)]}'
{
  "commit": "2eb9eabf1e868fda15808954fb29b0f105ed65f1",
  "tree": "e1aff1f0bb61840a1204159df623cc16a4c6d437",
  "parents": [
    "a3c812f7cfd80cf51e8f5b7034f7418f6beb56c1"
  ],
  "author": {
    "name": "Eric Biggers",
    "email": "ebiggers@google.com",
    "time": "Thu Nov 02 00:47:19 2017 +0000"
  },
  "committer": {
    "name": "James Morris",
    "email": "james.l.morris@oracle.com",
    "time": "Thu Nov 02 20:58:08 2017 +1100"
  },
  "message": "KEYS: fix out-of-bounds read during ASN.1 parsing\n\nsyzkaller with KASAN reported an out-of-bounds read in\nasn1_ber_decoder().  It can be reproduced by the following command,\nassuming CONFIG_X509_CERTIFICATE_PARSER\u003dy and CONFIG_KASAN\u003dy:\n\n    keyctl add asymmetric desc $\u0027\\x30\\x30\u0027 @s\n\nThe bug is that the length of an ASN.1 data value isn\u0027t validated in the\ncase where it is encoded using the short form, causing the decoder to\nread past the end of the input buffer.  Fix it by validating the length.\n\nThe bug report was:\n\n    BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x10cb/0x1730 lib/asn1_decoder.c:233\n    Read of size 1 at addr ffff88003cccfa02 by task syz-executor0/6818\n\n    CPU: 1 PID: 6818 Comm: syz-executor0 Not tainted 4.14.0-rc7-00008-g5f479447d983 #2\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n    Call Trace:\n     __dump_stack lib/dump_stack.c:16 [inline]\n     dump_stack+0xb3/0x10b lib/dump_stack.c:52\n     print_address_description+0x79/0x2a0 mm/kasan/report.c:252\n     kasan_report_error mm/kasan/report.c:351 [inline]\n     kasan_report+0x236/0x340 mm/kasan/report.c:409\n     __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:427\n     asn1_ber_decoder+0x10cb/0x1730 lib/asn1_decoder.c:233\n     x509_cert_parse+0x1db/0x650 crypto/asymmetric_keys/x509_cert_parser.c:89\n     x509_key_preparse+0x64/0x7a0 crypto/asymmetric_keys/x509_public_key.c:174\n     asymmetric_key_preparse+0xcb/0x1a0 crypto/asymmetric_keys/asymmetric_type.c:388\n     key_create_or_update+0x347/0xb20 security/keys/key.c:855\n     SYSC_add_key security/keys/keyctl.c:122 [inline]\n     SyS_add_key+0x1cd/0x340 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0xbe\n    RIP: 0033:0x447c89\n    RSP: 002b:00007fca7a5d3bd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8\n    RAX: ffffffffffffffda RBX: 00007fca7a5d46cc RCX: 0000000000447c89\n    RDX: 0000000020006f4a RSI: 0000000020006000 RDI: 0000000020001ff5\n    RBP: 0000000000000046 R08: fffffffffffffffd R09: 0000000000000000\n    R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000\n    R13: 0000000000000000 R14: 00007fca7a5d49c0 R15: 00007fca7a5d4700\n\nFixes: 42d5ec27f873 (\"X.509: Add an ASN.1 decoder\")\nCc: \u003cstable@vger.kernel.org\u003e # v3.7+\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0bd8a611eb83c99aad01fcee01143bbaad490845",
      "old_mode": 33188,
      "old_path": "lib/asn1_decoder.c",
      "new_id": "fef5d2e114be1eef73b78653ce84a915da3e59d3",
      "new_mode": 33188,
      "new_path": "lib/asn1_decoder.c"
    }
  ]
}