mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 00:20:32 +00:00
lib/digsig: fix dereference of NULL user_key_payload
commit192cabd6a2
upstream. digsig_verify() requests a user key, then accesses its payload. However, a revoked key has a NULL payload, and we failed to check for this. request_key() *does* skip revoked keys, but there is still a window where the key can be revoked before we acquire its semaphore. Fix it by checking for a NULL payload, treating it like a key which was already revoked at the time it was requested. Fixes:051dbb918c
("crypto: digital signature verification support") Reviewed-by: James Morris <james.l.morris@oracle.com> Cc: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
fec442e32b
commit
f9e7e2d605
1 changed files with 6 additions and 0 deletions
|
@ -87,6 +87,12 @@ static int digsig_verify_rsa(struct key *key,
|
|||
down_read(&key->sem);
|
||||
ukp = user_key_payload(key);
|
||||
|
||||
if (!ukp) {
|
||||
/* key was revoked before we acquired its semaphore */
|
||||
err = -EKEYREVOKED;
|
||||
goto err1;
|
||||
}
|
||||
|
||||
if (ukp->datalen < sizeof(*pkh))
|
||||
goto err1;
|
||||
|
||||
|
|
Loading…
Reference in a new issue