diff options
| author | Daniele Alessandrelli <daniele.alessandrelli@gmail.com> | 2019-09-18 16:04:54 +0200 |
|---|---|---|
| committer | Simon Glass <sjg@chromium.org> | 2019-10-15 08:40:03 -0600 |
| commit | 0772a1f4973031d6a30482cf7610f691b6bc1e6d (patch) | |
| tree | 46f866b6906b8778833551fadae7a177a1b6bc9e /lib/rsa | |
| parent | ce5172cf655533eabb977556036509416385cd90 (diff) | |
| download | u-boot-0772a1f4973031d6a30482cf7610f691b6bc1e6d.tar.gz u-boot-0772a1f4973031d6a30482cf7610f691b6bc1e6d.tar.xz u-boot-0772a1f4973031d6a30482cf7610f691b6bc1e6d.zip | |
rsa: Return immediately if required-key verification fails
Currently, if image verification with a required key fails, rsa_verify()
code tries to find another key to verify the FIT image. This however, is
not the intended behavior as the documentation says that required keys
"must be verified for the image / configuration to be considered valid".
This patch fixes the issue by making rsa_verify() return immediately if
the verification of a required key fails.
Signed-off-by: Daniele Alessandrelli <daniele.alessandrelli@gmail.com>
Diffstat (limited to 'lib/rsa')
| -rw-r--r-- | lib/rsa/rsa-verify.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/lib/rsa/rsa-verify.c b/lib/rsa/rsa-verify.c index 287fcc4d23..82dc513260 100644 --- a/lib/rsa/rsa-verify.c +++ b/lib/rsa/rsa-verify.c @@ -437,8 +437,7 @@ int rsa_verify(struct image_sign_info *info, if (info->required_keynode != -1) { ret = rsa_verify_with_keynode(info, hash, sig, sig_len, info->required_keynode); - if (!ret) - return ret; + return ret; } /* Look for a key that matches our hint */ |