Re: [PATCH v2 07/10] security: Hornet LSM
From: kernel test robot
Date: Sat Feb 28 2026 - 00:34:42 EST
Hi Blaise,
kernel test robot noticed the following build errors:
[auto build test ERROR on linus/master]
[also build test ERROR on v7.0-rc1 next-20260227]
[cannot apply to herbert-cryptodev-2.6/master herbert-crypto-2.6/master shuah-kselftest/next shuah-kselftest/fixes]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Blaise-Boscaccy/certs-break-out-pkcs7-check-into-its-own-function/20260228-074528
base: linus/master
patch link: https://lore.kernel.org/r/20260227233930.2418522-8-bboscaccy%40linux.microsoft.com
patch subject: [PATCH v2 07/10] security: Hornet LSM
config: csky-randconfig-r071-20260228 (https://download.01.org/0day-ci/archive/20260228/202602281307.9DVHYnXF-lkp@xxxxxxxxx/config)
compiler: csky-linux-gcc (GCC) 15.2.0
smatch version: v0.5.0-8994-gd50c5a4c
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260228/202602281307.9DVHYnXF-lkp@xxxxxxxxx/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602281307.9DVHYnXF-lkp@xxxxxxxxx/
All errors (new ones prefixed by >>):
security/hornet/hornet_lsm.c: In function 'hornet_check_program':
>> security/hornet/hornet_lsm.c:183:15: error: implicit declaration of function 'verify_pkcs7_signature'; did you mean 'bpf_verify_pkcs7_signature'? [-Wimplicit-function-declaration]
183 | err = verify_pkcs7_signature(prog->insnsi, prog->len * sizeof(struct bpf_insn),
| ^~~~~~~~~~~~~~~~~~~~~~
| bpf_verify_pkcs7_signature
>> security/hornet/hornet_lsm.c:197:13: error: implicit declaration of function 'validate_pkcs7_trust' [-Wimplicit-function-declaration]
197 | if (validate_pkcs7_trust(msg, VERIFY_USE_SECONDARY_KEYRING)) {
| ^~~~~~~~~~~~~~~~~~~~
vim +183 security/hornet/hornet_lsm.c
153
154 static int hornet_check_program(struct bpf_prog *prog, union bpf_attr *attr,
155 struct bpf_token *token, bool is_kernel)
156 {
157 struct hornet_maps maps = {0};
158 bpfptr_t usig = make_bpfptr(attr->signature, is_kernel);
159 struct pkcs7_message *msg;
160 struct hornet_parse_context *ctx;
161 void *sig;
162 int err;
163 const void *authattrs;
164 size_t authattrs_len;
165
166 if (!attr->signature)
167 return LSM_INT_VERDICT_UNSIGNED;
168
169 ctx = kzalloc(sizeof(struct hornet_parse_context), GFP_KERNEL);
170 if (!ctx)
171 return -ENOMEM;
172
173 maps.fd_array = make_bpfptr(attr->fd_array, is_kernel);
174 sig = kzalloc(attr->signature_size, GFP_KERNEL);
175 if (!sig) {
176 err = -ENOMEM;
177 goto out;
178 }
179 err = copy_from_bpfptr(sig, usig, attr->signature_size);
180 if (err != 0)
181 goto cleanup_sig;
182
> 183 err = verify_pkcs7_signature(prog->insnsi, prog->len * sizeof(struct bpf_insn),
184 sig, attr->signature_size, VERIFY_USE_SECONDARY_KEYRING,
185 VERIFYING_BPF_SIGNATURE, NULL, NULL);
186 if (err < 0) {
187 err = LSM_INT_VERDICT_BADSIG;
188 goto cleanup_sig;
189 }
190
191 msg = pkcs7_parse_message(sig, attr->signature_size);
192 if (IS_ERR(msg)) {
193 err = LSM_INT_VERDICT_BADSIG;
194 goto cleanup_sig;
195 }
196
> 197 if (validate_pkcs7_trust(msg, VERIFY_USE_SECONDARY_KEYRING)) {
198 err = LSM_INT_VERDICT_PARTIALSIG;
199 goto cleanup_msg;
200 }
201 if (pkcs7_get_authattr(msg, OID_hornet_data,
202 &authattrs, &authattrs_len) == -ENODATA) {
203 err = LSM_INT_VERDICT_PARTIALSIG;
204 goto cleanup_msg;
205 }
206
207 err = asn1_ber_decoder(&hornet_decoder, ctx, authattrs, authattrs_len);
208 if (err < 0 || authattrs == NULL) {
209 err = LSM_INT_VERDICT_PARTIALSIG;
210 goto cleanup_msg;
211 }
212 err = hornet_verify_hashes(&maps, ctx, prog);
213
214 cleanup_msg:
215 pkcs7_free_message(msg);
216 cleanup_sig:
217 kfree(sig);
218 out:
219 kfree(ctx);
220 return err;
221 }
222
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki