Andrey Ryabinin 2b95fda2c4 X.509: Fix double free in x509_cert_parse() [ver #3] ... We shouldn't free cert->pub->key in x509_cert_parse() because x509_free_certificate() also does this: BUG: Double free or freeing an invalid pointer ... Call Trace: [<ffffffff81896c20>] dump_stack+0x63/0x83 [<ffffffff81356571>] kasan_object_err+0x21/0x70 [<ffffffff81356ed9>] kasan_report_double_free+0x49/0x60 [<ffffffff813561ad>] kasan_slab_free+0x9d/0xc0 [<ffffffff81350b7a>] kfree+0x8a/0x1a0 [<ffffffff81844fbf>] public_key_free+0x1f/0x30 [<ffffffff818455d4>] x509_free_certificate+0x24/0x90 [<ffffffff818460bc>] x509_cert_parse+0x2bc/0x300 [<ffffffff81846cae>] x509_key_preparse+0x3e/0x330 [<ffffffff818444cf>] asymmetric_key_preparse+0x6f/0x100 [<ffffffff8178bec0>] key_create_or_update+0x260/0x5f0 [<ffffffff8178e6d9>] SyS_add_key+0x199/0x2a0 [<ffffffff821d823b>] entry_SYSCALL_64_fastpath+0x1e/0xad Object at ffff880110bd1900, in cache kmalloc-512 size: 512 .... Freed: PID = 2579 [<ffffffff8104283b>] save_stack_trace+0x1b/0x20 [<ffffffff813558f6>] save_stack+0x46/0xd0 [<ffffffff81356183>] kasan_slab_free+0x73/0xc0 [<ffffffff81350b7a>] kfree+0x8a/0x1a0 [<ffffffff818460a3>] x509_cert_parse+0x2a3/0x300 [<ffffffff81846cae>] x509_key_preparse+0x3e/0x330 [<ffffffff818444cf>] asymmetric_key_preparse+0x6f/0x100 [<ffffffff8178bec0>] key_create_or_update+0x260/0x5f0 [<ffffffff8178e6d9>] SyS_add_key+0x199/0x2a0 [<ffffffff821d823b>] entry_SYSCALL_64_fastpath+0x1e/0xad Fixes: db6c43bd21 ("crypto: KEYS: convert public key and digsig asym to the akcipher api") Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: <stable@vger.kernel.org> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com>		2016-11-25 12:57:48 +11:00
..
asymmetric_keys	X.509: Fix double free in x509_cert_parse() [ver #3]	2016-11-25 12:57:48 +11:00
async_tx	async_pq_val: fix DMA memory leak	2016-10-05 06:18:09 +05:30
.gitignore	…
842.c	…
Kconfig	crypto: powerpc - CRYPT_CRC32C_VPMSUM should depend on ALTIVEC	2016-08-09 18:25:09 +08:00
Makefile	crypto: skcipher - Remove top-level givcipher interface	2016-07-18 17:35:46 +08:00
ablk_helper.c	crypto: ablk_helper - Fix cryptd reordering	2016-06-23 18:29:53 +08:00
ablkcipher.c	crypto: skcipher - Remove top-level givcipher interface	2016-07-18 17:35:46 +08:00
aead.c	crypto: aead - Remove blkcipher null for IV generators	2016-07-18 17:35:43 +08:00
aes_generic.c	…
af_alg.c	…
ahash.c	crypto: ahash - Add padding in crypto_ahash_extsize	2016-07-01 23:45:03 +08:00
akcipher.c	…
algapi.c	crypto: api - Add crypto_inst_setname	2016-07-01 23:45:11 +08:00
algboss.c	…
algif_aead.c	crypto: af_alg - add async support to algif_aead	2016-04-05 20:35:41 +08:00
algif_hash.c	crypto: algif_hash - Fix result clobbering in recvmsg	2016-11-22 15:02:24 +08:00
algif_rng.c	…
algif_skcipher.c	crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path	2016-02-06 15:23:55 +08:00
ansi_cprng.c	…
anubis.c	…
api.c	…
arc4.c	…
authenc.c	crypto: authenc - Use skcipher	2016-07-18 17:35:38 +08:00
authencesn.c	crypto: authencesn - Use skcipher	2016-07-18 17:35:39 +08:00
blkcipher.c	crypto: skcipher - Fix blkcipher walk OOM crash	2016-09-13 18:44:57 +08:00
blowfish_common.c	…
blowfish_generic.c	…
camellia_generic.c	…
cast5_generic.c	…
cast6_generic.c	…
cast_common.c	…
cbc.c	…
ccm.c	crypto: ccm - Use skcipher	2016-07-18 17:35:40 +08:00
chacha20_generic.c	random: replace non-blocking pool with a Chacha20-based CRNG	2016-07-03 00:57:23 -04:00
chacha20poly1305.c	crypto: chacha20poly1305 - Use skcipher	2016-07-18 17:35:41 +08:00
cipher.c	…
cmac.c	…
compress.c	…
crc32_generic.c	crypto: crc32 - Rename generic implementation	2016-01-30 22:11:22 +08:00
crc32c_generic.c	…
crct10dif_common.c	…
crct10dif_generic.c	crypto: squash lines for simple wrapper functions	2016-09-13 20:27:26 +08:00
cryptd.c	crypto: cryptd - initialize child shash_desc on import	2016-09-07 21:04:36 +08:00
crypto_engine.c	kthread: kthread worker API cleanup	2016-10-11 15:06:33 -07:00
crypto_null.c	crypto: null - Remove default null blkcipher	2016-07-18 17:35:44 +08:00
crypto_user.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2016-07-21 12:26:55 +08:00
crypto_wq.c	…
ctr.c	crypto: ctr - Use skcipher in rfc3686	2016-07-18 17:35:39 +08:00
cts.c	crypto: cts - Convert to skcipher	2016-07-18 17:35:44 +08:00
deflate.c	…
des_generic.c	…
dh.c	crypto: rsa - Generate fixed-length output	2016-07-01 23:45:18 +08:00
dh_helper.c	crypto: dh - Add DH software implementation	2016-06-23 18:29:56 +08:00
drbg.c	crypto: drbg - fix error return code	2016-08-24 21:04:49 +08:00
ecb.c	…
ecc.c	crypto: ecdh - make ecdh_shared_secret unique	2016-06-24 21:24:59 +08:00
ecc.h	crypto: ecdh - make ecdh_shared_secret unique	2016-06-24 21:24:59 +08:00
ecc_curve_defs.h	crypto: ecdh - Add ECDH software support	2016-06-23 18:29:57 +08:00
ecdh.c	crypto: ecdh - make ecdh_shared_secret unique	2016-06-24 21:24:59 +08:00
ecdh_helper.c	crypto: ecdh - Add ECDH software support	2016-06-23 18:29:57 +08:00
echainiv.c	crypto: echainiv - Replace chaining with multiplication	2016-09-13 18:44:57 +08:00
fcrypt.c	…
fips.c	…
gcm.c	crypto: gcm - Fix IV buffer size in crypto_gcm_setkey	2016-10-02 22:31:52 +08:00
gf128mul.c	…
ghash-generic.c	crypto: ghash-generic - move common definitions to a new header file	2016-10-02 22:26:40 +08:00
hash_info.c	…
hmac.c	…
internal.h	…
jitterentropy-kcapi.c	crypto: jitterentropy - use ktime_get_ns as fallback	2016-06-24 21:24:58 +08:00
jitterentropy.c	…
keywrap.c	crypto: keywrap - memzero the correct memory	2016-02-01 22:27:05 +08:00
khazad.c	…
kpp.c	crypto: kpp - Key-agreement Protocol Primitives API (KPP)	2016-06-23 18:29:56 +08:00
lrw.c	…
lz4.c	…
lz4hc.c	…
lzo.c	crypto: lzo - get rid of superfluous __GFP_REPEAT	2016-04-15 22:36:36 +08:00
mcryptd.c	crypto: squash lines for simple wrapper functions	2016-09-13 20:27:26 +08:00
md4.c	…
md5.c	…
memneq.c	…
michael_mic.c	…
pcbc.c	…
pcrypt.c	…
poly1305_generic.c	…
proc.c	…
ripemd.h	…
rmd128.c	…
rmd160.c	…
rmd256.c	…
rmd320.c	…
rng.c	…
rsa-pkcs1pad.c	crypto: rsa-pkcs1pad - Handle leading zero for decryption	2016-09-22 17:42:08 +08:00
rsa.c	crypto: rsa - Generate fixed-length output	2016-07-01 23:45:18 +08:00
rsa_helper.c	crypto: rsa - allow keys >= 2048 bits in FIPS mode	2016-08-24 21:07:10 +08:00
rsaprivkey.asn1	crypto: rsa - Store rest of the private key components	2016-07-05 23:05:26 +08:00
rsapubkey.asn1	…
salsa20_generic.c	…
scatterwalk.c	crypto: scatterwalk - Remove unnecessary aliasing check in map_and_copy	2016-11-22 15:02:25 +08:00
seed.c	…
seqiv.c	crypto: skcipher - Remove top-level givcipher interface	2016-07-18 17:35:46 +08:00
serpent_generic.c	…
sha1_generic.c	…
sha3_generic.c	crypto: sha3 - Add missing ULL suffixes for 64-bit constants	2016-08-08 23:43:46 +08:00
sha256_generic.c	…
sha512_generic.c	…
shash.c	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2016-03-17 11:22:54 -07:00
skcipher.c	crypto: skcipher - Remove top-level givcipher interface	2016-07-18 17:35:46 +08:00
tcrypt.c	crypto: sha3 - Add HMAC-SHA3 test modes and test vectors	2016-07-01 23:45:24 +08:00
tcrypt.h	…
tea.c	…
testmgr.c	crypto: testmgr - add guard to dst buffer for ahash_export	2016-10-02 22:33:43 +08:00
testmgr.h	crypto: FIPS - allow tests to be disabled in FIPS mode	2016-08-31 23:21:25 +08:00
tgr192.c	…
twofish_common.c	…
twofish_generic.c	…
vmac.c	…
wp512.c	…
xcbc.c	…
xor.c	crypto: xor - Fix warning when XOR_SELECT_TEMPLATE is unset	2016-08-31 23:00:48 +08:00
xts.c	crypto: xts - fix a little typo	2016-08-16 17:16:49 +08:00