bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature

__bpf_dynptr_data() can return NULL (FILE dynptrs, any non-contiguous
backing). bpf_verify_pkcs7_signature() forwards the pointer to
verify_pkcs7_signature() unchecked, causing a NULL deref in
asn1_ber_decoder() reachable from a sleepable BPF LSM at lsm.s/bpf.

NULL-check both pointers and reject with -EINVAL. Mirrors the guards
already in kernel/bpf/crypto.c.

Fixes: 865b0566d8f1 ("bpf: Add bpf_verify_pkcs7_signature() kfunc")
Reported-by: Xianrui Dong <dongxianrui1@gmail.com>
Signed-off-by: KP Singh <kpsingh@kernel.org>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Song Liu <song@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260520024059.313468-1-kpsingh@kernel.org
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 2bb60200c2665e40252a2ecb2a6ebef455b0b5ec..b5314c9fed3cf0daa808278337ac831457bec7ae 100644 (file)
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -4241,8 +4241,13 @@ __bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p,
 
        data_len = __bpf_dynptr_size(data_ptr);
        data = __bpf_dynptr_data(data_ptr, data_len);
+       if (!data)
+               return -EINVAL;
+
        sig_len = __bpf_dynptr_size(sig_ptr);
        sig = __bpf_dynptr_data(sig_ptr, sig_len);
+       if (!sig)
+               return -EINVAL;
 
        return verify_pkcs7_signature(data, data_len, sig, sig_len,
                                      trusted_keyring->key,

diff --git a/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c b/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c
index 8cd298b78e44afc26d26475e8c58af5ce87a13d9..04aaf4c9cf5ee2338ceacda3ca4282f33f5ae79a 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c
+++ b/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c
@@ -14,7 +14,7 @@ static struct {
        const char *prog_name;
        int expected_runtime_err;
 } kfunc_dynptr_tests[] = {
-       {"dynptr_data_null", -EBADMSG},
+       {"dynptr_data_null", -EINVAL},
 };
 
 static bool kfunc_not_supported;