Re: [PATCH v5 12/19] crypto: cmh - add RSA akcipher

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] crypto: cmh: partial tfm state corruption on set_pub_key failure
--

commit 245d9a370fc37764e90c38f7f7cb69490074e21e
Author: Alex Ousherovitch <aousherovitch@rambus.com>

crypto: cmh - add RSA akcipher

This commit registers the RSA akcipher algorithm using the CMH PKE core,
supporting encryption, decryption, signing, and verification operations
for multiple key sizes.

> diff --git a/drivers/crypto/cmh/cmh_pke_rsa.c b/drivers/crypto/cmh/cmh_pke_rsa.c
> new file mode 100644
> index 0000000000000..251ae8275865d
> --- /dev/null
> +++ b/drivers/crypto/cmh/cmh_pke_rsa.c
[ ... ]
> +static int cmh_rsa_set_pub_key(struct crypto_akcipher *tfm,
> +			       const void *key, unsigned int keylen)
> +{
> +	struct cmh_rsa_tfm_ctx *ctx = cmh_rsa_ctx(tfm);
> +	struct rsa_key rsa = {};
> +	u32 bits;
> +	int ret;
> +
> +	/*
> +	 * Re-keying: release any private-key state (and its persistent DMA
> +	 * mapping) left by a prior set_priv_key so it is not leaked until
> +	 * exit_tfm and cannot be mistaken for the new public key.
> +	 */
> +	cmh_key_destroy(&ctx->key);
> +
> +	ret = rsa_parse_pub_key(&rsa, key, keylen);
> +	if (ret)
> +		return ret;

[Severity: Medium]
Does this leave the transform in a partially corrupted state if parsing fails?

If cmh_rsa_set_pub_key() is called after a key pair has already been
configured, the private key is destroyed early. If rsa_parse_pub_key() then
fails, the function returns without updating or clearing the existing public
key.

Userspace could potentially trigger this via the AF_ALG socket interface by
passing malformed key material. This would leave the transform in an
inconsistent state where encryption still works using the old public key, but
decryption fails.

Should the old private key be preserved until the new public key is fully
validated, or should the entire transform state be wiped on error?

The same pattern also appears in cmh_rsa_set_priv_key() where the old private
key could be left active while the public key is freed on a failure during
key material setup.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917225929.2494111-1-aousherovitch@rambus.com?part=12