* [PATCH] bpf: reject NULL data/sig in bpf_verify_pkcs7_signature
@ 2026-05-19 20:09 KP Singh
2026-05-19 20:36 ` Amery Hung
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: KP Singh @ 2026-05-19 20:09 UTC (permalink / raw)
To: bpf, linux-security-module; +Cc: ast, daniel, Xianrui Dong, KP Singh
__bpf_dynptr_data() can return NULL (FILE dynptrs, any non-contiguous
backing). bpf_verify_pkcs7_signature() forwards the pointer to
verify_pkcs7_signature() unchecked, causing a NULL deref in
asn1_ber_decoder() reachable from a sleepable BPF LSM at lsm.s/bpf.
NULL-check both pointers and reject with -EINVAL. Mirrors the guards
already in kernel/bpf/crypto.c.
Fixes: 865b0566d8f1 ("bpf: Add bpf_verify_pkcs7_signature() kfunc")
Reported-by: Xianrui Dong <dongxianrui1@gmail.com>
Signed-off-by: KP Singh <kpsingh@kernel.org>
---
kernel/bpf/helpers.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 2bb60200c266..b5314c9fed3c 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -4241,8 +4241,13 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p,
data_len = __bpf_dynptr_size(data_ptr);
data = __bpf_dynptr_data(data_ptr, data_len);
+ if (!data)
+ return -EINVAL;
+
sig_len = __bpf_dynptr_size(sig_ptr);
sig = __bpf_dynptr_data(sig_ptr, sig_len);
+ if (!sig)
+ return -EINVAL;
return verify_pkcs7_signature(data, data_len, sig, sig_len,
trusted_keyring->key,
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] bpf: reject NULL data/sig in bpf_verify_pkcs7_signature
2026-05-19 20:09 [PATCH] bpf: reject NULL data/sig in bpf_verify_pkcs7_signature KP Singh
@ 2026-05-19 20:36 ` Amery Hung
2026-05-19 20:54 ` Song Liu
2026-05-19 22:44 ` Daniel Borkmann
2 siblings, 0 replies; 4+ messages in thread
From: Amery Hung @ 2026-05-19 20:36 UTC (permalink / raw)
To: KP Singh; +Cc: bpf, linux-security-module, ast, daniel, Xianrui Dong
On Tue, May 19, 2026 at 1:09 PM KP Singh <kpsingh@kernel.org> wrote:
>
> __bpf_dynptr_data() can return NULL (FILE dynptrs, any non-contiguous
> backing). bpf_verify_pkcs7_signature() forwards the pointer to
> verify_pkcs7_signature() unchecked, causing a NULL deref in
> asn1_ber_decoder() reachable from a sleepable BPF LSM at lsm.s/bpf.
>
> NULL-check both pointers and reject with -EINVAL. Mirrors the guards
> already in kernel/bpf/crypto.c.
>
> Fixes: 865b0566d8f1 ("bpf: Add bpf_verify_pkcs7_signature() kfunc")
> Reported-by: Xianrui Dong <dongxianrui1@gmail.com>
> Signed-off-by: KP Singh <kpsingh@kernel.org>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
> ---
> kernel/bpf/helpers.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 2bb60200c266..b5314c9fed3c 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -4241,8 +4241,13 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p,
>
> data_len = __bpf_dynptr_size(data_ptr);
> data = __bpf_dynptr_data(data_ptr, data_len);
> + if (!data)
> + return -EINVAL;
> +
> sig_len = __bpf_dynptr_size(sig_ptr);
> sig = __bpf_dynptr_data(sig_ptr, sig_len);
> + if (!sig)
> + return -EINVAL;
>
> return verify_pkcs7_signature(data, data_len, sig, sig_len,
> trusted_keyring->key,
> --
> 2.53.0
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] bpf: reject NULL data/sig in bpf_verify_pkcs7_signature
2026-05-19 20:09 [PATCH] bpf: reject NULL data/sig in bpf_verify_pkcs7_signature KP Singh
2026-05-19 20:36 ` Amery Hung
@ 2026-05-19 20:54 ` Song Liu
2026-05-19 22:44 ` Daniel Borkmann
2 siblings, 0 replies; 4+ messages in thread
From: Song Liu @ 2026-05-19 20:54 UTC (permalink / raw)
To: KP Singh; +Cc: bpf, linux-security-module, ast, daniel, Xianrui Dong
On Tue, May 19, 2026 at 1:14 PM KP Singh <kpsingh@kernel.org> wrote:
>
> __bpf_dynptr_data() can return NULL (FILE dynptrs, any non-contiguous
> backing). bpf_verify_pkcs7_signature() forwards the pointer to
> verify_pkcs7_signature() unchecked, causing a NULL deref in
> asn1_ber_decoder() reachable from a sleepable BPF LSM at lsm.s/bpf.
>
> NULL-check both pointers and reject with -EINVAL. Mirrors the guards
> already in kernel/bpf/crypto.c.
>
> Fixes: 865b0566d8f1 ("bpf: Add bpf_verify_pkcs7_signature() kfunc")
> Reported-by: Xianrui Dong <dongxianrui1@gmail.com>
> Signed-off-by: KP Singh <kpsingh@kernel.org>
Acked-by: Song Liu <song@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] bpf: reject NULL data/sig in bpf_verify_pkcs7_signature
2026-05-19 20:09 [PATCH] bpf: reject NULL data/sig in bpf_verify_pkcs7_signature KP Singh
2026-05-19 20:36 ` Amery Hung
2026-05-19 20:54 ` Song Liu
@ 2026-05-19 22:44 ` Daniel Borkmann
2 siblings, 0 replies; 4+ messages in thread
From: Daniel Borkmann @ 2026-05-19 22:44 UTC (permalink / raw)
To: KP Singh, bpf, linux-security-module; +Cc: ast, Xianrui Dong
On 5/19/26 10:09 PM, KP Singh wrote:
> __bpf_dynptr_data() can return NULL (FILE dynptrs, any non-contiguous
> backing). bpf_verify_pkcs7_signature() forwards the pointer to
> verify_pkcs7_signature() unchecked, causing a NULL deref in
> asn1_ber_decoder() reachable from a sleepable BPF LSM at lsm.s/bpf.
>
> NULL-check both pointers and reject with -EINVAL. Mirrors the guards
> already in kernel/bpf/crypto.c.
>
> Fixes: 865b0566d8f1 ("bpf: Add bpf_verify_pkcs7_signature() kfunc")
> Reported-by: Xianrui Dong <dongxianrui1@gmail.com>
> Signed-off-by: KP Singh <kpsingh@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-05-19 22:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-19 20:09 [PATCH] bpf: reject NULL data/sig in bpf_verify_pkcs7_signature KP Singh
2026-05-19 20:36 ` Amery Hung
2026-05-19 20:54 ` Song Liu
2026-05-19 22:44 ` Daniel Borkmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox