zhenwei pi
a67d0cfe1a
crypto: public_key: fix overflow during implicit conversion
commit f985911b7bc75d5c98ed24d8aaa8b94c590f7c6a upstream.
Hit kernel warning like this, it can be reproduced by verifying 256
bytes datafile by keyctl command, run script:
RAWDATA=rawdata
SIGDATA=sigdata
modprobe pkcs8_key_parser
rm -rf *.der *.pem *.pfx
rm -rf $RAWDATA
dd if=/dev/random of=$RAWDATA bs=256 count=1
openssl req -nodes -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem \
-subj "/C=CN/ST=GD/L=SZ/O=vihoo/OU=dev/CN=xx.com/emailAddress=yy@xx.com"
KEY_ID=`openssl pkcs8 -in key.pem -topk8 -nocrypt -outform DER | keyctl \
padd asymmetric 123 @s`
keyctl pkey_sign $KEY_ID 0 $RAWDATA enc=pkcs1 hash=sha1 > $SIGDATA
keyctl pkey_verify $KEY_ID 0 $RAWDATA $SIGDATA enc=pkcs1 hash=sha1
Then the kernel reports:
WARNING: CPU: 5 PID: 344556 at crypto/rsa-pkcs1pad.c:540
pkcs1pad_verify+0x160/0x190
...
Call Trace:
public_key_verify_signature+0x282/0x380
? software_key_query+0x12d/0x180
? keyctl_pkey_params_get+0xd6/0x130
asymmetric_key_verify_signature+0x66/0x80
keyctl_pkey_verify+0xa5/0x100
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
The reason of this issue, in function 'asymmetric_key_verify_signature':
'.digest_size(u8) = params->in_len(u32)' leads overflow of an u8 value,
so use u32 instead of u8 for digest_size field. And reorder struct
public_key_signature, it saves 8 bytes on a 64-bit machine.
Cc: stable@vger.kernel.org
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2021-09-22 11:43:03 +02:00 |
| .. |
|
acpi
|
ACPI: scan: Use unique number for instance_no
|
2021-03-30 14:41:41 +02:00 |
|
asm-generic
|
vmlinux.lds.h: Handle clang's module.{c,d}tor sections
|
2021-08-26 08:37:24 -04:00 |
|
clocksource
|
|
|
|
crypto
|
crypto: public_key: fix overflow during implicit conversion
|
2021-09-22 11:43:03 +02:00 |
|
drm
|
drm: mst: Fix query_payload ack reply struct
|
2020-01-04 13:39:00 +01:00 |
|
dt-bindings
|
dt-bindings: reset: meson8b: fix duplicate reset IDs
|
2020-01-23 08:19:38 +01:00 |
|
keys
|
KEYS: user: Align the payload buffer
|
2019-02-27 10:07:00 +01:00 |
|
kvm
|
arm/arm64: KVM: Add PSCI version selection API
|
2018-05-09 09:50:19 +02:00 |
|
linux
|
power: supply: max17042_battery: fix typo in MAx17042_TOFF
|
2021-09-22 11:42:58 +02:00 |
|
math-emu
|
math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning
|
2019-12-21 10:41:02 +01:00 |
|
media
|
media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in v4l2_device macros
|
2020-02-28 15:42:24 +01:00 |
|
memory
|
|
|
|
misc
|
|
|
|
net
|
Bluetooth: defer cleanup of resources in hci_unregister_dev()
|
2021-08-15 13:01:02 +02:00 |
|
pcmcia
|
|
|
|
ras
|
|
|
|
rdma
|
IB/cma: Fix reference count leak when no ipv4 addresses are set
|
2020-06-03 08:16:33 +02:00 |
|
rxrpc
|
|
|
|
scsi
|
scsi: iscsi: Add iscsi_cls_conn refcount helpers
|
2021-07-20 16:21:11 +02:00 |
|
soc
|
irqchip/eznps: Fix build error for !ARC700 builds
|
2020-09-23 08:46:10 +02:00 |
|
sound
|
ALSA: compress: fix partial_drain completion state
|
2020-07-22 09:10:45 +02:00 |
|
target
|
target: add XCOPY target/segment desc sense codes
|
2021-01-17 13:57:53 +01:00 |
|
trace
|
memcg: fix a crash in wb_workfn when a device disappears
|
2021-02-23 13:59:15 +01:00 |
|
uapi
|
tty: actually undefine superseded ASYNC flags
|
2021-05-22 10:40:24 +02:00 |
|
video
|
udlfb: set optimal write delay
|
2018-09-09 20:01:25 +02:00 |
|
xen
|
Xen/gntdev: correct error checking in gntdev_map_grant_pages()
|
2021-02-23 13:59:17 +01:00 |
|
Kbuild
|
|
|