Eric Biggers 1471d12589 ASN.1: check for error from ASN1_OP_END__ACT actions ... commit 81a7be2cd69b412ab6aeacfe5ebf1bb6e5bce955 upstream. asn1_ber_decoder() was ignoring errors from actions associated with the opcodes ASN1_OP_END_SEQ_ACT, ASN1_OP_END_SET_ACT, ASN1_OP_END_SEQ_OF_ACT, and ASN1_OP_END_SET_OF_ACT. In practice, this meant the pkcs7_note_signed_info() action (since that was the only user of those opcodes). Fix it by checking for the error, just like the decoder does for actions associated with the other opcodes. This bug allowed users to leak slab memory by repeatedly trying to add a specially crafted "pkcs7_test" key (requires CONFIG_PKCS7_TEST_KEY). In theory, this bug could also be used to bypass module signature verification, by providing a PKCS#7 message that is misparsed such that a signature's ->authattrs do not contain its ->msgdigest. But it doesn't seem practical in normal cases, due to restrictions on the format of the ->authattrs. Fixes: 42d5ec27f8 ("X.509: Add an ASN.1 decoder") Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-12-16 10:33:48 +01:00
..
842	crypto: 842 - Add CRC and validation support	2015-10-14 22:23:17 +08:00
fonts
lz4	lib: lz4: fixed zram with lz4 on big endian machines	2016-05-04 14:48:41 -07:00
lzo
mpi	lib/mpi: call cond_resched() from mpi_powm() loop	2017-11-30 08:37:19 +00:00
raid6	md/raid6: delta syndrome for ARM NEON	2015-08-31 19:29:05 +02:00
reed_solomon
xz
zlib_deflate	zlib_deflate/deftree: remove bi_reverse()	2015-09-10 13:29:01 -07:00
zlib_inflate
.gitignore
argv_split.c
asn1_decoder.c	ASN.1: check for error from ASN1_OP_END__ACT actions	2017-12-16 10:33:48 +01:00
assoc_array.c	assoc_array: Fix a buggy node-splitting case	2017-11-02 09:40:49 +01:00
atomic64_test.c	atomic: Add simple atomic_t tests	2015-07-27 14:06:24 +02:00
atomic64.c	atomic: Provide atomic_{or,xor,and}	2015-07-27 14:06:24 +02:00
audit.c
bcd.c
bch.c
bitmap.c	lib/bitmap.c: bitmap_parselist can accept string with whitespaces on head or tail	2015-09-10 13:29:01 -07:00
bitrev.c
bsearch.c
btree.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
bug.c	module: Sanitize RCU usage and locking	2015-05-28 11:31:52 +09:30
build_OID_registry
bust_spinlocks.c
check_signature.c
checksum.c	lib/checksum.c: fix build for generic csum_tcpudp_nofold	2015-01-29 11:57:38 -08:00
clz_ctz.c
clz_tab.c
cmdline.c	lib/cmdline.c: fix get_options() overflow while parsing ranges	2017-06-29 12:48:51 +02:00
compat_audit.c
cordic.c
cpu_rmap.c	sched/topology: Rename topology_thread_cpumask() to topology_sibling_cpumask()	2015-05-27 15:22:15 +02:00
cpu-notifier-error-inject.c
cpumask.c	revert "cpumask: don't perform while loop in cpumask_next_and()"	2015-06-18 17:00:23 -10:00
crc-ccitt.c
crc-itu-t.c	lib: crc-itu-t.[ch] fix 0x0x prefix in integer constants	2015-05-26 15:26:43 +02:00
crc-t10dif.c	lib: introduce crc_t10dif_update()	2015-05-30 22:42:24 -07:00
crc7.c
crc8.c
crc16.c
crc32.c
crc32defs.h
ctype.c
debug_info.c	kbuild: include core debug info when DEBUG_INFO_REDUCED	2015-06-11 15:08:32 +02:00
debug_locks.c
debugobjects.c
dec_and_lock.c
decompress_bunzip2.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_inflate.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_unlz4.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_unlzma.c	lib/decompress_unlzma: Do a NULL check for pointer	2015-09-10 13:29:01 -07:00
decompress_unlzo.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_unxz.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress.c	lib/decompress: set the compressor name to NULL on error	2015-07-17 16:39:54 -07:00
devres.c	devres: fix a for loop bounds check	2015-10-05 04:49:54 +01:00
digsig.c	lib/digsig: fix dereference of NULL user_key_payload	2017-10-27 10:23:17 +02:00
div64.c	remove abs64()	2015-11-09 15:11:24 -08:00
dma-debug.c	dma-debug: avoid spinlock recursion when disabling dma-debug	2016-06-07 18:14:37 -07:00
dump_stack.c	dump_stack: avoid potential deadlocks	2016-02-25 12:01:23 -08:00
dynamic_debug.c	lib/dynamic_debug.c: use kstrdup_const	2015-11-06 17:50:42 -08:00
dynamic_queue_limits.c	lib/dynamic_queue_limits.c: simplify includes	2015-02-12 18:54:15 -08:00
earlycpio.c
extable.c
fault-inject.c	fault-inject: fix inverted interval/probability values in printk	2015-10-23 17:55:10 +09:00
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
fdt.c
find_bit.c	lib: rename lib/find_next_bit.c to lib/find_bit.c	2015-04-17 09:03:54 -04:00
flex_array.c
flex_proportions.c
gcd.c
gen_crc32table.c	lib: crc32: constify crc32 lookup table	2015-02-13 21:21:35 -08:00
genalloc.c	lib/genalloc.c: start search from start of chunk	2016-11-18 10:48:36 +01:00
glob.c
halfmd4.c	lib/halfmd4.c: use rol32 inline function in the ROUND macro	2015-11-06 17:50:42 -08:00
hexdump.c	lib/hexdump.c: truncate output in case of overflow	2015-11-06 17:50:42 -08:00
hweight.c
idr.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
inflate.c
int_sqrt.c
interval_tree_test.c
interval_tree.c	lib/interval_tree.c: simplify includes	2015-02-12 18:54:15 -08:00
iomap_copy.c
iomap.c
iommu-common.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc	2015-11-05 16:34:48 -08:00
iommu-helper.c
ioremap.c	x86, mm: support huge KVA mappings on x86	2015-04-14 16:49:04 -07:00
iov_iter.c	fix iov_iter_fault_in_readable()	2016-09-24 10:07:43 +02:00
irq_regs.c
is_single_threaded.c	lib/is_single_threaded.c: change current_is_single_threaded() to use for_each_thread()	2015-11-06 17:50:42 -08:00
jedec_ddr_data.c
kasprintf.c	lib/kasprintf.c: introduce kvasprintf_const	2015-11-06 17:50:42 -08:00
Kconfig	lib: sw842: select crc32	2016-03-03 15:07:24 -08:00
Kconfig.debug	lib/Kconfig.debug: fix frv build failure	2017-08-11 09:08:59 -07:00
Kconfig.kasan	mm, slub, kasan: enable user tracking by default with KASAN=y	2015-11-05 19:34:48 -08:00
Kconfig.kgdb
Kconfig.kmemcheck
kfifo.c
klist.c	klist: fix starting point removed bug in klist iterators	2016-02-25 12:01:16 -08:00
kobject_uevent.c	lib/kobject_uevent.c: remove redundant include	2015-02-12 18:54:15 -08:00
kobject.c	lib/kobject.c: use kvasprintf_const for formatting ->name	2015-11-06 17:50:42 -08:00
kstrtox.c	lib: add "on"/"off" support to kstrtobool	2016-10-28 03:01:31 -04:00
kstrtox.h
lcm.c	block: fix blk_stack_limits() regression due to lcm() change	2015-03-31 09:45:50 -06:00
libcrc32c.c	crypto: crc32c - Fix crc32c soft dependency	2016-02-17 12:31:04 -08:00
list_debug.c
list_sort.c	lib/list_sort: use late_initcall to hook in self tests	2015-06-16 14:12:35 -04:00
llist.c	lib/llist.c: fix data race in llist_del_first	2015-11-06 17:50:42 -08:00
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c
lockref.c	locking/lockref: Remove homebrew cmpxchg64_relaxed() macro definition	2015-08-12 11:59:04 +02:00
lru_cache.c	lru_cache: remove use of seq_printf return value	2015-04-15 16:35:25 -07:00
Makefile	test_printf: test printf family at runtime	2015-11-06 17:50:42 -08:00
md5.c	lib/md5.c: simplify include	2015-02-12 18:54:15 -08:00
memory-notifier-error-inject.c
memweight.c
net_utils.c
nlattr.c	netlink: pad nla_memcpy dest buffer with zeroes	2015-03-31 14:07:24 -04:00
nmi_backtrace.c	ARM: 8439/1: Fix backtrace generation when IPI is masked	2015-10-03 16:40:51 +01:00
notifier-error-inject.c
notifier-error-inject.h
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c	once: make helper generic for calling functions once	2015-10-08 05:26:36 -07:00
parser.c
pci_iomap.c	libnvdimm for 4.3:	2015-09-08 14:35:59 -07:00
percpu_counter.c	percpu_counter: batch size aware __percpu_counter_compare()	2015-05-29 07:39:34 +10:00
percpu_ida.c	mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM	2015-11-06 17:50:42 -08:00
percpu_test.c
percpu-refcount.c
plist.c	lib/plist.c: remove redundant include	2015-02-12 18:54:16 -08:00
pm-notifier-error-inject.c
proportions.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
radix-tree.c	radix-tree: fix race in gang lookup	2016-02-25 12:01:23 -08:00
random32.c	random32: add prandom_init_once helper for own rngs	2015-10-08 05:26:38 -07:00
ratelimit.c
rational.c
rbtree_test.c
rbtree.c	rbtree: Make lockless searches non-fatal	2015-05-28 11:32:04 +09:30
reciprocal_div.c
rhashtable.c	rhashtable: Kill harmless RCU warning in rhashtable_walk_init	2015-12-18 23:44:18 -05:00
scatterlist.c	scatterlist: allow limited chaining without ARCH_HAS_SG_CHAIN	2015-08-17 08:12:51 -06:00
seq_buf.c	seq_buf: Fix seq_buf_bprintf() truncation	2015-03-04 23:40:19 -05:00
sg_split.c	lib: scatterlist: add sg splitting function	2015-08-24 14:28:01 -06:00
sha1.c	lib: EXPORT_SYMBOL sha_init	2015-03-23 22:12:08 -04:00
show_mem.c	lib/show_mem.c: correct reserved memory calculation	2015-09-08 15:35:28 -07:00
smp_processor_id.c
sort.c	lib/sort: Add 64 bit swap function	2015-06-25 17:00:40 -07:00
stmp_device.c	lib/stmp_device.c: replace module.h include	2015-02-12 18:54:16 -08:00
string_helpers.c	string_helpers: fix precision loss for some inputs	2016-02-25 12:01:21 -08:00
string.c	lib: move strtobool() to kstrtobool()	2016-10-28 03:01:30 -04:00
strncpy_from_user.c	lib: move strncpy_from_unsafe() into mm/maccess.c	2015-08-31 12:36:10 -07:00
strnlen_user.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-06-22 15:52:04 -07:00
swiotlb.c	swiotlb: ensure that page-sized mappings are page-aligned	2017-07-05 14:37:20 +02:00
syscall.c
test_bpf.c	bpf, arm64: fix jit branch offset related to ldimm64	2017-05-14 13:32:58 +02:00
test_firmware.c	test: firmware_class: report errors properly on failure	2017-11-15 17:13:13 +01:00
test_kasan.c	lib: test_kasan: add some testcases	2015-11-05 19:34:48 -08:00
test_module.c
test_printf.c	test_printf: test printf family at runtime	2015-11-06 17:50:42 -08:00
test_rhashtable.c	rhashtable-test: extend to test concurrency	2015-08-17 14:33:47 -07:00
test_static_key_base.c	locking/static_keys: Provide a selftest	2015-08-03 11:51:12 +02:00
test_static_keys.c	locking/static_keys: Make verify_keys() static	2015-08-05 09:53:40 +02:00
test_user_copy.c	usercopy: Adjust tests to deal with SMAP/PAN	2017-06-14 13:16:27 +02:00
test-hexdump.c	hexdump: Make test data really const	2015-06-25 17:00:40 -07:00
test-kstrtox.c	kstrto*: accept "-0" for signed conversion	2015-09-10 13:29:01 -07:00
test-string_helpers.c	lib/test-string_helpers.c: fix and improve string_get_size() tests	2016-05-11 11:21:26 +02:00
textsearch.c
timerqueue.c	timerqueue: Let timerqueue_add/del return information	2015-04-22 17:06:49 +02:00
ts_bm.c
ts_fsm.c
ts_kmp.c
ucs2_string.c	lib/ucs2_string: Correct ucs2 -> utf8 conversion	2016-03-03 15:07:09 -08:00
usercopy.c
uuid.c
vsprintf.c	lib/vsprintf.c: update documentation	2015-11-06 17:50:42 -08:00