Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <20210107092855.76093-1-tianjia.zhang@linux.alibaba.com>
References: <20210107092855.76093-1-tianjia.zhang@linux.alibaba.com>
To:     Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Cc:     dhowells@redhat.com, Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>,
        Gilad Ben-Yossef <gilad@benyossef.com>,
        Tobias Markus <tobias@markus-regensburg.de>,
        Tee Hao Wei <angelsl@in04.sg>, keyrings@vger.kernel.org,
        linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org
Subject: Re: [PATCH] X.509: Fix crash caused by NULL pointer
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <772252.1610017082.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Thu, 07 Jan 2021 10:58:02 +0000
Message-ID: <772253.1610017082@warthog.procyon.org.uk>
Precedence: bulk

Tianjia Zhang <tianjia.zhang@linux.alibaba.com> wrote:

> On the following call path, `sig->pkey_algo` is not assigned
> in asymmetric_key_verify_signature(), which causes runtime
> crash in public_key_verify_signature().
> =

>   keyctl_pkey_verify
>     asymmetric_key_verify_signature
>       verify_signature
>         public_key_verify_signature
> =

> This patch simply check this situation and fixes the crash
> caused by NULL pointer.
> =

> Fixes: 215525639631 ("X.509: support OSCCA SM2-with-SM3 certificate veri=
fication")
> Cc: stable@vger.kernel.org # v5.10+
> Reported-by: Tobias Markus <tobias@markus-regensburg.de>
> Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

Looks reasonable:

Acked-by: David Howells <dhowells@redhat.com>

I wonder, though, if cert_sig_digest_update() should be obtained by some s=
ort
of function pointer.  It doesn't really seem to belong in this file.  But =
this
is a separate issue.

David