lib/mpi: Fix karactx leak in mpi_powm (c8ea9fce) · Commits · 戴 / test

Sometimes mpi_powm will leak karactx because a memory allocation failure causes a bail-out that skips the freeing of karactx. This patch moves the freeing of karactx to the end of the function like everything else so that it can't be skipped. Reported-by:

<syzbot+f7baccc38dcc1e094e77@syzkaller.appspotmail.com> Fixes: ("crypto: GnuPG based MPI lib - source files...") Cc: <stable@vger.kernel.org> Signed-off-by:

Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by:

Eric Biggers <ebiggers@kernel.org> Signed-off-by:

Herbert Xu <herbert@gondor.apana.org.au>

lib/mpi/mpi-pow.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -37,6 +37,7 @@
		int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
		{
		mpi_ptr_t mp_marker = NULL, bp_marker = NULL, ep_marker = NULL;
		struct karatsuba_ctx karactx = {};
		mpi_ptr_t xp_marker = NULL;
		mpi_ptr_t tspace = NULL;
		mpi_ptr_t rp, ep, mp, bp;
		@@ -163,13 +164,11 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
		int c;
		mpi_limb_t e;
		mpi_limb_t carry_limb;
		struct karatsuba_ctx karactx;

		xp = xp_marker = mpi_alloc_limb_space(2 * (msize + 1));
		if (!xp)
		goto enomem;

		memset(&karactx, 0, sizeof karactx);
		negative_result = (ep[0] & 1) && base->sign;

		i = esize - 1;
		@@ -294,8 +293,6 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
		if (mod_shift_cnt)
		mpihelp_rshift(rp, rp, rsize, mod_shift_cnt);
		MPN_NORMALIZE(rp, rsize);

		mpihelp_release_karatsuba_ctx(&karactx);
		}

		if (negative_result && rsize) {
		@@ -312,6 +309,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
		leave:
		rc = 0;
		enomem:
		mpihelp_release_karatsuba_ctx(&karactx);
		if (assign_rp)
		mpi_assign_limb_space(res, rp, size);
		if (mp_marker)

Admin message