github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

crypto: caam - fix double-free in caam_rsa_set_priv_key_form()

Browse Source 
caam_rsa_set_priv_key_form() frees the partially allocated key
components (p, q, tmp1, tmp2, dp, dq) with kfree_sensitive() on its
error path, but does not set those pointers to NULL afterward.

When the function returns an error, caam_rsa_set_priv_key() jumps to
its err label and calls caam_rsa_free_key(), which frees all of those
same pointers again, resulting in a double-free.

This is reachable when the allocation of q, tmp1, tmp2, dp, dq or qinv
fails, e.g. under memory pressure, or for a malformed key whose CRT
members decode to zero length and make caam_read_rsa_crt() return NULL.

Set each pointer to NULL right after freeing it so that the subsequent
caam_rsa_free_key() call becomes a no-op for the already-freed fields.

Fixes: 52e26d77b8 ("crypto: caam - add support for RSA key form 2")
Cc: stable@vger.kernel.org
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
Reviewed-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
ZhaoJinming 2026-09-23 18:14:57 +08:00 committed by Herbert Xu
parent e620245bff
commit a91d9346a7
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/crypto/caam/caampkc.c
View File

@ -1033,16 +1033,22 @@ static int caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
free_dq:
kfree_sensitive(rsa_key->dq);
rsa_key->dq = NULL;
free_dp:
kfree_sensitive(rsa_key->dp);
rsa_key->dp = NULL;
free_tmp2:
kfree_sensitive(rsa_key->tmp2);
rsa_key->tmp2 = NULL;
free_tmp1:
kfree_sensitive(rsa_key->tmp1);
rsa_key->tmp1 = NULL;
free_q:
kfree_sensitive(rsa_key->q);
rsa_key->q = NULL;
free_p:
kfree_sensitive(rsa_key->p);
rsa_key->p = NULL;
return -ENOMEM;
}