David Howells 23c8a812dc KEYS: Fix ASN.1 indefinite length object parsing ... This fixes CVE-2016-0758. In the ASN.1 decoder, when the length field of an ASN.1 value is extracted, it isn't validated against the remaining amount of data before being added to the cursor. With a sufficiently large size indicated, the check: datalen - dp < 2 may then fail due to integer overflow. Fix this by checking the length indicated against the amount of remaining data in both places a definite length is determined. Whilst we're at it, make the following changes: (1) Check the maximum size of extended length does not exceed the capacity of the variable it's being stored in (len) rather than the type that variable is assumed to be (size_t). (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the integer 0. (3) To reduce confusion, move the initialisation of len outside of: for (len = 0; n > 0; n--) { since it doesn't have anything to do with the loop counter n. Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Acked-by: David Woodhouse <David.Woodhouse@intel.com> Acked-by: Peter Jones <pjones@redhat.com>		2016-05-12 12:01:49 +01:00
..
842	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2016-03-17 21:38:27 -07:00
fonts
lz4	lib: lz4: cleanup unaligned access efficiency detection	2016-04-13 09:22:49 -07:00
lzo
mpi	lib/mpi: use "static inline" instead of "extern inline"	2016-02-28 03:26:34 +08:00
raid6	powerpc: Create disable_kernel_{fp,altivec,vsx,spe}()	2015-12-01 13:52:25 +11:00
reed_solomon
xz
zlib_deflate	zlib_deflate/deftree: remove bi_reverse()	2015-09-10 13:29:01 -07:00
zlib_inflate
.gitignore
argv_split.c
asn1_decoder.c	KEYS: Fix ASN.1 indefinite length object parsing	2016-05-12 12:01:49 +01:00
assoc_array.c	assoc_array: don't call compare_object() on a node	2016-04-06 14:06:48 +01:00
atomic64.c
atomic64_test.c	x86/cpufeature: Carve out X86_FEATURE_*	2016-01-30 11:22:17 +01:00
audit.c
bcd.c
bch.c
bitmap.c	lib/bitmap.c: conversion routines to/from u32 array	2016-02-19 22:54:09 -05:00
bitrev.c
bsearch.c
btree.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
bug.c	lib/bug.c: use common WARN helper	2016-03-17 15:09:34 -07:00
build_OID_registry
bust_spinlocks.c
check_signature.c
checksum.c	ipv4: Update parameters for csum_tcpudp_magic to their original types	2016-03-13 23:55:13 -04:00
clz_ctz.c
clz_tab.c
cmdline.c
compat_audit.c
cordic.c
cpu-notifier-error-inject.c
cpu_rmap.c
cpumask.c	cpumask: Export cpumask_any_but()	2016-02-29 09:35:20 +01:00
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c
crc7.c
crc8.c
crc16.c
crc32.c
crc32defs.h
ctype.c
debug_info.c
debug_locks.c
debugobjects.c	debugobjects: Allow bigger number of early boot objects	2016-01-27 15:40:59 +01:00
dec_and_lock.c
decompress.c
decompress_bunzip2.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_inflate.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_unlz4.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_unlzma.c	lib/decompress_unlzma: Do a NULL check for pointer	2015-09-10 13:29:01 -07:00
decompress_unlzo.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
decompress_unxz.c	lib/decompressors: use real out buf size for gunzip with kernel	2015-09-10 13:29:01 -07:00
devres.c	devres: use to_pci_dev()	2016-02-07 23:17:59 -08:00
digsig.c	KEYS: Merge the type-specific data with the payload data	2015-10-21 15:18:36 +01:00
div64.c	__div64_32(): make it overridable at compile time	2015-11-16 14:42:12 -05:00
dma-debug.c	dma-debug: switch check from _text to _stext	2016-01-14 16:00:49 -08:00
dma-noop.c	dma: Provide simple noop dma ops	2016-03-02 17:01:55 +02:00
dump_stack.c	dump_stack: avoid potential deadlocks	2016-02-05 18:10:40 -08:00
dynamic_debug.c	convert a bunch of open-coded instances of memdup_user_nul()	2016-01-04 10:26:58 -05:00
dynamic_queue_limits.c
earlycpio.c
extable.c	extable: add support for relative extables to search and sort routines	2016-02-24 14:57:26 +00:00
fault-inject.c	fault-inject: fix inverted interval/probability values in printk	2015-10-23 17:55:10 +09:00
fdt.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
find_bit.c
flex_array.c
flex_proportions.c	lib+mm: fix few spelling mistakes	2016-02-15 11:18:23 +01:00
gcd.c
gen_crc32table.c
genalloc.c	CPM/QE: use genalloc to manage CPM/QE muram	2015-12-22 17:10:18 -06:00
glob.c
halfmd4.c	lib/halfmd4.c: use rol32 inline function in the ROUND macro	2015-11-06 17:50:42 -08:00
hexdump.c	lib/hexdump.c: truncate output in case of overflow	2015-11-06 17:50:42 -08:00
hweight.c
idr.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
inflate.c
int_sqrt.c
interval_tree.c
interval_tree_test.c
iomap.c
iomap_copy.c	lib/iomap_copy.c: add __ioread32_copy()	2016-01-20 17:09:18 -08:00
iommu-common.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc	2015-11-05 16:34:48 -08:00
iommu-helper.c
ioremap.c
iov_iter.c	iov_iter: export import_single_range()	2015-12-06 20:42:19 -05:00
irq_poll.c	irq_poll: Fix irq_poll_sched()	2016-01-19 15:26:55 -05:00
irq_regs.c
is_single_threaded.c	lib/is_single_threaded.c: change current_is_single_threaded() to use for_each_thread()	2015-11-06 17:50:42 -08:00
jedec_ddr_data.c
kasprintf.c	lib/kasprintf.c: add sanity check to kvasprintf	2016-01-16 11:17:27 -08:00
Kconfig	mm, kasan: stackdepot implementation. Enable stackdepot for SLAB	2016-03-25 16:37:42 -07:00
Kconfig.debug	parisc,metag: Implement CONFIG_DEBUG_STACK_USAGE option	2016-03-23 15:44:34 +01:00
Kconfig.kasan	mm, kasan: stackdepot implementation. Enable stackdepot for SLAB	2016-03-25 16:37:42 -07:00
Kconfig.kgdb
Kconfig.kmemcheck
Kconfig.ubsan	ubsan: fix tree-wide -Wmaybe-uninitialized false positives	2016-03-22 15:36:02 -07:00
kfifo.c
klist.c	klist: fix starting point removed bug in klist iterators	2016-02-07 22:18:47 -08:00
kobject.c	kobject: export kset_find_obj() for module use	2016-02-09 17:36:34 -08:00
kobject_uevent.c
kstrtox.c	lib: add "on"/"off" support to kstrtobool	2016-03-17 15:09:34 -07:00
kstrtox.h
lcm.c
libcrc32c.c	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2016-01-22 11:58:43 -08:00
list_debug.c	list: kill list_force_poison()	2016-03-09 15:43:42 -08:00
list_sort.c
llist.c	lib/llist.c: fix data race in llist_del_first	2015-11-06 17:50:42 -08:00
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c
lockref.c
lru_cache.c	lru_cache: Converted lc_seq_printf_status to return void	2015-11-25 09:22:02 -07:00
Makefile	mm, kasan: stackdepot implementation. Enable stackdepot for SLAB	2016-03-25 16:37:42 -07:00
md5.c
memory-notifier-error-inject.c
memweight.c
net_utils.c
netdev-notifier-error-inject.c	net: Add support for CHANGEUPPER notifier error injection	2015-12-03 11:49:23 -05:00
nlattr.c
nmi_backtrace.c	ARM: 8439/1: Fix backtrace generation when IPI is masked	2015-10-03 16:40:51 +01:00
notifier-error-inject.c
notifier-error-inject.h
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c	once: make helper generic for calling functions once	2015-10-08 05:26:36 -07:00
parser.c
pci_iomap.c	libnvdimm for 4.3:	2015-09-08 14:35:59 -07:00
percpu-refcount.c	lib+mm: fix few spelling mistakes	2016-02-15 11:18:23 +01:00
percpu_counter.c
percpu_ida.c	mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM	2015-11-06 17:50:42 -08:00
percpu_test.c
plist.c
pm-notifier-error-inject.c
proportions.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
radix-tree.c	radix_tree: add radix_tree_dump	2016-03-17 15:09:34 -07:00
random32.c	netfilter: meta: add PRANDOM support	2016-02-29 13:55:59 +01:00
ratelimit.c	ratelimit: fix bug in time interval by resetting right begin time	2016-01-21 17:20:51 -08:00
rational.c
rbtree.c
rbtree_test.c
reciprocal_div.c
rhashtable.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-12-31 18:20:10 -05:00
scatterlist.c	scatterlist: fix a typo in comment block of sg_miter_stop()	2016-02-08 10:15:17 -08:00
seq_buf.c	tracing: Use seq_buf_used() in seq_buf_to_user() instead of len	2015-12-23 14:27:20 -05:00
sg_split.c
sha1.c
show_mem.c	lib/show_mem.c: correct reserved memory calculation	2015-09-08 15:35:28 -07:00
smp_processor_id.c
sort.c
stackdepot.c	lib/stackdepot: avoid to return 0 handle	2016-05-05 17:38:53 -07:00
stmp_device.c
string.c	lib: move strtobool() to kstrtobool()	2016-03-17 15:09:34 -07:00
string_helpers.c	string_helpers: fix precision loss for some inputs	2016-01-20 17:09:18 -08:00
strncpy_from_user.c	Use the new batched user accesses in generic user string handling	2015-12-17 10:05:19 -08:00
strnlen_user.c	Use the new batched user accesses in generic user string handling	2015-12-17 10:05:19 -08:00
swiotlb.c
syscall.c
test-kstrtox.c	kstrto*: accept "-0" for signed conversion	2015-09-10 13:29:01 -07:00
test-string_helpers.c	lib/test-string_helpers.c: fix and improve string_get_size() tests	2016-02-03 08:28:43 -08:00
test_bitmap.c	test_bitmap: unit tests for lib/bitmap.c	2016-02-19 22:54:09 -05:00
test_bpf.c	lib/test_bpf: Add additional BPF_ADD tests	2016-04-06 16:47:51 -04:00
test_firmware.c	test: firmware_class: add asynchronous request trigger	2016-01-07 13:44:22 -07:00
test_hexdump.c	test_hexdump: print statistics at the end	2016-01-20 17:09:18 -08:00
test_kasan.c	kasan: test fix: warn if the UAF could not be detected in kmalloc_uaf2	2016-03-25 16:37:42 -07:00
test_module.c
test_printf.c	mm, printk: introduce new format string for flags	2016-03-15 16:55:16 -07:00
test_rhashtable.c	rhashtable-test: allow to retry even if -ENOMEM was returned	2015-11-23 12:36:08 -05:00
test_static_key_base.c
test_static_keys.c	locking/static_keys: Avoid nested functions	2016-02-09 10:27:29 +01:00
test_user_copy.c
textsearch.c
timerqueue.c
ts_bm.c
ts_fsm.c
ts_kmp.c
ubsan.c	UBSAN: run-time undefined behavior sanity checker	2016-01-20 17:09:18 -08:00
ubsan.h	UBSAN: run-time undefined behavior sanity checker	2016-01-20 17:09:18 -08:00
ucs2_string.c	lib/ucs2_string: Correct ucs2 -> utf8 conversion	2016-02-16 12:49:05 +00:00
usercopy.c
uuid.c
vsprintf.c	sscanf: implement basic character sets	2016-03-17 15:09:34 -07:00