Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:
"This fixes two memory leaks and a list corruption bug"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: user - prevent operating on larval algorithms
crypto: cryptd - Fix skcipher instance memory leak
lib/mpi: Fix karactx leak in mpi_powm

+6 -4
+1
crypto/cryptd.c
··· 388 388 struct skcipherd_instance_ctx *ctx = skcipher_instance_ctx(inst); 389 389 390 390 crypto_drop_skcipher(&ctx->spawn); 391 + kfree(inst); 391 392 } 392 393 393 394 static int cryptd_create_skcipher(struct crypto_template *tmpl,
+3
crypto/crypto_user_base.c
··· 44 44 list_for_each_entry(q, &crypto_alg_list, cra_list) { 45 45 int match = 0; 46 46 47 + if (crypto_is_larval(q)) 48 + continue; 49 + 47 50 if ((q->cra_flags ^ p->cru_type) & p->cru_mask) 48 51 continue; 49 52
+2 -4
lib/mpi/mpi-pow.c
··· 24 24 int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) 25 25 { 26 26 mpi_ptr_t mp_marker = NULL, bp_marker = NULL, ep_marker = NULL; 27 + struct karatsuba_ctx karactx = {}; 27 28 mpi_ptr_t xp_marker = NULL; 28 29 mpi_ptr_t tspace = NULL; 29 30 mpi_ptr_t rp, ep, mp, bp; ··· 151 150 int c; 152 151 mpi_limb_t e; 153 152 mpi_limb_t carry_limb; 154 - struct karatsuba_ctx karactx; 155 153 156 154 xp = xp_marker = mpi_alloc_limb_space(2 * (msize + 1)); 157 155 if (!xp) 158 156 goto enomem; 159 157 160 - memset(&karactx, 0, sizeof karactx); 161 158 negative_result = (ep[0] & 1) && base->sign; 162 159 163 160 i = esize - 1; ··· 280 281 if (mod_shift_cnt) 281 282 mpihelp_rshift(rp, rp, rsize, mod_shift_cnt); 282 283 MPN_NORMALIZE(rp, rsize); 283 - 284 - mpihelp_release_karatsuba_ctx(&karactx); 285 284 } 286 285 287 286 if (negative_result && rsize) { ··· 296 299 leave: 297 300 rc = 0; 298 301 enomem: 302 + mpihelp_release_karatsuba_ctx(&karactx); 299 303 if (assign_rp) 300 304 mpi_assign_limb_space(res, rp, size); 301 305 if (mp_marker)