tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

KEYS: prevent NULL pointer dereference in find_asymmetric_key()

In find_asymmetric_key(), if all NULLs are passed in the id_{0,1,2}
arguments, the kernel will first emit WARN but then have an oops
because id_2 gets dereferenced anyway.

Add the missing id_2 check and move WARN_ON() to the final else branch
to avoid duplicate NULL checks.

Found by Linux Verification Center (linuxtesting.org) with Svace static
analysis tool.

Cc: stable@vger.kernel.org # v5.17+
Fixes: 7d30198ee24f ("keys: X.509 public key issuer lookup without AKID")
Suggested-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Roman Smirnov <r.smirnov@omp.ru>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

authored by

Roman Smirnov and committed by
Jarkko Sakkinen 70fd1966 652bfcb7

+4 -3
+4 -3
crypto/asymmetric_keys/asymmetric_type.c
··· 60 60 char *req, *p; 61 61 int len; 62 62 63 - WARN_ON(!id_0 && !id_1 && !id_2); 64 - 65 63 if (id_0) { 66 64 lookup = id_0->data; 67 65 len = id_0->len; 68 66 } else if (id_1) { 69 67 lookup = id_1->data; 70 68 len = id_1->len; 71 - } else { 69 + } else if (id_2) { 72 70 lookup = id_2->data; 73 71 len = id_2->len; 72 + } else { 73 + WARN_ON(1); 74 + return ERR_PTR(-EINVAL); 74 75 } 75 76 76 77 /* Construct an identifier "id:<keyid>". */