Hi , On Tue, 12 Jan 2021 at 11:19, Philippe Reynes <philippe.rey...@softathome.com> wrote: > > In the function rsa_verify_hash, if the "main" key doesn't > work, u-boot try others keys. But it searches those keys > in the FIT image instead of the u-boot device tree. > > Signed-off-by: Philippe Reynes <philippe.rey...@softathome.com> > --- > lib/rsa/rsa-verify.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/lib/rsa/rsa-verify.c b/lib/rsa/rsa-verify.c > index 0ab0f629d0..e34d3293d1 100644 > --- a/lib/rsa/rsa-verify.c > +++ b/lib/rsa/rsa-verify.c > @@ -522,10 +522,10 @@ int rsa_verify_hash(struct image_sign_info *info, > return ret; > > /* No luck, so try each of the keys in turn */ > - for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node, > + for (ndepth = 0, noffset = fdt_next_node(blob, sig_node, > &ndepth); > (noffset >= 0) && (ndepth > 0); > - noffset = fdt_next_node(info->fit, noffset, &ndepth)) { > + noffset = fdt_next_node(blob, noffset, &ndepth)) { > if (ndepth == 1 && noffset != node) { > ret = rsa_verify_with_keynode(info, hash, > sig, sig_len,
Reviewed-by: Simon Glass <s...@chromium.org> But I wonder how this is not caught by tests? Can you look into that please? We are obviously missing a test case. - Simon