Eric Biggers 3fc61b8dd6 KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2] ...

commit 624f5ab8720b3371367327a822c267699c1823b8 upstream.

syzkaller reported a NULL pointer dereference in asn1_ber_decoder().  It
can be reproduced by the following command, assuming
CONFIG_PKCS7_TEST_KEY=y:

        keyctl add pkcs7_test desc '' @s

The bug is that if the data buffer is empty, an integer underflow occurs
in the following check:

        if (unlikely(dp >= datalen - 1))
                goto data_overrun_error;

This results in the NULL data pointer being dereferenced.

Fix it by checking for 'datalen - dp < 2' instead.

Also fix the similar check for 'dp >= datalen - n' later in the same
function.  That one possibly could result in a buffer overread.

The NULL pointer dereference was reproducible using the "pkcs7_test" key
type but not the "asymmetric" key type because the "asymmetric" key type
checks for a 0-length payload before calling into the ASN.1 decoder but
the "pkcs7_test" key type does not.

The bug report was:

    BUG: unable to handle kernel NULL pointer dereference at           (null)
    IP: asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233
    PGD 7b708067 P4D 7b708067 PUD 7b6ee067 PMD 0
    Oops: 0000 [#1] SMP
    Modules linked in:
    CPU: 0 PID: 522 Comm: syz-executor1 Not tainted 4.14.0-rc8 #7
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.3-20171021_125229-anatol 04/01/2014
    task: ffff9b6b3798c040 task.stack: ffff9b6b37970000
    RIP: 0010:asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233
    RSP: 0018:ffff9b6b37973c78 EFLAGS: 00010216
    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000021c
    RDX: ffffffff814a04ed RSI: ffffb1524066e000 RDI: ffffffff910759e0
    RBP: ffff9b6b37973d60 R08: 0000000000000001 R09: ffff9b6b3caa4180
    R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
    R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
    FS:  00007f10ed1f2700(0000) GS:ffff9b6b3ea00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000000 CR3: 000000007b6f3000 CR4: 00000000000006f0
    Call Trace:
     pkcs7_parse_message+0xee/0x240 crypto/asymmetric_keys/pkcs7_parser.c:139
     verify_pkcs7_signature+0x33/0x180 certs/system_keyring.c:216
     pkcs7_preparse+0x41/0x70 crypto/asymmetric_keys/pkcs7_key_type.c:63
     key_create_or_update+0x180/0x530 security/keys/key.c:855
     SYSC_add_key security/keys/keyctl.c:122 [inline]
     SyS_add_key+0xbf/0x250 security/keys/keyctl.c:62
     entry_SYSCALL_64_fastpath+0x1f/0xbe
    RIP: 0033:0x4585c9
    RSP: 002b:00007f10ed1f1bd8 EFLAGS: 00000216 ORIG_RAX: 00000000000000f8
    RAX: ffffffffffffffda RBX: 00007f10ed1f2700 RCX: 00000000004585c9
    RDX: 0000000020000000 RSI: 0000000020008ffb RDI: 0000000020008000
    RBP: 0000000000000000 R08: ffffffffffffffff R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000216 R12: 00007fff1b2260ae
    R13: 00007fff1b2260af R14: 00007f10ed1f2700 R15: 0000000000000000
    Code: dd ca ff 48 8b 45 88 48 83 e8 01 4c 39 f0 0f 86 a8 07 00 00 e8 53 dd ca ff 49 8d 46 01 48 89 85 58 ff ff ff 48 8b 85 60 ff ff ff <42> 0f b6 0c 30 89 c8 88 8d 75 ff ff ff 83 e0 1f 89 8d 28 ff ff
    RIP: asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233 RSP: ffff9b6b37973c78
    CR2: 0000000000000000

Fixes: 42d5ec27f873 ("X.509: Add an ASN.1 decoder")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-11-15 17:13:12 +01:00

..

842

crypto: 842 - Add CRC and validation support

2015-10-14 22:23:17 +08:00

fonts

fonts: Add 6x10 font

2014-10-09 11:35:48 +03:00

lz4

lib: lz4: fixed zram with lz4 on big endian machines

2016-05-04 14:48:41 -07:00

lzo

lzo: check for length overrun in variable length encoding.

2014-09-28 11:08:01 +02:00

mpi

mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]

2016-12-02 09:09:01 +01:00

raid6

md/raid6: delta syndrome for ARM NEON

2015-08-31 19:29:05 +02:00

reed_solomon

…

xz

lib/xz: enable all filters by default in Kconfig

2014-06-04 16:54:18 -07:00

zlib_deflate

zlib_deflate/deftree: remove bi_reverse()

2015-09-10 13:29:01 -07:00

zlib_inflate

zlib: clean up some dead code

2014-08-06 18:01:24 -07:00

.gitignore

X.509: Implement simple static OID registry

2012-10-08 13:50:18 +10:30

argv_split.c

argv_split(): teach it to handle mutable strings

2013-04-29 18:28:19 -07:00

asn1_decoder.c

KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2]

2017-11-15 17:13:12 +01:00

assoc_array.c

assoc_array: Fix a buggy node-splitting case

2017-11-02 09:40:49 +01:00

atomic64_test.c

atomic: Add simple atomic_t tests

2015-07-27 14:06:24 +02:00

atomic64.c

atomic: Provide atomic_{or,xor,and}

2015-07-27 14:06:24 +02:00

audit.c

syscalls: implement execveat() system call

2014-12-13 12:42:51 -08:00

bcd.c

usb/core: use bin2bcd() for bcdDevice in RH

2012-09-10 11:13:16 -07:00

bch.c

…

bitmap.c

lib/bitmap.c: bitmap_parselist can accept string with whitespaces on head or tail

2015-09-10 13:29:01 -07:00

bitrev.c

ARM: 8187/1: add CONFIG_HAVE_ARCH_BITREVERSE to support rbit instruction

2014-12-22 16:43:06 +00:00

bsearch.c

…

btree.c

treewide: Remove old email address

2015-11-23 09:44:58 +01:00

bug.c

module: Sanitize RCU usage and locking

2015-05-28 11:31:52 +09:30

build_OID_registry

X.509: do not emit any informational output

2013-06-19 17:54:06 +02:00

bust_spinlocks.c

printk: Provide a wake_up_klogd() off-case

2013-03-22 16:41:20 -07:00

check_signature.c

…

checksum.c

lib/checksum.c: fix build for generic csum_tcpudp_nofold

2015-01-29 11:57:38 -08:00

clz_ctz.c

lib/clz_ctz.c: add prototype declarations in lib/clz_ctz.c

2014-04-03 16:21:12 -07:00

clz_tab.c

…

cmdline.c

lib/cmdline.c: fix get_options() overflow while parsing ranges

2017-06-29 12:48:51 +02:00

compat_audit.c

audit: Add generic compat syscall support

2014-03-20 10:11:35 -04:00

cordic.c

…

cpu_rmap.c

sched/topology: Rename topology_thread_cpumask() to topology_sibling_cpumask()

2015-05-27 15:22:15 +02:00

cpu-notifier-error-inject.c

…

cpumask.c

revert "cpumask: don't perform while loop in cpumask_next_and()"

2015-06-18 17:00:23 -10:00

crc7.c

lib/crc7: Shift crc7() output left 1 bit

2014-05-16 14:26:52 -04:00

crc8.c

…

crc16.c

…

crc32.c

lib: crc32: Add some additional __pure annotations

2014-06-25 16:04:00 -07:00

crc32defs.h

…

crc-ccitt.c

…

crc-itu-t.c

lib: crc-itu-t.[ch] fix 0x0x prefix in integer constants

2015-05-26 15:26:43 +02:00

crc-t10dif.c

lib: introduce crc_t10dif_update()

2015-05-30 22:42:24 -07:00

ctype.c

…

debug_info.c

kbuild: include core debug info when DEBUG_INFO_REDUCED

2015-06-11 15:08:32 +02:00

debug_locks.c

mutex: Add support for wound/wait style locks

2013-06-26 12:10:56 +02:00

debugobjects.c

lib/debugobjects.c: convert printk(KERN_DEBUG to pr_debug

2014-06-04 16:53:53 -07:00

dec_and_lock.c

…

decompress_bunzip2.c

lib/decompressors: use real out buf size for gunzip with kernel

2015-09-10 13:29:01 -07:00

decompress_inflate.c

lib/decompressors: use real out buf size for gunzip with kernel

2015-09-10 13:29:01 -07:00

decompress_unlz4.c

lib/decompressors: use real out buf size for gunzip with kernel

2015-09-10 13:29:01 -07:00

decompress_unlzma.c

lib/decompress_unlzma: Do a NULL check for pointer

2015-09-10 13:29:01 -07:00

decompress_unlzo.c

lib/decompressors: use real out buf size for gunzip with kernel

2015-09-10 13:29:01 -07:00

decompress_unxz.c

lib/decompressors: use real out buf size for gunzip with kernel

2015-09-10 13:29:01 -07:00

decompress.c

lib/decompress: set the compressor name to NULL on error

2015-07-17 16:39:54 -07:00

devres.c

devres: fix a for loop bounds check

2015-10-05 04:49:54 +01:00

digsig.c

lib/digsig: fix dereference of NULL user_key_payload

2017-10-27 10:23:17 +02:00

div64.c

remove abs64()

2015-11-09 15:11:24 -08:00

dma-debug.c

dma-debug: avoid spinlock recursion when disabling dma-debug

2016-06-07 18:14:37 -07:00

dump_stack.c

dump_stack: avoid potential deadlocks

2016-02-25 12:01:23 -08:00

dynamic_debug.c

lib/dynamic_debug.c: use kstrdup_const

2015-11-06 17:50:42 -08:00

dynamic_queue_limits.c

lib/dynamic_queue_limits.c: simplify includes

2015-02-12 18:54:15 -08:00

earlycpio.c

earlycpio.c: Fix the confusing comment of find_cpio_data().

2013-08-14 23:24:01 +02:00

extable.c

…

fault-inject.c

fault-inject: fix inverted interval/probability values in printk

2015-10-23 17:55:10 +09:00

fdt_empty_tree.c

lib: add fdt_empty_tree.c

2014-04-30 19:49:37 +01:00

fdt_ro.c

…

fdt_rw.c

…

fdt_strerror.c

…

fdt_sw.c

…

fdt_wip.c

…

fdt.c

…

find_bit.c

lib: rename lib/find_next_bit.c to lib/find_bit.c

2015-04-17 09:03:54 -04:00

flex_array.c

reciprocal_divide: update/correction of the algorithm

2014-01-21 23:17:20 -08:00

flex_proportions.c

proportions: add @gfp to init functions

2014-09-08 09:51:30 +09:00

gcd.c

lib/gcd.c: prevent possible div by 0

2012-10-06 03:04:57 +09:00

gen_crc32table.c

lib: crc32: constify crc32 lookup table

2015-02-13 21:21:35 -08:00

genalloc.c

lib/genalloc.c: start search from start of chunk

2016-11-18 10:48:36 +01:00

glob.c

lib/glob.c: add CONFIG_GLOB_SELFTEST

2014-08-06 18:01:25 -07:00

halfmd4.c

lib/halfmd4.c: use rol32 inline function in the ROUND macro

2015-11-06 17:50:42 -08:00

hexdump.c

lib/hexdump.c: truncate output in case of overflow

2015-11-06 17:50:42 -08:00

hweight.c

Make ARCH_HAS_FAST_MULTIPLIER a real config variable

2014-09-13 11:14:53 -07:00

idr.c

mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd

2015-11-06 17:50:42 -08:00

inflate.c

…

int_sqrt.c

lib/int_sqrt.c: optimize square root algorithm

2013-04-29 18:28:19 -07:00

interval_tree_test.c

lib: Export interval_tree

2014-05-05 09:09:14 +02:00

interval_tree.c

lib/interval_tree.c: simplify includes

2015-02-12 18:54:15 -08:00

iomap_copy.c

…

iomap.c

Kconfig: rename HAS_IOPORT to HAS_IOPORT_MAP

2014-04-07 16:36:11 -07:00

iommu-common.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc

2015-11-05 16:34:48 -08:00

iommu-helper.c

…

ioremap.c

x86, mm: support huge KVA mappings on x86

2015-04-14 16:49:04 -07:00

iov_iter.c

fix iov_iter_fault_in_readable()

2016-09-24 10:07:43 +02:00

irq_regs.c

…

is_single_threaded.c

lib/is_single_threaded.c: change current_is_single_threaded() to use for_each_thread()

2015-11-06 17:50:42 -08:00

jedec_ddr_data.c

…

kasprintf.c

lib/kasprintf.c: introduce kvasprintf_const

2015-11-06 17:50:42 -08:00

Kconfig

lib: sw842: select crc32

2016-03-03 15:07:24 -08:00

Kconfig.debug

lib/Kconfig.debug: fix frv build failure

2017-08-11 09:08:59 -07:00

Kconfig.kasan

mm, slub, kasan: enable user tracking by default with KASAN=y

2015-11-05 19:34:48 -08:00

Kconfig.kgdb

kdb: Allow access to sensitive commands to be restricted by default

2014-11-11 09:31:52 -06:00

Kconfig.kmemcheck

…

kfifo.c

kfifo: use BUG_ON

2014-08-08 15:57:25 -07:00

klist.c

klist: fix starting point removed bug in klist iterators

2016-02-25 12:01:16 -08:00

kobject_uevent.c

lib/kobject_uevent.c: remove redundant include

2015-02-12 18:54:15 -08:00

kobject.c

lib/kobject.c: use kvasprintf_const for formatting ->name

2015-11-06 17:50:42 -08:00

kstrtox.c

lib: add "on"/"off" support to kstrtobool

2016-10-28 03:01:31 -04:00

kstrtox.h

…

lcm.c

block: fix blk_stack_limits() regression due to lcm() change

2015-03-31 09:45:50 -06:00

libcrc32c.c

crypto: crc32c - Fix crc32c soft dependency

2016-02-17 12:31:04 -08:00

list_debug.c

…

list_sort.c

lib/list_sort: use late_initcall to hook in self tests

2015-06-16 14:12:35 -04:00

llist.c

lib/llist.c: fix data race in llist_del_first

2015-11-06 17:50:42 -08:00

locking-selftest-hardirq.h

…

locking-selftest-mutex.h

…

locking-selftest-rlock-hardirq.h

…

locking-selftest-rlock-softirq.h

…

locking-selftest-rlock.h

…

locking-selftest-rsem.h

…

locking-selftest-softirq.h

…

locking-selftest-spin-hardirq.h

…

locking-selftest-spin-softirq.h

…

locking-selftest-spin.h

…

locking-selftest-wlock-hardirq.h

…

locking-selftest-wlock-softirq.h

…

locking-selftest-wlock.h

…

locking-selftest-wsem.h

…

locking-selftest.c

locking/lockdep: Revert qrwlock recusive stuff

2014-10-03 06:09:30 +02:00

lockref.c

locking/lockref: Remove homebrew cmpxchg64_relaxed() macro definition

2015-08-12 11:59:04 +02:00

lru_cache.c

lru_cache: remove use of seq_printf return value

2015-04-15 16:35:25 -07:00

Makefile

test_printf: test printf family at runtime

2015-11-06 17:50:42 -08:00

md5.c

lib/md5.c: simplify include

2015-02-12 18:54:15 -08:00

memory-notifier-error-inject.c

memory: memory notifier error injection module

2012-07-30 17:25:22 -07:00

memweight.c

…

net_utils.c

mac_pton: Use bool not int return

2014-06-25 17:45:43 -07:00

nlattr.c

netlink: pad nla_memcpy dest buffer with zeroes

2015-03-31 14:07:24 -04:00

nmi_backtrace.c

ARM: 8439/1: Fix backtrace generation when IPI is masked

2015-10-03 16:40:51 +01:00

notifier-error-inject.c

mode_t, whack-a-mole at 11...

2013-04-09 14:13:05 -04:00

notifier-error-inject.h

…

of-reconfig-notifier-error-inject.c

powerpc+of: Rename and fix OF reconfig notifier error inject module

2012-12-14 10:32:52 +11:00

oid_registry.c

Give the OID registry file module info to avoid kernel tainting

2013-05-05 14:38:00 -07:00

once.c

once: make helper generic for calling functions once

2015-10-08 05:26:36 -07:00

parser.c

lib/parser.c: put EXPORT_SYMBOLs in the conventional place

2014-01-23 16:36:55 -08:00

pci_iomap.c

libnvdimm for 4.3:

2015-09-08 14:35:59 -07:00

percpu_counter.c

percpu_counter: batch size aware __percpu_counter_compare()

2015-05-29 07:39:34 +10:00

percpu_ida.c

mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM

2015-11-06 17:50:42 -08:00

percpu_test.c

percpu: add test module for various percpu operations

2013-11-13 12:09:11 +09:00

percpu-refcount.c

percpu_ref: make INIT_ATOMIC and switch_to_atomic() sticky

2014-09-24 13:31:50 -04:00

plist.c

lib/plist.c: remove redundant include

2015-02-12 18:54:16 -08:00

pm-notifier-error-inject.c

…

proportions.c

treewide: Remove old email address

2015-11-23 09:44:58 +01:00

radix-tree.c

radix-tree: fix race in gang lookup

2016-02-25 12:01:23 -08:00

random32.c

random32: add prandom_init_once helper for own rngs

2015-10-08 05:26:38 -07:00

ratelimit.c

…

rational.c

…

rbtree_test.c

rbtree/test: test rbtree_postorder_for_each_entry_safe()

2014-01-23 16:37:03 -08:00

rbtree.c

rbtree: Make lockless searches non-fatal

2015-05-28 11:32:04 +09:30

reciprocal_div.c

reciprocal_divide: update/correction of the algorithm

2014-01-21 23:17:20 -08:00

rhashtable.c

rhashtable: Kill harmless RCU warning in rhashtable_walk_init

2015-12-18 23:44:18 -05:00

scatterlist.c

scatterlist: allow limited chaining without ARCH_HAS_SG_CHAIN

2015-08-17 08:12:51 -06:00

seq_buf.c

seq_buf: Fix seq_buf_bprintf() truncation

2015-03-04 23:40:19 -05:00

sg_split.c

lib: scatterlist: add sg splitting function

2015-08-24 14:28:01 -06:00

sha1.c

lib: EXPORT_SYMBOL sha_init

2015-03-23 22:12:08 -04:00

show_mem.c

lib/show_mem.c: correct reserved memory calculation

2015-09-08 15:35:28 -07:00

smp_processor_id.c

percpu: add preemption checks to __this_cpu ops

2014-04-07 16:36:14 -07:00

sort.c

lib/sort: Add 64 bit swap function

2015-06-25 17:00:40 -07:00

stmp_device.c

lib/stmp_device.c: replace module.h include

2015-02-12 18:54:16 -08:00

string_helpers.c

string_helpers: fix precision loss for some inputs

2016-02-25 12:01:21 -08:00

string.c

lib: move strtobool() to kstrtobool()

2016-10-28 03:01:30 -04:00

strncpy_from_user.c

lib: move strncpy_from_unsafe() into mm/maccess.c

2015-08-31 12:36:10 -07:00

strnlen_user.c

Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2015-06-22 15:52:04 -07:00

swiotlb.c

swiotlb: ensure that page-sized mappings are page-aligned

2017-07-05 14:37:20 +02:00

syscall.c

lib/syscall.c: unexport task_current_syscall()

2014-04-03 16:21:06 -07:00

test_bpf.c

bpf, arm64: fix jit branch offset related to ldimm64

2017-05-14 13:32:58 +02:00

test_firmware.c

test: add firmware_class loader test

2014-07-17 18:44:19 -07:00

test_kasan.c

lib: test_kasan: add some testcases

2015-11-05 19:34:48 -08:00

test_module.c

test: add minimal module for verification testing

2014-01-23 16:36:57 -08:00

test_printf.c

test_printf: test printf family at runtime

2015-11-06 17:50:42 -08:00

test_rhashtable.c

rhashtable-test: extend to test concurrency

2015-08-17 14:33:47 -07:00

test_static_key_base.c

locking/static_keys: Provide a selftest

2015-08-03 11:51:12 +02:00

test_static_keys.c

locking/static_keys: Make verify_keys() static

2015-08-05 09:53:40 +02:00

test_user_copy.c

usercopy: Adjust tests to deal with SMAP/PAN

2017-06-14 13:16:27 +02:00

test-hexdump.c

hexdump: Make test data really const

2015-06-25 17:00:40 -07:00

test-kstrtox.c

kstrto*: accept "-0" for signed conversion

2015-09-10 13:29:01 -07:00

test-string_helpers.c

lib/test-string_helpers.c: fix and improve string_get_size() tests

2016-05-11 11:21:26 +02:00

textsearch.c

lib/textsearch.c: remove textsearch_put reference from comments

2014-10-14 02:18:14 +02:00

timerqueue.c

timerqueue: Let timerqueue_add/del return information

2015-04-22 17:06:49 +02:00

ts_bm.c

…

ts_fsm.c

…

ts_kmp.c

…

ucs2_string.c

lib/ucs2_string: Correct ucs2 -> utf8 conversion

2016-03-03 15:07:09 -08:00

usercopy.c

Kconfig: consolidate CONFIG_DEBUG_STRICT_USER_COPY_CHECKS

2013-04-30 17:04:09 -07:00

uuid.c

uuid: use prandom_bytes()

2013-04-29 18:28:42 -07:00

vsprintf.c

lib/vsprintf.c: update documentation

2015-11-06 17:50:42 -08:00