Eric Biggers a77cf1b983 lib/digsig: fix dereference of NULL user_key_payload ...

commit 192cabd6a296cbc57b3d8c05c4c89d87fc102506 upstream.

digsig_verify() requests a user key, then accesses its payload.
However, a revoked key has a NULL payload, and we failed to check for
this.  request_key() *does* skip revoked keys, but there is still a
window where the key can be revoked before we acquire its semaphore.

Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.

Fixes: 051dbb918c ("crypto: digital signature verification support")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: <stable@vger.kernel.org>    [v3.3+]
Cc: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>

2017-11-02 07:16:18 +01:00

..

lzo

lzo: check for length overrun in variable length encoding.

2014-10-30 09:35:11 -07:00

mpi

mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]

2017-02-10 11:04:07 +01:00

raid6

lib/raid6: build proper files on corresponding arch

2012-12-13 19:51:04 +11:00

reed_solomon

…

xz

decompressors: fix typo "POWERPC"

2013-03-13 15:21:48 -07:00

zlib_deflate

zlib: slim down zlib_deflate() workspace when possible

2011-03-22 17:44:17 -07:00

zlib_inflate

…

.gitignore

X.509: Implement simple static OID registry

2012-10-08 13:50:18 +10:30

argv_split.c

argv_split(): teach it to handle mutable strings

2013-04-29 18:28:19 -07:00

asn1_decoder.c

Merge tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

2012-12-19 07:55:08 -08:00

atomic64_test.c

atomic64_test: simplify the #ifdef for atomic64_dec_if_positive() test

2012-07-30 17:25:16 -07:00

atomic64.c

lib: atomic64: Initialize locks statically to fix early users

2012-12-20 13:50:16 -08:00

audit.c

audit: support the "standard" <asm-generic/unistd.h>

2011-05-04 14:41:28 -04:00

average.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

bcd.c

usb/core: use bin2bcd() for bcdDevice in RH

2012-09-10 11:13:16 -07:00

bch.c

lib: add shared BCH ECC library

2011-03-11 14:25:50 +00:00

bitmap.c

__bitmap_parselist: fix bug in empty string handling

2015-08-03 09:29:46 -07:00

bitrev.c

…

bsearch.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

btree.c

lib/btree.c: fix leak of whole btree nodes

2014-08-07 14:30:27 -07:00

bug.c

taint: add explicit flag to show whether lock dep is still OK.

2013-01-21 17:17:57 +10:30

build_OID_registry

X.509: Implement simple static OID registry

2012-10-08 13:50:18 +10:30

bust_spinlocks.c

printk: Provide a wake_up_klogd() off-case

2013-03-22 16:41:20 -07:00

check_signature.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

checksum.c

lib/checksum.c: fix build for generic csum_tcpudp_nofold

2015-02-11 14:48:17 +08:00

clz_tab.c

lib: Fix multiple definitions of clz_tab

2012-02-02 10:34:23 +11:00

cmdline.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

cordic.c

Docs: wording: functions -> algorithm

2011-10-29 21:20:22 +02:00

cpu_rmap.c

lib: cpu_rmap: avoid flushing all workqueues

2013-01-11 14:54:54 -08:00

cpu-notifier-error-inject.c

cpu: rewrite cpu-notifier-error-inject module

2012-07-30 17:25:22 -07:00

cpumask.c

bootmem: fix wrong call parameter for free_bootmem()

2012-12-11 17:22:28 -08:00

crc7.c

…

crc8.c

lib: crc8: add new library module providing crc8 algorithm

2011-06-03 15:01:06 -04:00

crc16.c

…

crc32.c

sections: fix const sections for crc32 table

2012-10-06 03:04:46 +09:00

crc32defs.h

crc32: select an algorithm via Kconfig

2012-03-23 16:58:38 -07:00

crc-ccitt.c

…

crc-itu-t.c

…

crc-t10dif.c

…

ctype.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

debug_locks.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

debugobjects.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

dec_and_lock.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

decompress_bunzip2.c

decompress_bunzip2: off by one in get_next_block()

2015-01-27 07:52:33 -08:00

decompress_inflate.c

lib/decompressors: fix "no limit" output buffer length

2014-02-06 11:08:12 -08:00

decompress_unlzma.c

treewide: Fix comment and string typo 'bufer'

2011-12-06 09:53:40 +01:00

decompress_unlzo.c

lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c

2013-02-20 19:36:00 +01:00

decompress_unxz.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

decompress.c

lib/decompress.c: fix initconst

2013-04-30 17:04:09 -07:00

devres.c

devres: fix a for loop bounds check

2016-03-03 15:06:20 -08:00

digsig.c

lib/digsig: fix dereference of NULL user_key_payload

2017-11-02 07:16:18 +01:00

div64.c

Revert "math64: New div64_u64_rem helper"

2013-04-30 19:13:05 +02:00

dma-debug.c

dma-debug: avoid spinlock recursion when disabling dma-debug

2016-08-21 23:22:50 +02:00

dump_stack.c

dump_stack: consolidate dump_stack() implementations and unify their behaviors

2013-04-30 17:04:02 -07:00

dynamic_debug.c

dynamic_debug: reuse generic string_unescape function

2013-04-30 17:04:03 -07:00

dynamic_queue_limits.c

bql: Avoid possible inconsistent calculation.

2012-05-31 18:18:17 -04:00

earlycpio.c

lib: Add early cpio decoder

2012-09-30 18:02:20 -07:00

extable.c

…

fault-inject.c

lib/: rename random32() to prandom_u32()

2013-04-29 18:28:42 -07:00

fdt_ro.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt_rw.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt_strerror.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt_sw.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt_wip.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

fdt.c

of/lib: Allow scripts/dtc/libfdt to be used from kernel code

2012-07-23 13:54:52 +01:00

find_last_bit.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

find_next_bit.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

flex_array.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

flex_proportions.c

lib/flex_proportions.c: fix corruption of denominator in flexible proportions

2012-09-25 08:59:21 -07:00

gcd.c

lib/gcd.c: prevent possible div by 0

2012-10-06 03:04:57 +09:00

gen_crc32table.c

sections: fix const sections for crc32 table

2012-10-06 03:04:46 +09:00

genalloc.c

lib/genalloc.c: start search from start of chunk

2017-02-10 11:03:59 +01:00

halfmd4.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

hexdump.c

dynamic_debug: dynamic hex dump

2013-01-17 12:19:09 -08:00

hweight.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

idr.c

idr: fix overflow bug during maximum ID calculation at maximum height

2014-06-30 20:09:42 -07:00

inflate.c

MN10300: Don't try and #include <linux/slab.h> in lib/inflate.c from bootloader

2010-08-12 09:51:35 -07:00

int_sqrt.c

lib/int_sqrt.c: optimize square root algorithm

2013-04-29 18:28:19 -07:00

interval_tree_test_main.c

random32: rename random32 to prandom

2012-12-17 17:15:26 -08:00

interval_tree.c

mm: interval tree updates

2012-10-09 16:22:40 +09:00

iomap_copy.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

iomap.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

iommu-helper.c

Merge tag 'module-for-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2012-03-24 10:24:31 -07:00

ioremap.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

iovec.c

Hoist memcpy_fromiovec/memcpy_toiovec into lib/

2013-05-20 10:24:22 +09:30

irq_regs.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

is_single_threaded.c

…

jedec_ddr_data.c

ddr: add LPDDR2 data from JESD209-2

2012-05-02 00:04:06 -07:00

kasprintf.c

lib/kasprintf.c: use kmalloc_track_caller() to get accurate traces for kvasprintf

2012-10-11 08:50:15 +09:00

Kconfig

Move utf16 functions to kernel core and rename

2013-04-15 21:23:03 +01:00

Kconfig.debug

lib/Kconfig.debug: Restrict FRAME_POINTER for MIPS

2013-07-28 16:30:12 -07:00

Kconfig.kgdb

Merge tag 'for_linux-3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/kgdb

2013-03-02 08:31:39 -08:00

Kconfig.kmemcheck

…

kfifo.c

kfifo: fix kfifo_alloc() and kfifo_init()

2013-02-27 19:10:23 -08:00

klist.c

klist: fix starting point removed bug in klist iterators

2016-02-25 11:57:47 -08:00

kobject_uevent.c

netlink: hide struct module parameter in netlink_kernel_create

2012-09-08 18:46:30 -04:00

kobject.c

kref: minor cleanup

2013-05-07 16:09:00 -07:00

kstrtox.c

kstrto*: add documentation

2012-12-17 17:15:22 -08:00

kstrtox.h

lib/kstrtox: common code between kstrto*() and simple_strto*() functions

2011-10-31 17:30:56 -07:00

lcm.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

libcrc32c.c

…

list_debug.c

rcu: Fix broken strings in RCU's source code.

2012-07-06 06:01:49 -07:00

list_sort.c

lib/: rename random32() to prandom_u32()

2013-04-29 18:28:42 -07:00

llist.c

Merge tag 'split-asm_system_h-for-linus-20120328' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-asm_system

2012-03-28 15:58:21 -07:00

locking-selftest-hardirq.h

…

locking-selftest-mutex.h

…

locking-selftest-rlock-hardirq.h

…

locking-selftest-rlock-softirq.h

…

locking-selftest-rlock.h

…

locking-selftest-rsem.h

…

locking-selftest-softirq.h

…

locking-selftest-spin-hardirq.h

…

locking-selftest-spin-softirq.h

…

locking-selftest-spin.h

…

locking-selftest-wlock-hardirq.h

…

locking-selftest-wlock-softirq.h

…

locking-selftest-wlock.h

…

locking-selftest-wsem.h

…

locking-selftest.c

lockdep: Selftest: convert spinlock to raw spinlock

2013-02-19 08:43:35 +01:00

lru_cache.c

lru_cache: introduce lc_get_cumulative()

2013-03-22 22:17:36 -06:00

Makefile

x86, hweight: Fix BUG when booting with CONFIG_GCOV_PROFILE_ALL=y

2014-02-20 11:06:11 -08:00

md5.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

memory-notifier-error-inject.c

memory: memory notifier error injection module

2012-07-30 17:25:22 -07:00

memweight.c

string: introduce memweight()

2012-07-30 17:25:16 -07:00

nlattr.c

netlink: rate-limit leftover bytes warning and print process name

2014-06-26 15:12:37 -04:00

notifier-error-inject.c

mode_t, whack-a-mole at 11...

2013-04-09 14:13:05 -04:00

notifier-error-inject.h

fault-injection: notifier error injection

2012-07-30 17:25:22 -07:00

of-reconfig-notifier-error-inject.c

powerpc+of: Rename and fix OF reconfig notifier error inject module

2012-12-14 10:32:52 +11:00

oid_registry.c

Give the OID registry file module info to avoid kernel tainting

2013-05-05 14:38:00 -07:00

parser.c

lib/parser.c: fix up comments for valid return values from match_number

2013-02-21 17:22:25 -08:00

pci_iomap.c

lib: add NO_GENERIC_PCI_IOPORT_MAP

2012-01-31 23:19:47 +02:00

percpu_counter.c

switch the protection of percpu_counter list to spinlock

2012-07-31 09:28:31 +04:00

percpu-rwsem.c

percpu_rw_semaphore: add lockdep annotations

2012-12-17 17:15:18 -08:00

plist.c

lib/plist.c: make plist test announcements KERN_DEBUG

2012-10-06 03:04:58 +09:00

pm-notifier-error-inject.c

PM: PM notifier error injection module

2012-07-30 17:25:22 -07:00

prio_heap.c

…

proportions.c

locking, lib/proportions: Annotate prop_local_percpu::lock as raw

2011-09-13 11:11:50 +02:00

radix-tree.c

radix-tree: fix race in gang lookup

2016-02-25 11:57:49 -08:00

random32.c

random32: fix off-by-one in seeding requirement

2013-12-08 07:29:24 -08:00

ratelimit.c

ratelimit: fix bug in time interval by resetting right begin time

2017-02-10 11:04:00 +01:00

rational.c

lib: Change mail address of Oskar Schirmer

2012-05-17 15:18:37 +02:00

rbtree_test.c

rbtree_test: add __init/__exit annotations

2013-04-30 17:04:07 -07:00

rbtree.c

lib/rbtree.c: avoid the use of non-static __always_inline

2013-01-11 14:54:56 -08:00

reciprocal_div.c

sch_red: Adaptative RED AQM

2011-12-08 19:52:43 -05:00

rwsem-spinlock.c

rwsem: simplify __rwsem_do_wake

2013-05-07 07:20:16 -07:00

rwsem.c

rwsem: check counter to avoid cmpxchg calls

2013-05-07 16:11:51 -07:00

scatterlist.c

lib/scatterlist.c: don't flush_kernel_dcache_page on slab page

2013-11-13 12:05:33 +09:00

sha1.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

show_mem.c

mm, show_mem: suppress page counts in non-blockable contexts

2013-04-29 15:54:28 -07:00

smp_processor_id.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

sort.c

…

spinlock_debug.c

lib/spinlock_debug: avoid livelock in do_raw_spin_lock()

2012-10-06 03:04:57 +09:00

stmp_device.c

lib: add support for stmp-style devices

2012-04-20 23:27:08 +02:00

string_helpers.c

lib/string_helpers: introduce generic string_unescape

2013-04-30 17:04:03 -07:00

string.c

lib: memzero_explicit: use barrier instead of OPTIMIZER_HIDE_VAR

2015-05-06 21:56:28 +02:00

strncpy_from_user.c

word-at-a-time: make the interfaces truly generic

2012-05-26 11:33:40 -07:00

strnlen_user.c

lib: Fix strnlen_user() to not touch memory after specified maximum

2015-06-05 23:19:54 -07:00

swiotlb.c

x86, kdump: Set crashkernel_low automatically

2013-04-17 12:35:32 -07:00

syscall.c

lib: reduce the use of module.h wherever possible

2012-03-07 15:04:04 -05:00

test-kstrtox.c

lib/test-kstrtox.c: mark const init data with __initconst instead of __initdata

2012-05-29 16:22:32 -07:00

test-string_helpers.c

lib/string_helpers: introduce generic string_unescape

2013-04-30 17:04:03 -07:00

textsearch.c

textsearch: doc - fix spelling in lib/textsearch.c.

2011-01-24 23:33:30 -08:00

timerqueue.c

Merge tag 'module-for-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2012-03-24 10:24:31 -07:00

ts_bm.c

…

ts_fsm.c

…

ts_kmp.c

…

ucs2_string.c

lib/ucs2_string: Correct ucs2 -> utf8 conversion

2016-03-16 08:41:37 -07:00

usercopy.c

Kconfig: consolidate CONFIG_DEBUG_STRICT_USER_COPY_CHECKS

2013-04-30 17:04:09 -07:00

uuid.c

uuid: use prandom_bytes()

2013-04-29 18:28:42 -07:00

vsprintf.c

vsprintf: check real user/group id for %pK

2013-12-04 10:56:06 -08:00