_payload *prep)
 {
         struct encrypted_key_payload *epayload = NULL;
         char *datablob = NULL;
@@ -782,16 +782,17 @@ static int encrypted_instantiate(struct key *key, const void *data,
         char *master_desc = NULL;
         char *decrypted_datalen = NULL;
         char *hex_encoded_iv = NULL;
+        size_t datalen = prep->datalen;
         int ret;
 
-        if (datalen <= 0 || datalen > 32767 || !data)
+        if (datalen <= 0 || datalen > 32767 || !prep->data)
                 return -EINVAL;
 
         datablob = kmalloc(datalen + 1, GFP_KERNEL);
         if (!datablob)
                 return -ENOMEM;
         datablob[datalen] = 0;
-        memcpy(datablob, data, datalen);
+        memcpy(datablob, prep->data, datalen);
         ret = datablob_parse(datablob, &format, &master_desc,
                              &decrypted_datalen, &hex_encoded_iv);
         if (ret < 0)
@@ -834,16 +835,17 @@ static void encrypted_rcu_free(struct rcu_head *rcu)
  *
  * On success, return 0. Otherwise return errno.
  */
-static int encrypted_update(struct key *key, const void *data, size_t datalen)
+static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
 {
         struct encrypted_key_payload *epayload = key->payload.data;
         struct encrypted_key_payload *new_epayload;
         char *buf;
         char *new_master_desc = NULL;
         const char *format = NULL;
+        size_t datalen = prep->datalen;
         int ret = 0;
 
-        if (datalen <= 0 || datalen > 32767 || !data)
+        if (datalen <= 0 || datalen > 32767 || !prep->data)
                 return -EINVAL;
 
         buf = kmalloc(datalen + 1, GFP_KERNEL);
@@ -851,7 +853,7 @@ static int encrypted_update(struct key *key, const void *data, size_t datalen)
                 return -ENOMEM;
 
         buf[datalen] = 0;
-        memcpy(buf, data, datalen);
+        memcpy(buf, prep->data, datalen);
         ret = datablob_parse(buf, &format, &new_master_desc, NULL, NULL);
         if (ret < 0)
                 goto out;
diff --git a/security/keys/key.c b/security/keys/key.c
index a30e92734905..a15c9da8f971 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -405,8 +405,7 @@ EXPORT_SYMBOL(key_payload_reserve);
  * key_construction_mutex.
  */
 static int __key_instantiate_and_link(struct key *key,
-                                      const void *data,
-                                      size_t datalen,
+                                      struct key_preparsed_payload *prep,
                                       struct key *keyring,
                                       struct key *authkey,
                                       unsigned long *_prealloc)
@@ -424,7 +423,7 @@ static int __key_instantiate_and_link(struct key *key,
         /* can't instantiate twice */
         if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
                 /* instantiate the key */
-                ret = key->type->instantiate(key, data, datalen);
+                ret = key->type->instantiate(key, prep);
 
                 if (ret == 0) {
                         /* mark the key as being instantiated */
@@ -475,22 +474,37 @@ int key_instantiate_and_link(struct key *key,
                              struct key *keyring,
                              struct key *authkey)
 {
+        struct key_preparsed_payload prep;
         unsigned long prealloc;
         int ret;
 
+        memset(&prep, 0, sizeof(prep));
+        prep.data = data;
+        prep.datalen = datalen;
+        prep.quotalen = key->type->def_datalen;
+        if (key->type->preparse) {
+                ret = key->type->preparse(&prep);
+                if (ret < 0)
+                        goto error;
+        }
+
         if (keyring) {
                 ret = __key_link_begin(keyring, key->type, key->description,
                                        &prealloc);
                 if (ret < 0)
-                        return ret;
+                        goto error_free_preparse;
         }
 
-        ret = __key_instantiate_and_link(key, data, datalen, keyring, authkey,
+        ret = __key_instantiate_and_link(key, &prep, keyring, authkey,
                                          &prealloc);
 
         if (keyring)
                 __key_link_end(keyring, key->type, prealloc);
 
+error_free_preparse:
+        if (key->type->preparse)
+                key->type->free_preparse(&prep);
+error:
         return ret;
 }
 
@@ -699,7 +713,7 @@ void key_type_put(struct key_type *ktype)
  * if we get an error.
  */
 static inline key_ref_t __key_update(key_ref_t key_ref,
-                                     const void *payload, size_t plen)
+                                     struct key_preparsed_payload *prep)
 {
         struct key *key = key_ref_to_ptr(key_ref);
         int ret;
@@ -715,7 +729,7 @@ static inline key_ref_t __key_update(key_ref_t key_ref,
 
         down_write(&key->sem);