From 553c623a12f4928a2889cf1bba0bd8885f0bdd4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= Date: Sat, 22 Aug 2026 21:27:04 +0000 Subject: [PATCH] crypto: asymmetric_keys/pkcs7 - Check all signers before waiving authattrs rejection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pkcs7_check_authattrs() only looks at the first SignerInfo when deciding whether rejection of authenticated attributes may be waived. For the remaining signers it checks only that authenticated attributes are either present on all signers or absent from all of them. This means an unmatched ML-DSA signer can be placed first, followed by a trusted RSA, ECDSA, or ECRDSA signer. Verification skips the unmatched signature and accepts the later trusted signer. The first signer still leaves the waiver enabled for the whole message, so the non-ML-DSA signer can use an exception intended only for ML-DSA. Check each SignerInfo's public-key algorithm before leaving the waiver enabled. Fixes: 91db696adea4 ("pkcs7: Allow authenticatedAttributes for ML-DSA") Assisted-by: Codex:gpt-5 Signed-off-by: Jérémy Jean Signed-off-by: Herbert Xu --- crypto/asymmetric_keys/pkcs7_parser.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c index 6e3ffdac83ac..7f00e45a33cf 100644 --- a/crypto/asymmetric_keys/pkcs7_parser.c +++ b/crypto/asymmetric_keys/pkcs7_parser.c @@ -111,6 +111,12 @@ static int pkcs7_check_authattrs(struct pkcs7_message *msg) if (!!sinfo->authattrs != want) goto inconsistent; +#ifdef CONFIG_PKCS7_WAIVE_AUTHATTRS_REJECTION_FOR_MLDSA + if (sinfo->authattrs && + strncmp(sinfo->sig->pkey_algo, "mldsa", 5) != 0) + msg->authattrs_rej_waivable = false; +#endif + if (!sinfo->authattrs && sinfo->sig->algo_takes_data) sinfo->sig->hash_algo = "none";