Commit 1b86a3bd authored by Tianjia Zhang's avatar Tianjia Zhang Committed by felix
Browse files

crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init 

stable inclusion
from stable-v5.10.210
commit 0c3687822259a7628c85cd21a3445cbe3c367165
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JP7
CVE: CVE-2023-52616

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0c3687822259a7628c85cd21a3445cbe3c367165



--------------------------------

[ Upstream commit ba3c5574203034781ac4231acf117da917efcd2a ]

When the mpi_ec_ctx structure is initialized, some fields are not
cleared, causing a crash when referencing the field when the
structure was released. Initially, this issue was ignored because
memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.
For example, this error will be triggered when calculating the
Za value for SM2 separately.

Fixes: d58bb7e5 ("lib/mpi: Introduce ec implementation to MPI library")
Cc: stable@vger.kernel.org # v6.5
Signed-off-by: default avatarTianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarFelix Fu <fuzhen5@huawei.com>
parent c2bdc9e9

lib/mpi/ec.c

+3 −0
Original line number Diff line number Diff line
@@ -584,6 +584,9 @@ void mpi_ec_init(struct mpi_ec_ctx *ctx, enum gcry_mpi_ec_models model, 
	ctx->a = mpi_copy(a);

	ctx->b = mpi_copy(b);



	ctx->d = NULL;

	ctx->t.two_inv_p = NULL;



	ctx->t.p_barrett = use_barrett > 0 ? mpi_barrett_init(ctx->p, 0) : NULL;



	mpi_ec_get_reset(ctx);