Andrey Ryabinin 2b95fda2c4 X.509: Fix double free in x509_cert_parse() [ver #3] ... We shouldn't free cert->pub->key in x509_cert_parse() because x509_free_certificate() also does this: BUG: Double free or freeing an invalid pointer ... Call Trace: [<ffffffff81896c20>] dump_stack+0x63/0x83 [<ffffffff81356571>] kasan_object_err+0x21/0x70 [<ffffffff81356ed9>] kasan_report_double_free+0x49/0x60 [<ffffffff813561ad>] kasan_slab_free+0x9d/0xc0 [<ffffffff81350b7a>] kfree+0x8a/0x1a0 [<ffffffff81844fbf>] public_key_free+0x1f/0x30 [<ffffffff818455d4>] x509_free_certificate+0x24/0x90 [<ffffffff818460bc>] x509_cert_parse+0x2bc/0x300 [<ffffffff81846cae>] x509_key_preparse+0x3e/0x330 [<ffffffff818444cf>] asymmetric_key_preparse+0x6f/0x100 [<ffffffff8178bec0>] key_create_or_update+0x260/0x5f0 [<ffffffff8178e6d9>] SyS_add_key+0x199/0x2a0 [<ffffffff821d823b>] entry_SYSCALL_64_fastpath+0x1e/0xad Object at ffff880110bd1900, in cache kmalloc-512 size: 512 .... Freed: PID = 2579 [<ffffffff8104283b>] save_stack_trace+0x1b/0x20 [<ffffffff813558f6>] save_stack+0x46/0xd0 [<ffffffff81356183>] kasan_slab_free+0x73/0xc0 [<ffffffff81350b7a>] kfree+0x8a/0x1a0 [<ffffffff818460a3>] x509_cert_parse+0x2a3/0x300 [<ffffffff81846cae>] x509_key_preparse+0x3e/0x330 [<ffffffff818444cf>] asymmetric_key_preparse+0x6f/0x100 [<ffffffff8178bec0>] key_create_or_update+0x260/0x5f0 [<ffffffff8178e6d9>] SyS_add_key+0x199/0x2a0 [<ffffffff821d823b>] entry_SYSCALL_64_fastpath+0x1e/0xad Fixes: db6c43bd21 ("crypto: KEYS: convert public key and digsig asym to the akcipher api") Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: <stable@vger.kernel.org> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com>		2016-11-25 12:57:48 +11:00
..
asymmetric_keys	X.509: Fix double free in x509_cert_parse() [ver #3]	2016-11-25 12:57:48 +11:00
async_tx	async_pq_val: fix DMA memory leak	2016-10-05 06:18:09 +05:30
.gitignore
842.c
ablk_helper.c
ablkcipher.c
aead.c
aes_generic.c
af_alg.c
ahash.c
akcipher.c
algapi.c
algboss.c
algif_aead.c
algif_hash.c	crypto: algif_hash - Fix result clobbering in recvmsg	2016-11-22 15:02:24 +08:00
algif_rng.c
algif_skcipher.c
ansi_cprng.c
anubis.c
api.c
arc4.c
authenc.c
authencesn.c
blkcipher.c	crypto: skcipher - Fix blkcipher walk OOM crash	2016-09-13 18:44:57 +08:00
blowfish_common.c
blowfish_generic.c
camellia_generic.c
cast5_generic.c
cast6_generic.c
cast_common.c
cbc.c
ccm.c
chacha20_generic.c
chacha20poly1305.c
cipher.c
cmac.c
compress.c
crc32_generic.c
crc32c_generic.c
crct10dif_common.c
crct10dif_generic.c	crypto: squash lines for simple wrapper functions	2016-09-13 20:27:26 +08:00
cryptd.c	crypto: cryptd - initialize child shash_desc on import	2016-09-07 21:04:36 +08:00
crypto_engine.c	kthread: kthread worker API cleanup	2016-10-11 15:06:33 -07:00
crypto_null.c
crypto_user.c
crypto_wq.c
ctr.c
cts.c
deflate.c
des_generic.c
dh.c
dh_helper.c
drbg.c	crypto: drbg - fix error return code	2016-08-24 21:04:49 +08:00
ecb.c
ecc.c
ecc.h
ecc_curve_defs.h
ecdh.c
ecdh_helper.c
echainiv.c	crypto: echainiv - Replace chaining with multiplication	2016-09-13 18:44:57 +08:00
fcrypt.c
fips.c
gcm.c	crypto: gcm - Fix IV buffer size in crypto_gcm_setkey	2016-10-02 22:31:52 +08:00
gf128mul.c
ghash-generic.c	crypto: ghash-generic - move common definitions to a new header file	2016-10-02 22:26:40 +08:00
hash_info.c
hmac.c
internal.h
jitterentropy-kcapi.c
jitterentropy.c
Kconfig	crypto: powerpc - CRYPT_CRC32C_VPMSUM should depend on ALTIVEC	2016-08-09 18:25:09 +08:00
keywrap.c
khazad.c
kpp.c
lrw.c
lz4.c
lz4hc.c
lzo.c
Makefile
mcryptd.c	crypto: squash lines for simple wrapper functions	2016-09-13 20:27:26 +08:00
md4.c
md5.c
memneq.c
michael_mic.c
pcbc.c
pcrypt.c
poly1305_generic.c
proc.c
ripemd.h
rmd128.c
rmd160.c
rmd256.c
rmd320.c
rng.c
rsa-pkcs1pad.c	crypto: rsa-pkcs1pad - Handle leading zero for decryption	2016-09-22 17:42:08 +08:00
rsa.c
rsa_helper.c	crypto: rsa - allow keys >= 2048 bits in FIPS mode	2016-08-24 21:07:10 +08:00
rsaprivkey.asn1
rsapubkey.asn1
salsa20_generic.c
scatterwalk.c	crypto: scatterwalk - Remove unnecessary aliasing check in map_and_copy	2016-11-22 15:02:25 +08:00
seed.c
seqiv.c
serpent_generic.c
sha1_generic.c
sha3_generic.c	crypto: sha3 - Add missing ULL suffixes for 64-bit constants	2016-08-08 23:43:46 +08:00
sha256_generic.c
sha512_generic.c
shash.c
skcipher.c
tcrypt.c
tcrypt.h
tea.c
testmgr.c	crypto: testmgr - add guard to dst buffer for ahash_export	2016-10-02 22:33:43 +08:00
testmgr.h	crypto: FIPS - allow tests to be disabled in FIPS mode	2016-08-31 23:21:25 +08:00
tgr192.c
twofish_common.c
twofish_generic.c
vmac.c
wp512.c
xcbc.c
xor.c	crypto: xor - Fix warning when XOR_SELECT_TEMPLATE is unset	2016-08-31 23:00:48 +08:00
xts.c	crypto: xts - fix a little typo	2016-08-16 17:16:49 +08:00