KP Singh 49b18315be bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature ...

__bpf_dynptr_data() can return NULL (FILE dynptrs, any non-contiguous
backing). bpf_verify_pkcs7_signature() forwards the pointer to
verify_pkcs7_signature() unchecked, causing a NULL deref in
asn1_ber_decoder() reachable from a sleepable BPF LSM at lsm.s/bpf.

NULL-check both pointers and reject with -EINVAL. Mirrors the guards
already in kernel/bpf/crypto.c.

Fixes: 865b0566d8 ("bpf: Add bpf_verify_pkcs7_signature() kfunc")
Reported-by: Xianrui Dong <[email protected]>
Signed-off-by: KP Singh <[email protected]>
Reviewed-by: Amery Hung <[email protected]>
Acked-by: Song Liu <[email protected]>
Acked-by: Daniel Borkmann <[email protected]>
Link: https://lore.kernel.org/bpf/[email protected]
Signed-off-by: Kumar Kartikeya Dwivedi <[email protected]>

2026-05-20 05:12:05 +02:00

..

preload

…

arena.c

bpf: Fix off-by-one boundary validation in arena direct-value access

2026-05-09 16:18:39 -07:00

arraymap.c

bpf: Use array_map_meta_equal for percpu array inner map replacement

2026-05-14 08:18:50 -07:00

backtrack.c

bpf: Move backtracking logic to backtrack.c

2026-04-12 12:36:58 -07:00

bloom_filter.c

bpf: Lose const-ness of map in map_check_btf()

2026-02-27 15:39:00 -08:00

bpf_cgrp_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

bpf_inode_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

bpf_insn_array.c

bpf: Lose const-ness of map in map_check_btf()

2026-02-27 15:39:00 -08:00

bpf_iter.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

bpf_local_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

bpf_lru_list.c

…

bpf_lru_list.h

…

bpf_lsm_proto.c

…

bpf_lsm.c

bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

2026-04-07 07:57:07 -07:00

bpf_struct_ops.c

bpf: Dissociate struct_ops program with map if map_update fails

2026-04-17 12:04:14 -07:00

bpf_task_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

btf_iter.c

…

btf_relocate.c

…

btf.c

btf: Support kernel parsing of BTF with layout info

2026-03-26 13:53:56 -07:00

cfg.c

bpf: Check global subprog exception paths

2026-05-17 11:15:05 -07:00

cgroup_iter.c

…

cgroup.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

check_btf.c

bpf: Move BTF checking logic into check_btf.c

2026-04-12 12:37:04 -07:00

const_fold.c

bpf: Add bpf_compute_const_regs() and bpf_prune_dead_branches() passes

2026-04-03 08:34:36 -07:00

core.c

bpf: Fix s16 truncation for large bpf-to-bpf call offsets

2026-05-11 08:27:02 -07:00

cpumap.c

bpf: Add missing XDP_ABORTED handling in cpumap

2026-03-03 08:37:21 -08:00

cpumask.c

…

crypto.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

devmap.c

bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path

2026-03-24 15:17:20 -07:00

disasm.c

…

disasm.h

…

dispatcher.c

…

dmabuf_iter.c

…

fixups.c

bpf: Fix s16 truncation for large bpf-to-bpf call offsets

2026-05-11 08:27:02 -07:00

hashtab.c

Merge patch series "bpf: Fix OOB in pcpu_init_value and add a test"

2026-04-12 13:36:55 -07:00

helpers.c

bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature

2026-05-20 05:12:05 +02:00

inode.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

Kconfig

…

kmem_cache_iter.c

…

link_iter.c

…

liveness.c

bpf: Don't run arg-tracking analysis twice on main subprog

2026-05-09 16:12:40 -07:00

local_storage.c

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

2026-04-05 18:45:05 -07:00

log.c

bpf: poison dead stack slots

2026-04-10 15:13:38 -07:00

lpm_trie.c

bpf: Lose const-ness of map in map_check_btf()

2026-02-27 15:39:00 -08:00

Makefile

bpf: Move BTF checking logic into check_btf.c

2026-04-12 12:37:04 -07:00

map_in_map.c

…

map_in_map.h

…

map_iter.c

…

memalloc.c

bpf: Retire rcu_trace_implies_rcu_gp()

2026-04-07 12:24:49 -07:00

mmap_unlock_work.h

…

mprog.c

…

net_namespace.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

offload.c

bpf: Fix use-after-free in offloaded map/prog info fill

2026-04-09 13:24:32 -07:00

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

…

range_tree.c

…

range_tree.h

…

relo_core.c

…

reuseport_array.c

…

ringbuf.c

…

rqspinlock.c

Merge tag 'mm-nonmm-stable-2026-02-12-10-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-02-12 12:13:01 -08:00

rqspinlock.h

…

stackmap.c

…

states.c

bpf: Move state equivalence logic to states.c

2026-04-12 12:36:52 -07:00

stream.c

bpf: Add bpf_stream_print_stack stack dumping kfunc

2026-02-03 10:41:16 -08:00

syscall.c

bpf: Fix s16 truncation for large bpf-to-bpf call offsets

2026-05-11 08:27:02 -07:00

sysfs_btf.c

…

task_iter.c

bpf: return VMA snapshot from task_vma iterator

2026-04-10 12:05:16 -07:00

tcx.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

tnum.c

bpf: Simplify tnum_step()

2026-03-24 08:45:29 -07:00

token.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

trampoline.c

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

2026-03-03 15:13:51 -08:00

verifier.c

bpf: Check global subprog exception paths

2026-05-17 11:15:05 -07:00