From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S938826AbcKWRuy (ORCPT ); Wed, 23 Nov 2016 12:50:54 -0500 Received: from mail-db5eur01on0095.outbound.protection.outlook.com ([104.47.2.95]:38784 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932464AbcKWRuw (ORCPT ); Wed, 23 Nov 2016 12:50:52 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; From: Andrey Ryabinin To: David Howells CC: Tadeusz Struk , Herbert Xu , "David S. Miller" , , , , Andrey Ryabinin , Subject: [PATCH] X.509: Fix double free in x509_cert_parse() Date: Wed, 23 Nov 2016 19:16:59 +0300 Message-ID: <1479917819-31571-1-git-send-email-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.7.3 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: HE1PR0802CA0012.eurprd08.prod.outlook.com (10.172.123.150) To AM5PR0801MB2050.eurprd08.prod.outlook.com (10.168.158.140) X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2050;2:0bvuNCX6HP6Rs3OJ8AWnglIhBi0ldmUEP6NnilVWYVSQ/kisXQMQuDshTDV4huLdGt3TR7rXcU3vCTKn9VRSmQ5fYeixlZXKIq9XvLgiqt/uebYJ9E3Sc4x+Eb9ciNW1l41au07xXPYoejakRnxUATAABA2P/M1kTVJSOf+tbEk=;3:2TPGGNdr+ai6361Bm633fvB6HswsIQKVaRNQQOKOgxxGiP8Av6Lz618FR0FP4XKfqVVNU8tRm9Nr+YGapDV4ezd+d6iDag6NBE6n3pX6gBMEjzHPy9ll2iCnCw3CN35Vt5xDfH8vtn3YQgbzX7gEfpEJvyrXtLKwDwacwCfodyI=;25:pH0/k6sA0pBAMFzU40jgw0iiBhbIWf3tRU9D5ItVloHi2Hs+6aqTe1p41YpocqZMHACqGoWD4CescdEVze5qDlk3qDBLXui3C2lO+n5OTnT21AkZ4rW+Lqh98uykmBQAvEjCfcYkYOVa4GjAEWGBnuz7FL2Jgfi7MkiQW2ebUvwon+ooXhOZuuRNXXIgczJThIK6tKLyK/pfO4tJzdU2zxnCEMwnOvJCAhXWpf6qSjn95ysOpyLsbxWs/qMa3FZSOGfDBfshMdjAg+3H7EqLUrwTXrxbdVMG7XWduz/lwMpGXcKBE4mxoVew+zqerp1Zqk/A3IstvaAhoF01ghYR2n796NMroxbxJhImopvZ5tY+B7W8zsRxN1BP8U9KQ+UPVFRV/qxgsP9SR4J+N92V071FIX2TugQs++xNz2xy9FURQdugicwfC7nFg1gHDzj79wbCClsIMXR2BVQKJy7bMg== X-MS-Office365-Filtering-Correlation-Id: 7050f180-aef3-4d9b-a894-08d413bc481b X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:AM5PR0801MB2050; X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2050;31:ZUU2uXv/3HohihVNoLaDhmT/GkARkrhT8mIiqQvV+UPF7ErlQj0ToW6ZFf3pcvPKpF51+a+bfjiYCzVLHHSPd2S1Ph3+Fr7DrbyfdqIgfifmTlb0ynI7xBhaW4s5h9EPPMK0c4bGbVoEMvF1Hh5aVYZPzWz05IOfxpNunZDbERaNB2VBz/DHr804YUn7Ntcic4d4wZ3+WVJ7rGtVtj7+zVJ5ssZPQuunLOEJXuhDJc9BiKfJ/JCPn6c3LTfA4A1YzwE6DFgVajaUzlBiEXqTMA==;20:tlVmINNEUiRZP8ZpOf8YkSW+L/2r0N4juaNBAIno+h3gXOa9QYZ8KNLc2M/7xKqraxw8fvSyEZcmocs4IE439+TIDMtX9n8l4JtdOBlX2hPvnSLR+o7NmwMXfqshtt5ACq3stnCDMCn1gw5CMMkC7sdADes0FYkGU06UrPUuI1c= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(9452136761055); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6060326)(6040307)(6045199)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041248)(6061324)(2016111802025)(6043046);SRVR:AM5PR0801MB2050;BCL:0;PCL:0;RULEID:;SRVR:AM5PR0801MB2050; X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2050;4:caeQLWHXECYJzEngBlhPzyoudRu2bQTycApOYD/8UrWBWqgF6M0ZAsPAWipL0u/MsM4U4RuL2A3dHIt3qMkqRc4XLhWxZEozzrmAtZGJ0wUz+veTgJ7lqw0/jlK6+sWL1sBbNVhD2SJOKhDIDNmnvpEAid+Yk4IHtxU94F9rFcZUoJsEWm2MoSt8onGmkRVT7bmgHw24Obp26cHOAcQTtBuB5juCQ6cIVSbqvFmbikW9bjJPbgt7uXKDYD+iIeO9YJ3yg2PDcQ5RKe5zvX/TGzio24sSU2kKz9rZmuoKMNk7jK4YbnmkPbiH6MlQdHdyCOodafpvDHjXvKDQe4OyO0YTNGFRdyCZOyMILw0orzqQMWfLWTu5SxAeOz+4gMJuavlaBkv46l5VhDHAcsY0hNcELk0vsU6K5CAfDPYYva/G7AdY7/8hILIuT/yaz5+VOL0xOB0h7I1kfdktj5rpcuucrnfNB4WX/6ok9hU3ReC5el4dpjEs+8WJvFyA8w94gjPE3aMinw6INB2cAIBVRp1R5LDo7S07tB4Zhp9jQ8AayBKqmr4zUf4epGWLmFoH X-Forefront-PRVS: 013568035E X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(7916002)(199003)(189002)(50986999)(50226002)(81156014)(3846002)(8676002)(81166006)(92566002)(6116002)(38730400001)(77096005)(97736004)(2906002)(48376002)(4326007)(50466002)(101416001)(69596002)(47776003)(5660300001)(53416004)(76506005)(7846002)(106356001)(6916009)(7736002)(189998001)(105586002)(36756003)(68736007)(110136003)(33646002)(305945005)(66066001)(5003940100001)(86362001)(42186005);DIR:OUT;SFP:1102;SCL:1;SRVR:AM5PR0801MB2050;H:localhost.sw.ru;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;AM5PR0801MB2050;23:QL38DnA9f1R27P2+RWRnAoDdfr3lhbW5e1BVYDf?= =?us-ascii?Q?rWQ2zljaDQAmnrwQrvn0RUT7oRtxtEbmuPpcIxRzeI7ffNSBl25QfVFQRYF9?= =?us-ascii?Q?67mged9+YCzBfzrsHCLJ/imG5YbL2YEWIpKxGVAE4iC7bpvIFeZi6DoFVGwy?= =?us-ascii?Q?pX/zAcz2bdv7i47Gsk0hV9P47wJM8qpCzTGN1ptYXgHkEVAPyvzMzK9EwXmr?= =?us-ascii?Q?8OnFVxPU4CFeQImXOKjdJTXWlE5hNCCHXZTNzi/HodAcRGkNSxLGSE4e6j/Y?= =?us-ascii?Q?ZezU/OmgUtXt26Ggh/ub1BoMToTsIxZCcLjXO4MOTTVCYBKbZxq2KHpThta9?= =?us-ascii?Q?TLPZtpT1dT5J9VhjYCrdhYJ2p9ffYsgEbA+4O+N1TtBTAXpSkY2+HTG5FibJ?= =?us-ascii?Q?duLfdWR+m6AD3qhWmZhzaCIYmSe9dAHk+qLxJ9JH6aYYvgllXSlOTNx2pHrX?= =?us-ascii?Q?7YOE+FsLpR2uD0M1kf+ddOmoJH5x5iWtMox9YCzx6j8l056+lJo4F3qArG44?= =?us-ascii?Q?mRG0qwmaG2EBFG3zO9/BFq7t9wrWrMGziAJEkuZ54I/rnJPTUsLjHgCY+Uj/?= =?us-ascii?Q?cNbtYk8T9PFuGqiRmkBjeai4lfviv+AeI9Xi1+zLXeMfOBmByL8S/GlkuoXO?= =?us-ascii?Q?vM6YVkoh3/0PJGz/GX/d1T0IlSD8EzxzEblWuOJ6M4HpazWIkfreevTMVNPY?= =?us-ascii?Q?AEprmJQEL8+tOnB27rw3thV0LfOGKiOgRJ2Cp3OemUHL3eOM57wWZCu299t4?= =?us-ascii?Q?o8SfAvN5yO4ZyEkmliaK5tu4wEA7ZdVqMt4GzZ/x1g+rkP7bcHsBf4LU80uD?= =?us-ascii?Q?W2wZv6n5zLyrusI3Ti1M7BAMfhXqUS56LTbrn3mSwPGZvkZe3Y7wZBq2BqKa?= =?us-ascii?Q?d56ZCVVss48ERtI2LFi80TRmXyVYbitLdbKnZHAGigWRQICcV92sY7/MXobo?= =?us-ascii?Q?Km9hYmbs+yyB1vqgj1gAhJVXEZQrE4InpXAMTti4wMTZ1U8Kz+covpa5PWhr?= =?us-ascii?Q?4XtIxrCypjS57BzLZL0tOYKpbojcOpxdaBwQJW6VPsCDTt0j21X6/QVCcrZI?= =?us-ascii?Q?fpjirkYK3fSk8vtziLuV49gU6HNN0?= X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2050;6:65Wm9JzEAFalYE/fWwkzsl77h7lw2nvcD9AkQUdqvyElO+AgUYfEEF1/5jltlfVBYDgpoqtWuVj5qnUJ1sLkN6tma2elLnvjo3MtTWWlz2eh9oMtaG80afKrROWRIBbyGfw61nRWIAgK2hbJdnqK9GhHMqSHpySIyRgBmtNZUKPeT7nQhcescrzRbOOc2qdY3fs1N1RGBPPt77WKnWq7Yqxsg0knSaVcFVzpHmhxrdc2kDnz7TWRjEALeUCz6maZ8ABgH7ZfkVTDd7svjrHfoT2S6TKiOxawNSHJj5kqfCFvpTT29YBxCj7T0ATbZ2FM313OXTe4JiRz/XSpo8XKkiWlWn33ZhmJ/+3A9LXukdRxBltcuY8kEd/tFX52wGpp;5:T4WZkqJr98BUtsXjl74D9R33dXNsBQxLawzkH/3+/X4by3V+ZfJQKH31rwa7VxGZhT7rw/E1ZblhFc1PsE/GirKoG+sC6Wzu3i3Xinbou9lBYJuG83tU4uEqCCzKP3sFHAJOaRz4vYIFIrZkNg83RA==;24:1DpgqrBzLLGYNm33lHCBJKJIBE+oGpMNwqOuqqQtNQEAV2WmIYpb+ZdfLLxo80L1AeGLr76UsyVDAzUdUIEB8Aos4hhr1pYJi5M/6DS7xm4= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB2050;7:2kNv+7DuwoWfv3Jyl4UzbOw2ij5Yt1Fo7A6XZ0Pj6dPYKJo4FX9/8GoCu9KFxgIpSzFocTK/zkfKxsmCfcbVH8EyJqST5DzgqBoiZuIiDEAFASu9iMaVsgib9ouYqnRi19+Obkrs/+tJShSulV4A5Vf6XSCB0oVPyUdc99TEqTi+O6l2d6IHIaKhYMSFOJnz+LvZ3BV98hxEEDOumcY8uXBo8vzzjFI+buSzWk5qEjy8bxII1rzdzkvEVqe9LsAsSb9IboZIQ92COjB4KqvjBl2xpuMT0iXCylPAE9tI68BR+fkCf5hH8A6b9PbzYZXO6LVjI7p5wHQEuJJp0Ms9G8R7ykvkPS+GWe9uhCfYTwo=;20:7s0hcum7YWzjJ+2HqPlDymeZfopXkmcysShV84HnU4BoBkvHqNdJ+tDpepx6gobgvEoZDjfM+3BJJYpXjamOqErfVQJa8KZEKiTGFKdSw+EiWCd0+9NsXaqhVxE6AqAO9PUs7gonWdX+EG775xYzAlzrDGaC35T4/3YZZFleCRY= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Nov 2016 16:17:53.8784 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0801MB2050 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We shouldn't free cert->pub->key in x509_cert_parse() because x509_free_certificate() also does this: BUG: Double free or freeing an invalid pointer ... Call Trace: [] dump_stack+0x63/0x83 [] kasan_object_err+0x21/0x70 [] kasan_report_double_free+0x49/0x60 [] kasan_slab_free+0x9d/0xc0 [] kfree+0x8a/0x1a0 [] public_key_free+0x1f/0x30 [] x509_free_certificate+0x24/0x90 [] x509_cert_parse+0x2bc/0x300 [] x509_key_preparse+0x3e/0x330 [] asymmetric_key_preparse+0x6f/0x100 [] key_create_or_update+0x260/0x5f0 [] SyS_add_key+0x199/0x2a0 [] entry_SYSCALL_64_fastpath+0x1e/0xad Object at ffff880110bd1900, in cache kmalloc-512 size: 512 .... Freed: PID = 2579 [] save_stack_trace+0x1b/0x20 [] save_stack+0x46/0xd0 [] kasan_slab_free+0x73/0xc0 [] kfree+0x8a/0x1a0 [] x509_cert_parse+0x2a3/0x300 [] x509_key_preparse+0x3e/0x330 [] asymmetric_key_preparse+0x6f/0x100 [] key_create_or_update+0x260/0x5f0 [] SyS_add_key+0x199/0x2a0 [] entry_SYSCALL_64_fastpath+0x1e/0xad Fixes: db6c43bd2132 ("crypto: KEYS: convert public key and digsig asym to the akcipher api") Signed-off-by: Andrey Ryabinin Cc: --- crypto/asymmetric_keys/x509_cert_parser.c | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index 865f46e..c80765b 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -133,7 +133,6 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen) return cert; error_decode: - kfree(cert->pub->key); kfree(ctx); error_no_ctx: x509_free_certificate(cert); -- 2.7.3