)]}'
{
  "commit": "624f5ab8720b3371367327a822c267699c1823b8",
  "tree": "91db804547747274e274444faad34edd9f92a0ad",
  "parents": [
    "fbc3edf7d7731d7a22c483c679700589bab936a3"
  ],
  "author": {
    "name": "Eric Biggers",
    "email": "ebiggers@google.com",
    "time": "Tue Nov 07 22:29:02 2017 +0000"
  },
  "committer": {
    "name": "James Morris",
    "email": "james.l.morris@oracle.com",
    "time": "Thu Nov 09 00:38:21 2017 +1100"
  },
  "message": "KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2]\n\nsyzkaller reported a NULL pointer dereference in asn1_ber_decoder().  It\ncan be reproduced by the following command, assuming\nCONFIG_PKCS7_TEST_KEY\u003dy:\n\n        keyctl add pkcs7_test desc \u0027\u0027 @s\n\nThe bug is that if the data buffer is empty, an integer underflow occurs\nin the following check:\n\n        if (unlikely(dp \u003e\u003d datalen - 1))\n                goto data_overrun_error;\n\nThis results in the NULL data pointer being dereferenced.\n\nFix it by checking for \u0027datalen - dp \u003c 2\u0027 instead.\n\nAlso fix the similar check for \u0027dp \u003e\u003d datalen - n\u0027 later in the same\nfunction.  That one possibly could result in a buffer overread.\n\nThe NULL pointer dereference was reproducible using the \"pkcs7_test\" key\ntype but not the \"asymmetric\" key type because the \"asymmetric\" key type\nchecks for a 0-length payload before calling into the ASN.1 decoder but\nthe \"pkcs7_test\" key type does not.\n\nThe bug report was:\n\n    BUG: unable to handle kernel NULL pointer dereference at           (null)\n    IP: asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233\n    PGD 7b708067 P4D 7b708067 PUD 7b6ee067 PMD 0\n    Oops: 0000 [#1] SMP\n    Modules linked in:\n    CPU: 0 PID: 522 Comm: syz-executor1 Not tainted 4.14.0-rc8 #7\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.3-20171021_125229-anatol 04/01/2014\n    task: ffff9b6b3798c040 task.stack: ffff9b6b37970000\n    RIP: 0010:asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233\n    RSP: 0018:ffff9b6b37973c78 EFLAGS: 00010216\n    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000021c\n    RDX: ffffffff814a04ed RSI: ffffb1524066e000 RDI: ffffffff910759e0\n    RBP: ffff9b6b37973d60 R08: 0000000000000001 R09: ffff9b6b3caa4180\n    R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002\n    R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n    FS:  00007f10ed1f2700(0000) GS:ffff9b6b3ea00000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000000000 CR3: 000000007b6f3000 CR4: 00000000000006f0\n    Call Trace:\n     pkcs7_parse_message+0xee/0x240 crypto/asymmetric_keys/pkcs7_parser.c:139\n     verify_pkcs7_signature+0x33/0x180 certs/system_keyring.c:216\n     pkcs7_preparse+0x41/0x70 crypto/asymmetric_keys/pkcs7_key_type.c:63\n     key_create_or_update+0x180/0x530 security/keys/key.c:855\n     SYSC_add_key security/keys/keyctl.c:122 [inline]\n     SyS_add_key+0xbf/0x250 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0xbe\n    RIP: 0033:0x4585c9\n    RSP: 002b:00007f10ed1f1bd8 EFLAGS: 00000216 ORIG_RAX: 00000000000000f8\n    RAX: ffffffffffffffda RBX: 00007f10ed1f2700 RCX: 00000000004585c9\n    RDX: 0000000020000000 RSI: 0000000020008ffb RDI: 0000000020008000\n    RBP: 0000000000000000 R08: ffffffffffffffff R09: 0000000000000000\n    R10: 0000000000000000 R11: 0000000000000216 R12: 00007fff1b2260ae\n    R13: 00007fff1b2260af R14: 00007f10ed1f2700 R15: 0000000000000000\n    Code: dd ca ff 48 8b 45 88 48 83 e8 01 4c 39 f0 0f 86 a8 07 00 00 e8 53 dd ca ff 49 8d 46 01 48 89 85 58 ff ff ff 48 8b 85 60 ff ff ff \u003c42\u003e 0f b6 0c 30 89 c8 88 8d 75 ff ff ff 83 e0 1f 89 8d 28 ff ff\n    RIP: asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233 RSP: ffff9b6b37973c78\n    CR2: 0000000000000000\n\nFixes: 42d5ec27f873 (\"X.509: Add an ASN.1 decoder\")\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v3.7+\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fef5d2e114be1eef73b78653ce84a915da3e59d3",
      "old_mode": 33188,
      "old_path": "lib/asn1_decoder.c",
      "new_id": "1ef0cec38d7879332966f8095d0bfdc0c7580230",
      "new_mode": 33188,
      "new_path": "lib/asn1_decoder.c"
    }
  ]
}