Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) client-ip=23.128.96.34;
Date:   Fri, 6 Oct 2023 12:19:37 -0700
From:   Dan Williams <dan.j.williams@intel.com>
To:     Lukas Wunner <lukas@wunner.de>, Bjorn Helgaas <helgaas@kernel.org>,
        "David Howells" <dhowells@redhat.com>,
        David Woodhouse <dwmw2@infradead.org>,
        "Herbert Xu" <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>,
        Alex Williamson <alex.williamson@redhat.com>,
        <linux-pci@vger.kernel.org>, <linux-cxl@vger.kernel.org>,
        <linux-coco@lists.linux.dev>, <keyrings@vger.kernel.org>,
        <linux-crypto@vger.kernel.org>, <kvm@vger.kernel.org>
CC:     Jonathan Cameron <Jonathan.Cameron@huawei.com>,
        <linuxarm@huawei.com>, David Box <david.e.box@intel.com>,
        Dan Williams <dan.j.williams@intel.com>,
        Dave Jiang <dave.jiang@intel.com>,
        "Li, Ming" <ming4.li@intel.com>, Zhi Wang <zhi.a.wang@intel.com>,
        Alistair Francis <alistair.francis@wdc.com>,
        "Wilfred Mallawa" <wilfred.mallawa@wdc.com>,
        Alexey Kardashevskiy <aik@amd.com>,
        "Tom Lendacky" <thomas.lendacky@amd.com>,
        Sean Christopherson <seanjc@google.com>,
        Alexander Graf <graf@amazon.com>
Subject: RE: [PATCH 04/12] certs: Create blacklist keyring earlier
Message-ID: <65205dc992c11_ae7e7294b9@dwillia2-xfh.jf.intel.com.notmuch>
References: <cover.1695921656.git.lukas@wunner.de>
 <3db7a8856833dfcbc4b122301f233828379d67db.1695921657.git.lukas@wunner.de>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <3db7a8856833dfcbc4b122301f233828379d67db.1695921657.git.lukas@wunner.de>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?N/fYBtvhp8WsO4iH4iSF8Yqe9tZSTrEKEutfFc2HlH/3BXfJqo8aTkO+21Ec?=
 =?us-ascii?Q?j5u58YZfStgwcQFvnIiHTH08HJXXrcWMvBsvvO1KNfSsay0/kY6N2Zju7Pz3?=
 =?us-ascii?Q?Yy80BPnhCACuxMF2t4sdKn76a7oUQYanWED/h3YlN1ONIajGIq08d+EsNRkc?=
 =?us-ascii?Q?exubH4t4xmJFtQAJLO6lV//IZQRYSz930Z2/QqS935PpsadLIU99kv9fpAtU?=
 =?us-ascii?Q?XLv/KLITdQ5JyHuKmJa0ca/jkHorcuCJTOXXAp+84v1dg12IZ1704fMhOb02?=
 =?us-ascii?Q?AGbqbF1j4HsjCThB/H656yGavmSGG5tQ+yX/0kPvgpBvbgfzA93Uj3AO0RWN?=
 =?us-ascii?Q?D+lMZPrLWYLd2nX1LsZ93buDMqfkzHoyVOQeJQXWxH+aidpsDxSo7PTdvYGd?=
 =?us-ascii?Q?qklpbEULnUqidlkGnAFe/W/Dvc9WVzlY63Cp/vHiR6eldy4+ywP7yTgWz47y?=
 =?us-ascii?Q?JqAr1nfHxc+qEIGSgO3NpuWGgCXkAwIWVV0pur2QKzQowgethaIlGXcMS4DC?=
 =?us-ascii?Q?Kj0oxMx854k7roBu+jMPt1xAjyM5rLSapSBi2CGApYayBLNbXCU3XFNnsTwD?=
 =?us-ascii?Q?FOgg4dwg3RXlOhYpvAfagcY+TT2DrVNLJlZm+LmTqhmSfioxRS8ciVKvh5/v?=
 =?us-ascii?Q?Xrb0oU8fntQlTw1aV9YhzAEoE1Yofk/5O8G4M9FDGNtH2FjA/hu3FNXY0wMr?=
 =?us-ascii?Q?JsdrXqgaK9zXjCeFcMa13sptSGK8vg4bai1lfvWg+EMcG2UNRaSYpGq2Cg0Z?=
 =?us-ascii?Q?8QbFyFJJbSGMR460w0os8l54VeY2V71occzfWH2NOi++1ETMziztvm2QUNlN?=
 =?us-ascii?Q?R8TW6fGlPNqg+ANSWW/O2sWCV1G99iEV198QADN/xVdYQcU06+kAod1Jmzfr?=
 =?us-ascii?Q?U1LZR5ulW4HbEKES77VIOBL13QQNS5yXuQvYsD7bj6dzulU2VzDrdmOuh7w2?=
 =?us-ascii?Q?j0B74LEMG/zBXzlwpF5rX6FMMayXoCx+h44813tZir7SulNaBtSVUkDG+cbn?=
 =?us-ascii?Q?0Zc6G737ZQ3cmCPyM+DXfzhNT2gncSC9KdtBAP9wX+sbxrs+SzgWICow2k4+?=
 =?us-ascii?Q?91163OvHDlW+c6enUM/AXiyM4/v+/msfVpxALfdWZsUvQdkkcw99W4qEzyLK?=
 =?us-ascii?Q?gOgL8j2miO5sHLjs7dQC7vVzEd3sRINz0klAjf1HPHBhdQfAJKXhOTfc3B81?=
 =?us-ascii?Q?u69qA8rAqo2xvSKwzwdGcNjpSYma1djsjRvUV5cKkSVA/6Ty4ZmH9vy+YND7?=
 =?us-ascii?Q?7I3sv38YXDIpmK2A1el4oYy+gOy3Vq4DcNA3Tk1iuzz5iLFESeFhipBs88vE?=
 =?us-ascii?Q?4rqzHuuDz3XK7m600ux0E+RtSTE1NVPH19K9MuSzcZbmGjQ83INNIoJOTl1k?=
 =?us-ascii?Q?dUzQKlryGaj6oDToG5BHXt17BUlLC/sm/sIK+DwAve32z+AvIJ/oEeLoXOkC?=
 =?us-ascii?Q?H9zNMA2Z1swR86zGSyz0ZmBksUBXhp3f+0GxwFP9XIdP/MrNvLAjezMYROrj?=
 =?us-ascii?Q?Kbjv8b22owCniYLMrGe8VkqbfGcqlMK/w1UFrraVamMX5gHRkfO7xaEW8Sbq?=
 =?us-ascii?Q?r0MXakEkao4FvRD928fBHnzxiq+HPvmE6PYcS0uj3C+rD4yBmU9N6krUWu2l?=
 =?us-ascii?Q?pA=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: b871740c-510e-4942-0d29-08dbc6a130e0
X-MS-Exchange-CrossTenant-AuthSource: PH8PR11MB8107.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Oct 2023 19:19:41.6551
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: lake6eBjk7GsYHsDiGP/xzHrH2g9YXrpP8mMUjj+PVMLD57JB8/1XNPAWTiYqH543wMYI6zsGJdWzmKEeqC5IjLYqS/HWpKqNqmTkFXFZKU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR11MB5341
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=2.7 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RCVD_IN_SBL_CSS,SPF_HELO_NONE,SPF_PASS autolearn=no
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on howler.vger.email
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (howler.vger.email [0.0.0.0]); Fri, 06 Oct 2023 12:20:03 -0700 (PDT)
X-Spam-Level: **

Lukas Wunner wrote:
> The upcoming support for PCI device authentication with CMA-SPDM
> (PCIe r6.1 sec 6.31) requires parsing X.509 certificates upon
> device enumeration, which happens in a subsys_initcall().
> 
> Parsing X.509 certificates accesses the blacklist keyring:
> x509_cert_parse()
>   x509_get_sig_params()
>     is_hash_blacklisted()
>       keyring_search()
> 
> So far the keyring is created much later in a device_initcall().  Avoid
> a NULL pointer dereference on access to the keyring by creating it one
> initcall level earlier than PCI device enumeration, i.e. in an
> arch_initcall().
> 
> Signed-off-by: Lukas Wunner <lukas@wunner.de>

I was going to comment on s/blacklist/blocklist/, but the coding-style
recommendation is relative to new usage.

Reviewed-by: Dan Williams <dan.j.williams@intel.com>