From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Andrey Ryabinin <aryabinin@virtuozzo.com>,
David Howells <dhowells@redhat.com>,
James Morris <james.l.morris@oracle.com>
Subject: [PATCH 4.8 29/37] X.509: Fix double free in x509_cert_parse() [ver #3]
Date: Wed, 30 Nov 2016 10:30:06 +0100 [thread overview]
Message-ID: <20161130092731.076331236@linuxfoundation.org> (raw)
In-Reply-To: <20161130092729.623248210@linuxfoundation.org>
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
commit 2b95fda2c4fcb6d6625963f889247538f247fce0 upstream.
We shouldn't free cert->pub->key in x509_cert_parse() because
x509_free_certificate() also does this:
BUG: Double free or freeing an invalid pointer
...
Call Trace:
[<ffffffff81896c20>] dump_stack+0x63/0x83
[<ffffffff81356571>] kasan_object_err+0x21/0x70
[<ffffffff81356ed9>] kasan_report_double_free+0x49/0x60
[<ffffffff813561ad>] kasan_slab_free+0x9d/0xc0
[<ffffffff81350b7a>] kfree+0x8a/0x1a0
[<ffffffff81844fbf>] public_key_free+0x1f/0x30
[<ffffffff818455d4>] x509_free_certificate+0x24/0x90
[<ffffffff818460bc>] x509_cert_parse+0x2bc/0x300
[<ffffffff81846cae>] x509_key_preparse+0x3e/0x330
[<ffffffff818444cf>] asymmetric_key_preparse+0x6f/0x100
[<ffffffff8178bec0>] key_create_or_update+0x260/0x5f0
[<ffffffff8178e6d9>] SyS_add_key+0x199/0x2a0
[<ffffffff821d823b>] entry_SYSCALL_64_fastpath+0x1e/0xad
Object at ffff880110bd1900, in cache kmalloc-512 size: 512
....
Freed:
PID = 2579
[<ffffffff8104283b>] save_stack_trace+0x1b/0x20
[<ffffffff813558f6>] save_stack+0x46/0xd0
[<ffffffff81356183>] kasan_slab_free+0x73/0xc0
[<ffffffff81350b7a>] kfree+0x8a/0x1a0
[<ffffffff818460a3>] x509_cert_parse+0x2a3/0x300
[<ffffffff81846cae>] x509_key_preparse+0x3e/0x330
[<ffffffff818444cf>] asymmetric_key_preparse+0x6f/0x100
[<ffffffff8178bec0>] key_create_or_update+0x260/0x5f0
[<ffffffff8178e6d9>] SyS_add_key+0x199/0x2a0
[<ffffffff821d823b>] entry_SYSCALL_64_fastpath+0x1e/0xad
Fixes: db6c43bd2132 ("crypto: KEYS: convert public key and digsig asym to the akcipher api")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/asymmetric_keys/x509_cert_parser.c | 1 -
1 file changed, 1 deletion(-)
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -133,7 +133,6 @@ struct x509_certificate *x509_cert_parse
return cert;
error_decode:
- kfree(cert->pub->key);
kfree(ctx);
error_no_ctx:
x509_free_certificate(cert);
next prev parent reply other threads:[~2016-11-30 9:55 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20161130093010epcas2p3047cf63814e74dfcc79f43d37b446ae0@epcas2p3.samsung.com>
2016-11-30 9:29 ` [PATCH 4.8 00/37] 4.8.12-stable review Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 07/37] usb: chipidea: move the lock initialization to core file Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 08/37] USB: serial: cp210x: add ID for the Zone DPMX Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 09/37] USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 10/37] Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 11/37] scsi: mpt3sas: Fix secure erase premature termination Greg Kroah-Hartman
2016-11-30 16:49 ` Martin K. Petersen
2016-12-01 7:10 ` Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 12/37] tile: avoid using clocksource_cyc2ns with absolute cycle count Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 13/37] cfg80211: limit scan results cache size Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 15/37] drm/radeon: fix power state when port pm is unavailable (v2) Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 16/37] apparmor: fix change_hat not finding hat after policy replacement Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 17/37] NFSv4.x: hide array-bounds warning Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 18/37] x86/fpu: Fix invalid FPU ptrace state after execve() Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 19/37] x86/traps: Ignore high word of regs->cs in early_fixup_exception() Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 20/37] perf/core: Fix address filter parser Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 21/37] perf/x86/intel: Cure bogus unwind from PEBS entries Greg Kroah-Hartman
2016-11-30 9:29 ` [PATCH 4.8 22/37] thermal/powerclamp: add back module device table Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 23/37] parisc: Fix races in parisc_setup_cache_timing() Greg Kroah-Hartman
2016-11-30 9:30 ` Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 24/37] parisc: Switch to generic sched_clock implementation Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 25/37] parisc: Fix race in pci-dma.c Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 26/37] parisc: Also flush data TLB in flush_icache_page_asm Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 27/37] mmc: sdhci-of-esdhc: fixup PRESENT_STATE read Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 28/37] mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] Greg Kroah-Hartman
2016-11-30 9:30 ` Greg Kroah-Hartman [this message]
2016-11-30 9:30 ` [PATCH 4.8 30/37] xc2028: Fix use-after-free bug properly Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 31/37] device-dax: check devm_nsio_enable() return value Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 32/37] device-dax: fail all private mapping attempts Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 33/37] powerpc: Set missing wakeup bit in LPCR on POWER9 Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 34/37] powerpc/mm: Fixup kernel read only mapping Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 35/37] powerpc/boot: Fix the early OPAL console wrappers Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 36/37] can: bcm: fix support for CAN FD frames Greg Kroah-Hartman
2016-11-30 9:30 ` [PATCH 4.8 37/37] mm, oom: stop pre-mature high-order OOM killer invocations Greg Kroah-Hartman
[not found] ` <20161130092730.460938123@linuxfoundation.org>
2016-11-30 10:51 ` [PATCH 4.8 14/37] drm/amdgpu: fix power state when port pm is unavailable Peter Wu
2016-11-30 10:51 ` Peter Wu
2016-11-30 11:53 ` Greg Kroah-Hartman
2016-12-05 0:11 ` Peter Wu
2016-12-05 14:46 ` Greg Kroah-Hartman
2016-11-30 16:04 ` [PATCH 4.8 00/37] 4.8.12-stable review Shuah Khan
2016-12-01 7:14 ` Greg Kroah-Hartman
2016-11-30 23:34 ` Guenter Roeck
2016-12-01 7:15 ` Greg Kroah-Hartman
[not found] ` <583ed167.6602c20a.c3129.a6b8@mx.google.com>
[not found] ` <m2oa0wkjlk.fsf@baylibre.com>
2016-12-01 7:11 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161130092731.076331236@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=aryabinin@virtuozzo.com \
--cc=dhowells@redhat.com \
--cc=james.l.morris@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.