On Friday 18 December 2015 00:02:09 David Howells wrote: > The format of ASN.1 GeneralizedTime seems to be specified by ISO 8601 > [X.680 46.3] and this apparently supports leap seconds (ie. the seconds > field is 60). It's not entirely clear that ASN.1 expects it, but we can > relax the seconds check slightly for GeneralizedTime. > > This, however, results in us passing a time with sec as 60 to mktime64() > which, unpatched, doesn't really handle such things. What it will do is > equate the 60th second of a minute to the 0th second of the next minute. > > We can't really do otherwise without giving the kernel much greater > knowledge of where all the leap seconds are. Unfortunately, this would > require change the mapping of the kernel's current-time-in-seconds. > > UTCTime, however, only supports a seconds value in the range 00-59. > > Without this patch, certain X.509 certificates will be rejected, > potentially making a kernel unbootable. > > Reported-by: Rudolf Polzer <rpolzer@xxxxxxxxxx> > Signed-off-by: David Howells <dhowells@xxxxxxxxxx> > cc: David Woodhouse <David.Woodhouse@xxxxxxxxx> > cc: John Stultz <john.stultz@xxxxxxxxxx> > cc: Arnd Bergmann <arnd@xxxxxxxx> > cc: stable@xxxxxxxxxxxxxxx Acked-by: Arnd Bergmann <arnd@xxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html