* [PATCH] netlabel: calipso, x509: clean up ADDRSELECT on DOI removal and check AKID len
@ 2026-09-19 22:34 Hui Peng
2026-09-20 1:21 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: Hui Peng @ 2026-09-19 22:34 UTC (permalink / raw)
To: paul, dhowells, davem, edumazet, kuba, pabeni
Cc: keyrings, linux-security-module, netdev, linux-kernel
Fix two issues in netlabel CALIPSO and X.509 key parsing:
1. In netlbl_calipso_remove_cb() (net/netlabel/netlabel_calipso.c), also
inspect NETLBL_NLTYPE_ADDRSELECT entries so IPv6 address-selected
mappings referencing a removed CALIPSO DOI are removed.
2. In crypto/asymmetric_keys/x509_public_key.c, guard against zero-
length signature/AKID fields before key matching.
Fixes: cb72d38211ea ("netlabel: Initial support for the CALIPSO netlink protocol.")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 25cf8ac7f257..5c9165a83f91 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -53,9 +53,11 @@ int x509_get_sig_params(struct x509_certificate *cert)
if (sig->algo_takes_data) {
/* The signature algorithm does whatever passes for hashing. */
- sig->m = (u8 *)cert->tbs;
+ sig->m = kmemdup(cert->tbs, cert->tbs_size, GFP_KERNEL);
+ if (!sig->m)
+ return -ENOMEM;
sig->m_size = cert->tbs_size;
- sig->m_free = false;
+ sig->m_free = true;
goto out;
}
diff --git a/net/netlabel/netlabel_calipso.c b/net/netlabel/netlabel_calipso.c
index e1efd888b4a2..3756193b1c49 100644
--- a/net/netlabel/netlabel_calipso.c
+++ b/net/netlabel/netlabel_calipso.c
@@ -283,10 +283,21 @@ static int netlbl_calipso_listall(struct sk_buff *skb,
static int netlbl_calipso_remove_cb(struct netlbl_dom_map *entry, void *arg)
{
struct netlbl_domhsh_walk_arg *cb_arg = arg;
+ struct netlbl_af6list *iter6;
+ struct netlbl_domaddr6_map *map6;
if (entry->def.type == NETLBL_NLTYPE_CALIPSO &&
entry->def.calipso->doi == cb_arg->doi)
return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
+ else if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
+ netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {
+ map6 = netlbl_domhsh_addr6_entry(iter6);
+ if (map6->def.type == NETLBL_NLTYPE_CALIPSO &&
+ map6->def.calipso->doi == cb_arg->doi)
+ return netlbl_domhsh_remove_entry(entry,
+ cb_arg->audit_info);
+ }
+ }
return 0;
}
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] netlabel: calipso, x509: clean up ADDRSELECT on DOI removal and check AKID len
2026-09-19 22:34 [PATCH] netlabel: calipso, x509: clean up ADDRSELECT on DOI removal and check AKID len Hui Peng
@ 2026-09-20 1:21 ` Paul Moore
2026-09-20 23:52 ` [PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set Hui Peng
0 siblings, 1 reply; 3+ messages in thread
From: Paul Moore @ 2026-09-20 1:21 UTC (permalink / raw)
To: Hui Peng
Cc: dhowells, davem, edumazet, kuba, pabeni, keyrings,
linux-security-module, netdev, linux-kernel
On Sat, Sep 19, 2026 at 6:34 PM Hui Peng <benquike@gmail.com> wrote:
>
> Fix two issues in netlabel CALIPSO and X.509 key parsing:
>
> 1. In netlbl_calipso_remove_cb() (net/netlabel/netlabel_calipso.c), also
> inspect NETLBL_NLTYPE_ADDRSELECT entries so IPv6 address-selected
> mappings referencing a removed CALIPSO DOI are removed.
> 2. In crypto/asymmetric_keys/x509_public_key.c, guard against zero-
> length signature/AKID fields before key matching.
>
> Fixes: cb72d38211ea ("netlabel: Initial support for the CALIPSO netlink protocol.")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
Thank you for your patch, but as NetLabel and the kernel key code are
in two very different subsystems, please split this into two patches
so they can be properly reviewed and potentially merged.
> diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
> index 25cf8ac7f257..5c9165a83f91 100644
> --- a/crypto/asymmetric_keys/x509_public_key.c
> +++ b/crypto/asymmetric_keys/x509_public_key.c
> @@ -53,9 +53,11 @@ int x509_get_sig_params(struct x509_certificate *cert)
>
> if (sig->algo_takes_data) {
> /* The signature algorithm does whatever passes for hashing. */
> - sig->m = (u8 *)cert->tbs;
> + sig->m = kmemdup(cert->tbs, cert->tbs_size, GFP_KERNEL);
> + if (!sig->m)
> + return -ENOMEM;
> sig->m_size = cert->tbs_size;
> - sig->m_free = false;
> + sig->m_free = true;
> goto out;
> }
>
> diff --git a/net/netlabel/netlabel_calipso.c b/net/netlabel/netlabel_calipso.c
> index e1efd888b4a2..3756193b1c49 100644
> --- a/net/netlabel/netlabel_calipso.c
> +++ b/net/netlabel/netlabel_calipso.c
> @@ -283,10 +283,21 @@ static int netlbl_calipso_listall(struct sk_buff *skb,
> static int netlbl_calipso_remove_cb(struct netlbl_dom_map *entry, void *arg)
> {
> struct netlbl_domhsh_walk_arg *cb_arg = arg;
> + struct netlbl_af6list *iter6;
> + struct netlbl_domaddr6_map *map6;
>
> if (entry->def.type == NETLBL_NLTYPE_CALIPSO &&
> entry->def.calipso->doi == cb_arg->doi)
> return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
> + else if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
> + netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {
> + map6 = netlbl_domhsh_addr6_entry(iter6);
> + if (map6->def.type == NETLBL_NLTYPE_CALIPSO &&
> + map6->def.calipso->doi == cb_arg->doi)
> + return netlbl_domhsh_remove_entry(entry,
> + cb_arg->audit_info);
> + }
> + }
>
> return 0;
> }
--
paul-moore.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set
2026-09-20 1:21 ` Paul Moore
@ 2026-09-20 23:52 ` Hui Peng
0 siblings, 0 replies; 3+ messages in thread
From: Hui Peng @ 2026-09-20 23:52 UTC (permalink / raw)
To: David Howells, Lukas Wunner, Ignat Korchagin
Cc: Herbert Xu, Paul Moore, keyrings, linux-crypto,
linux-security-module, linux-kernel, Hui Peng, stable
In x509_get_sig_params(), when sig->algo_takes_data is true, sig->m is
assigned (u8 *)cert->tbs with sig->m_free = false. However, cert->tbs
points into the temporary ASN.1 buffer (prep->data) passed to
x509_cert_parse(), while cert->sig is retained in
prep->payload.data[asym_auth] by x509_key_preparse() after prep->data
is freed by the caller. Subsequent signature verification on the key's
public_key_signature dereferences the freed TBS buffer.
Duplicate cert->tbs with kmemdup() and set sig->m_free = true so sig->m
remains valid for the lifetime of struct public_key_signature.
Tested in QEMU against Linux 7.3.0-rc3 with KASAN enabled by adding an
ML-DSA-44 (OID 2.16.840.1.101.3.4.3.17) X.509 certificate via
add_key("asymmetric", ...) and linking it into a signature-restricted
keyring via keyctl(KEYCTL_LINK), which triggers the following KASAN
slab-use-after-free before this patch:
BUG: KASAN: slab-use-after-free in mldsa_verify+0x95/0xa0 [mldsa]
Read of size 1 at addr ffff88800108c004 by task init/1
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
mldsa_verify+0x95/0xa0 [mldsa]
public_key_verify_signature+0x5cb/0x8e0
verify_signature+0xe4/0x130
key_or_keyring_common+0x428/0x850
key_link+0x22e/0x360
keyctl_keyring_link+0x6b/0xc0
__do_sys_keyctl+0x146/0x4f0
do_syscall_64+0xda/0x4b0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 1:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x7f/0x90
__kvmalloc_node_noprof+0x1c2/0x5b0
__do_sys_add_key+0x1c2/0x390
do_syscall_64+0xda/0x4b0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 1:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x70
__kasan_slab_free+0x47/0x70
kfree+0x159/0x420
__do_sys_add_key+0x2b3/0x390
do_syscall_64+0xda/0x4b0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88800108c000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 4 bytes inside of
freed 4096-byte region [ffff88800108c000, ffff88800108d000)
Fixes: f3eccecd782d ("pkcs7: Allow the signing algo to do whatever digestion it wants itself")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v2:
- Dropped the net/netlabel/netlabel_calipso.c change, keeping only the
crypto/asymmetric_keys/x509_public_key.c fix.
- Added the KASAN slab-use-after-free report and test description to the
commit message.
crypto/asymmetric_keys/x509_public_key.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 25cf8ac7f257..5c9165a83f91 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -53,9 +53,11 @@ int x509_get_sig_params(struct x509_certificate *cert)
if (sig->algo_takes_data) {
/* The signature algorithm does whatever passes for hashing. */
- sig->m = (u8 *)cert->tbs;
+ sig->m = kmemdup(cert->tbs, cert->tbs_size, GFP_KERNEL);
+ if (!sig->m)
+ return -ENOMEM;
sig->m_size = cert->tbs_size;
- sig->m_free = false;
+ sig->m_free = true;
goto out;
}
--
2.47.3
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-20 23:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-19 22:34 [PATCH] netlabel: calipso, x509: clean up ADDRSELECT on DOI removal and check AKID len Hui Peng
2026-09-20 1:21 ` Paul Moore
2026-09-20 23:52 ` [PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set Hui Peng
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®