1 files changed, 21 insertions, 0 deletions

diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 623e6c58081f..9642b9b33655 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -19,6 +19,8 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/efi.h>
+#include <linux/verify_pefile.h>
+#include <keys/system_keyring.h>
 
 #include <asm/bootparam.h>
 #include <asm/setup.h>
@@ -525,8 +527,27 @@ int bzImage64_cleanup(void *loader_data)
         return 0;
 }
 
+#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
+int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
+{
+        bool trusted;
+        int ret;
+
+        ret = verify_pefile_signature(kernel, kernel_len,
+                                      system_trusted_keyring, &trusted);
+        if (ret < 0)
+                return ret;
+        if (!trusted)
+                return -EKEYREJECTED;
+        return 0;
+}
+#endif
+
 struct kexec_file_ops kexec_bzImage64_ops = {
         .probe = bzImage64_probe,
         .load = bzImage64_load,
         .cleanup = bzImage64_cleanup,
+#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
+        .verify_sig = bzImage64_verify_sig,
+#endif
 };