From patchwork Thu Dec 14 03:08:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tianjia Zhang X-Patchwork-Id: 178438 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:3b04:b0:fb:cd0c:d3e with SMTP id c4csp8289790dys; Wed, 13 Dec 2023 19:08:53 -0800 (PST) X-Google-Smtp-Source: AGHT+IHjdqgy4999TJNCZo4AbvTJwmBDWtxEuvzUcSoT9cYCNWEeHHlRDSJAHGsCy6ETssF20M1q X-Received: by 2002:a05:6a20:8e0a:b0:18d:10d7:3313 with SMTP id y10-20020a056a208e0a00b0018d10d73313mr12459287pzj.20.1702523333617; Wed, 13 Dec 2023 19:08:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702523333; cv=none; d=google.com; s=arc-20160816; b=VqtokDNQWNWc0Kn+dWf0nY2vvj5Ry5Gi54lxUIpjT8W+l/yfC9zVfMpWyH2+RhSeJh bWOePIpTKVES0vpvw3AJ0vXkSBpojrR/DMJbjXIc6xpfE9r6BPD6lUhENtszMYDW971a 5HSP2PtRKu1u9zGuvT/BkKBV8KIJ1MSE1KR1gxHEQ/jwD7hJ6EmLNTEN5Nz4xDxqRLxc rDxrMqm4HQ+JXUo7w9RNp9NmQ+oqH9pCQTF0IHUluRqYDRxHo9K1lXeFLX+h0qFAJE4l b7HSBrq+xkSY6iPj7eagASbPl/VSihDiryjM58ZhCCdnJxrekP6/dq99QkBAKanx9Mcx nHEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=6eA1O30RGkm4+e0jHK53dR7i+TD0qTNRQc7drrhGtwo=; fh=/TS/mHffID6mRuPMVSBxRtbxR/d15Bs0u95gmaNOlzE=; b=uoejZRMSyWhFNBY+m2eOmTZtkpo/OvTJO4CgsVLD4+lsU1dohNNkSDjFamn+u1ctNc 9Ov9spIXHRHarvoJXuWSvhToeVP5OjCthyUxG5PEk4pYrZHB8o8IHUhCuSiXTBWoiugJ VwiRMblo00ZLgkeBoo8N5N0OtFa8wtw8YJ3NzvJYTjDhOrpCoHBQ99Uy6tyFI6MqUe5u lmGjj/6cpoTA20XMqMPY0Q+fzM5gnaOVRmjY8xMfVt0p1w3G8azHyvNsJOqFUBl+WT05 0TsIvC5vMO6Wk0nR3HKgtC2sGVOeS6CYajOzKbzZhYSJSIU74+DemMBzBNJqyVd652kb n8WQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from fry.vger.email (fry.vger.email. [23.128.96.38]) by mx.google.com with ESMTPS id v67-20020a632f46000000b005c66e020cbdsi10341310pgv.709.2023.12.13.19.08.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Dec 2023 19:08:53 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by fry.vger.email (Postfix) with ESMTP id 1D9BD8087B4B; Wed, 13 Dec 2023 19:08:51 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at fry.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230117AbjLNDId (ORCPT + 99 others); Wed, 13 Dec 2023 22:08:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59542 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229525AbjLNDId (ORCPT ); Wed, 13 Dec 2023 22:08:33 -0500 Received: from out30-97.freemail.mail.aliyun.com (out30-97.freemail.mail.aliyun.com [115.124.30.97]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C6253D0; Wed, 13 Dec 2023 19:08:37 -0800 (PST) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R191e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046050;MF=tianjia.zhang@linux.alibaba.com;NM=1;PH=DS;RN=6;SR=0;TI=SMTPD_---0VySjsdn_1702523314; Received: from localhost(mailfrom:tianjia.zhang@linux.alibaba.com fp:SMTPD_---0VySjsdn_1702523314) by smtp.aliyun-inc.com; Thu, 14 Dec 2023 11:08:35 +0800 From: Tianjia Zhang To: Herbert Xu , "David S. Miller" , Mimi Zohar , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Tianjia Zhang Subject: [PATCH] crypto: lib/mpi - Fix unexpected pointer access Date: Thu, 14 Dec 2023 11:08:34 +0800 Message-Id: <20231214030834.2665-1-tianjia.zhang@linux.alibaba.com> X-Mailer: git-send-email 2.24.3 (Apple Git-128) MIME-Version: 1.0 X-Spam-Status: No, score=-0.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE, UNPARSEABLE_RELAY autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on fry.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (fry.vger.email [0.0.0.0]); Wed, 13 Dec 2023 19:08:51 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1785225106900369772 X-GMAIL-MSGID: 1785225106900369772 When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately. Fixes: d58bb7e55a8a ("lib/mpi: Introduce ec implementation to MPI library") Cc: stable@vger.kernel.org # v6.5 Signed-off-by: Tianjia Zhang --- lib/crypto/mpi/ec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/crypto/mpi/ec.c b/lib/crypto/mpi/ec.c index 40f5908e57a4..e16dca1e23d5 100644 --- a/lib/crypto/mpi/ec.c +++ b/lib/crypto/mpi/ec.c @@ -584,6 +584,9 @@ void mpi_ec_init(struct mpi_ec_ctx *ctx, enum gcry_mpi_ec_models model, ctx->a = mpi_copy(a); ctx->b = mpi_copy(b); + ctx->d = NULL; + ctx->t.two_inv_p = NULL; + ctx->t.p_barrett = use_barrett > 0 ? mpi_barrett_init(ctx->p, 0) : NULL; mpi_ec_get_reset(ctx);