Re: [PATCH v2] lib/crypto/mpi: Fix heap OOB write in mpi_powm() when res aliases input

[Eric Biggers <ebiggers@kernel.org>]

On Mon, Nov 02, 2026 at 09:25:50AM +0000, Maholi Tumanggor wrote:
> When mpi_powm() is called with res->alloced < size and res->d aliases
> base->d or exp->d, assign_rp is set to 1 and a new buffer is allocated
> for rp. However the final write-back block unconditionally writes the
> result into res->d (the original undersized buffer) instead of rp,
> causing a heap out-of-bounds write and a subsequent use-after-free when
> mpi_assign_limb_space() frees and re-assigns the corrupted buffer.
> 
> The previous fix (v1) introduced a new issue: inside the exponentiation
> loop rp and xp are swapped after each squaring/multiplication step, so
> after the loop rp may point to xp_marker instead of the originally
> allocated buffer. Fix by saving the allocation pointer in rp_alloc at
> the time of allocation, then using rp_alloc as the write-back destination
> so mpi_assign_limb_space() always receives the correct buffer regardless
> of how many swaps occurred in the loop.
> 
> Confirmed via SLUB debug (slub_debug=FZPU) on kernel 6.8.0-147-generic
> (Ubuntu 24.04): two BUG reports (Right Redzone overwritten and Freepointer
> corrupt) are triggered by mpi_powm(base, base, exp, mod) with base->alloced
> smaller than required, and are absent after this fix.
> 
> Signed-off-by: Maholi Tumanggor <maholitumanggor@gmail.com>

Is this issue actually reachable from any existing kernel code, such as
RSA or DH?  The commit message needs to mention this.  If it's
reachable, explain how to reach it.

If this fixes a bug, there also needs to be a Fixes tag.  Fixing a bug
in a previous, unapplied version of this same patch doesn't count.

And finally, please see the Sashiko review, which had a finding.

- Eric