Eric Lee / smarc-uboot

Download as
Browse Code ยป

Commit 8a682e03d7d18b3d20810ea83fcec69f8d09c909

Authored by Simon Glass
Committed by Tom Rini
1 parent dd0ee9ea85
Exists in smarc_8mq_lf_v2020.04 and in 11 other branches 8qm-imx_v2020.04_5.4.70_2.3.0, emb_lf_v2022.04, pitx_8mp_lf_v2020.04, smarc-8m-android-10.0.0_2.6.0, smarc-8m-android-11.0.0_2.0.0, smarc-8mp-android-11.0.0_2.0.0, smarc_8m-imx_v2019.04_4.19.35_1.1.0, smarc_8mm-imx_v2019.04_4.19.35_1.1.0, smarc_8mm-imx_v2020.04_5.4.24_2.1.0, smarc_8mp_lf_v2020.04, smarc_8mq-imx_v2020.04_5.4.24_2.1.0

rsa: Fix missing memory leak on error in fdt_add_bignum() 

Thsi function can fail without freeing all its memory. Fix it.

Reported-by: Coverity (CID: 131217)
Signed-off-by: Simon Glass <sjg@chromium.org>

Showing 1 changed file with 10 additions and 3 deletions Inline Diff

1 // SPDX-License-Identifier: GPL-2.0+ 1 // SPDX-License-Identifier: GPL-2.0+
2 /* 2 /*
3 * Copyright (c) 2013, Google Inc. 3 * Copyright (c) 2013, Google Inc.
4 */ 4 */
5 5
6 #include "mkimage.h" 6 #include "mkimage.h"
7 #include <stdio.h> 7 #include <stdio.h>
8 #include <string.h> 8 #include <string.h>
9 #include <image.h> 9 #include <image.h>
10 #include <time.h> 10 #include <time.h>
11 #include <openssl/bn.h> 11 #include <openssl/bn.h>
12 #include <openssl/rsa.h> 12 #include <openssl/rsa.h>
13 #include <openssl/pem.h> 13 #include <openssl/pem.h>
14 #include <openssl/err.h> 14 #include <openssl/err.h>
15 #include <openssl/ssl.h> 15 #include <openssl/ssl.h>
16 #include <openssl/evp.h> 16 #include <openssl/evp.h>
17 #include <openssl/engine.h> 17 #include <openssl/engine.h>
18 18
19 #if OPENSSL_VERSION_NUMBER >= 0x10000000L 19 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
20 #define HAVE_ERR_REMOVE_THREAD_STATE 20 #define HAVE_ERR_REMOVE_THREAD_STATE
21 #endif 21 #endif
22 22
23 #if OPENSSL_VERSION_NUMBER < 0x10100000L 23 #if OPENSSL_VERSION_NUMBER < 0x10100000L
24 static void RSA_get0_key(const RSA *r, 24 static void RSA_get0_key(const RSA *r,
25 const BIGNUM **n, const BIGNUM **e, const BIGNUM **d) 25 const BIGNUM **n, const BIGNUM **e, const BIGNUM **d)
26 { 26 {
27 if (n != NULL) 27 if (n != NULL)
28 *n = r->n; 28 *n = r->n;
29 if (e != NULL) 29 if (e != NULL)
30 *e = r->e; 30 *e = r->e;
31 if (d != NULL) 31 if (d != NULL)
32 *d = r->d; 32 *d = r->d;
33 } 33 }
34 #endif 34 #endif
35 35
36 static int rsa_err(const char *msg) 36 static int rsa_err(const char *msg)
37 { 37 {
38 unsigned long sslErr = ERR_get_error(); 38 unsigned long sslErr = ERR_get_error();
39 39
40 fprintf(stderr, "%s", msg); 40 fprintf(stderr, "%s", msg);
41 fprintf(stderr, ": %s\n", 41 fprintf(stderr, ": %s\n",
42 ERR_error_string(sslErr, 0)); 42 ERR_error_string(sslErr, 0));
43 43
44 return -1; 44 return -1;
45 } 45 }
46 46
47 /** 47 /**
48 * rsa_pem_get_pub_key() - read a public key from a .crt file 48 * rsa_pem_get_pub_key() - read a public key from a .crt file
49 * 49 *
50 * @keydir: Directory containins the key 50 * @keydir: Directory containins the key
51 * @name Name of key file (will have a .crt extension) 51 * @name Name of key file (will have a .crt extension)
52 * @rsap Returns RSA object, or NULL on failure 52 * @rsap Returns RSA object, or NULL on failure
53 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 53 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL)
54 */ 54 */
55 static int rsa_pem_get_pub_key(const char *keydir, const char *name, RSA **rsap) 55 static int rsa_pem_get_pub_key(const char *keydir, const char *name, RSA **rsap)
56 { 56 {
57 char path[1024]; 57 char path[1024];
58 EVP_PKEY *key; 58 EVP_PKEY *key;
59 X509 *cert; 59 X509 *cert;
60 RSA *rsa; 60 RSA *rsa;
61 FILE *f; 61 FILE *f;
62 int ret; 62 int ret;
63 63
64 *rsap = NULL; 64 *rsap = NULL;
65 snprintf(path, sizeof(path), "%s/%s.crt", keydir, name); 65 snprintf(path, sizeof(path), "%s/%s.crt", keydir, name);
66 f = fopen(path, "r"); 66 f = fopen(path, "r");
67 if (!f) { 67 if (!f) {
68 fprintf(stderr, "Couldn't open RSA certificate: '%s': %s\n", 68 fprintf(stderr, "Couldn't open RSA certificate: '%s': %s\n",
69 path, strerror(errno)); 69 path, strerror(errno));
70 return -EACCES; 70 return -EACCES;
71 } 71 }
72 72
73 /* Read the certificate */ 73 /* Read the certificate */
74 cert = NULL; 74 cert = NULL;
75 if (!PEM_read_X509(f, &cert, NULL, NULL)) { 75 if (!PEM_read_X509(f, &cert, NULL, NULL)) {
76 rsa_err("Couldn't read certificate"); 76 rsa_err("Couldn't read certificate");
77 ret = -EINVAL; 77 ret = -EINVAL;
78 goto err_cert; 78 goto err_cert;
79 } 79 }
80 80
81 /* Get the public key from the certificate. */ 81 /* Get the public key from the certificate. */
82 key = X509_get_pubkey(cert); 82 key = X509_get_pubkey(cert);
83 if (!key) { 83 if (!key) {
84 rsa_err("Couldn't read public key\n"); 84 rsa_err("Couldn't read public key\n");
85 ret = -EINVAL; 85 ret = -EINVAL;
86 goto err_pubkey; 86 goto err_pubkey;
87 } 87 }
88 88
89 /* Convert to a RSA_style key. */ 89 /* Convert to a RSA_style key. */
90 rsa = EVP_PKEY_get1_RSA(key); 90 rsa = EVP_PKEY_get1_RSA(key);
91 if (!rsa) { 91 if (!rsa) {
92 rsa_err("Couldn't convert to a RSA style key"); 92 rsa_err("Couldn't convert to a RSA style key");
93 ret = -EINVAL; 93 ret = -EINVAL;
94 goto err_rsa; 94 goto err_rsa;
95 } 95 }
96 fclose(f); 96 fclose(f);
97 EVP_PKEY_free(key); 97 EVP_PKEY_free(key);
98 X509_free(cert); 98 X509_free(cert);
99 *rsap = rsa; 99 *rsap = rsa;
100 100
101 return 0; 101 return 0;
102 102
103 err_rsa: 103 err_rsa:
104 EVP_PKEY_free(key); 104 EVP_PKEY_free(key);
105 err_pubkey: 105 err_pubkey:
106 X509_free(cert); 106 X509_free(cert);
107 err_cert: 107 err_cert:
108 fclose(f); 108 fclose(f);
109 return ret; 109 return ret;
110 } 110 }
111 111
112 /** 112 /**
113 * rsa_engine_get_pub_key() - read a public key from given engine 113 * rsa_engine_get_pub_key() - read a public key from given engine
114 * 114 *
115 * @keydir: Key prefix 115 * @keydir: Key prefix
116 * @name Name of key 116 * @name Name of key
117 * @engine Engine to use 117 * @engine Engine to use
118 * @rsap Returns RSA object, or NULL on failure 118 * @rsap Returns RSA object, or NULL on failure
119 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 119 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL)
120 */ 120 */
121 static int rsa_engine_get_pub_key(const char *keydir, const char *name, 121 static int rsa_engine_get_pub_key(const char *keydir, const char *name,
122 ENGINE *engine, RSA **rsap) 122 ENGINE *engine, RSA **rsap)
123 { 123 {
124 const char *engine_id; 124 const char *engine_id;
125 char key_id[1024]; 125 char key_id[1024];
126 EVP_PKEY *key; 126 EVP_PKEY *key;
127 RSA *rsa; 127 RSA *rsa;
128 int ret; 128 int ret;
129 129
130 *rsap = NULL; 130 *rsap = NULL;
131 131
132 engine_id = ENGINE_get_id(engine); 132 engine_id = ENGINE_get_id(engine);
133 133
134 if (engine_id && !strcmp(engine_id, "pkcs11")) { 134 if (engine_id && !strcmp(engine_id, "pkcs11")) {
135 if (keydir) 135 if (keydir)
136 snprintf(key_id, sizeof(key_id), 136 snprintf(key_id, sizeof(key_id),
137 "pkcs11:%s;object=%s;type=public", 137 "pkcs11:%s;object=%s;type=public",
138 keydir, name); 138 keydir, name);
139 else 139 else
140 snprintf(key_id, sizeof(key_id), 140 snprintf(key_id, sizeof(key_id),
141 "pkcs11:object=%s;type=public", 141 "pkcs11:object=%s;type=public",
142 name); 142 name);
143 } else { 143 } else {
144 fprintf(stderr, "Engine not supported\n"); 144 fprintf(stderr, "Engine not supported\n");
145 return -ENOTSUP; 145 return -ENOTSUP;
146 } 146 }
147 147
148 key = ENGINE_load_public_key(engine, key_id, NULL, NULL); 148 key = ENGINE_load_public_key(engine, key_id, NULL, NULL);
149 if (!key) 149 if (!key)
150 return rsa_err("Failure loading public key from engine"); 150 return rsa_err("Failure loading public key from engine");
151 151
152 /* Convert to a RSA_style key. */ 152 /* Convert to a RSA_style key. */
153 rsa = EVP_PKEY_get1_RSA(key); 153 rsa = EVP_PKEY_get1_RSA(key);
154 if (!rsa) { 154 if (!rsa) {
155 rsa_err("Couldn't convert to a RSA style key"); 155 rsa_err("Couldn't convert to a RSA style key");
156 ret = -EINVAL; 156 ret = -EINVAL;
157 goto err_rsa; 157 goto err_rsa;
158 } 158 }
159 159
160 EVP_PKEY_free(key); 160 EVP_PKEY_free(key);
161 *rsap = rsa; 161 *rsap = rsa;
162 162
163 return 0; 163 return 0;
164 164
165 err_rsa: 165 err_rsa:
166 EVP_PKEY_free(key); 166 EVP_PKEY_free(key);
167 return ret; 167 return ret;
168 } 168 }
169 169
170 /** 170 /**
171 * rsa_get_pub_key() - read a public key 171 * rsa_get_pub_key() - read a public key
172 * 172 *
173 * @keydir: Directory containing the key (PEM file) or key prefix (engine) 173 * @keydir: Directory containing the key (PEM file) or key prefix (engine)
174 * @name Name of key file (will have a .crt extension) 174 * @name Name of key file (will have a .crt extension)
175 * @engine Engine to use 175 * @engine Engine to use
176 * @rsap Returns RSA object, or NULL on failure 176 * @rsap Returns RSA object, or NULL on failure
177 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 177 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL)
178 */ 178 */
179 static int rsa_get_pub_key(const char *keydir, const char *name, 179 static int rsa_get_pub_key(const char *keydir, const char *name,
180 ENGINE *engine, RSA **rsap) 180 ENGINE *engine, RSA **rsap)
181 { 181 {
182 if (engine) 182 if (engine)
183 return rsa_engine_get_pub_key(keydir, name, engine, rsap); 183 return rsa_engine_get_pub_key(keydir, name, engine, rsap);
184 return rsa_pem_get_pub_key(keydir, name, rsap); 184 return rsa_pem_get_pub_key(keydir, name, rsap);
185 } 185 }
186 186
187 /** 187 /**
188 * rsa_pem_get_priv_key() - read a private key from a .key file 188 * rsa_pem_get_priv_key() - read a private key from a .key file
189 * 189 *
190 * @keydir: Directory containing the key 190 * @keydir: Directory containing the key
191 * @name Name of key file (will have a .key extension) 191 * @name Name of key file (will have a .key extension)
192 * @rsap Returns RSA object, or NULL on failure 192 * @rsap Returns RSA object, or NULL on failure
193 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 193 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL)
194 */ 194 */
195 static int rsa_pem_get_priv_key(const char *keydir, const char *name, 195 static int rsa_pem_get_priv_key(const char *keydir, const char *name,
196 RSA **rsap) 196 RSA **rsap)
197 { 197 {
198 char path[1024]; 198 char path[1024];
199 RSA *rsa; 199 RSA *rsa;
200 FILE *f; 200 FILE *f;
201 201
202 *rsap = NULL; 202 *rsap = NULL;
203 snprintf(path, sizeof(path), "%s/%s.key", keydir, name); 203 snprintf(path, sizeof(path), "%s/%s.key", keydir, name);
204 f = fopen(path, "r"); 204 f = fopen(path, "r");
205 if (!f) { 205 if (!f) {
206 fprintf(stderr, "Couldn't open RSA private key: '%s': %s\n", 206 fprintf(stderr, "Couldn't open RSA private key: '%s': %s\n",
207 path, strerror(errno)); 207 path, strerror(errno));
208 return -ENOENT; 208 return -ENOENT;
209 } 209 }
210 210
211 rsa = PEM_read_RSAPrivateKey(f, 0, NULL, path); 211 rsa = PEM_read_RSAPrivateKey(f, 0, NULL, path);
212 if (!rsa) { 212 if (!rsa) {
213 rsa_err("Failure reading private key"); 213 rsa_err("Failure reading private key");
214 fclose(f); 214 fclose(f);
215 return -EPROTO; 215 return -EPROTO;
216 } 216 }
217 fclose(f); 217 fclose(f);
218 *rsap = rsa; 218 *rsap = rsa;
219 219
220 return 0; 220 return 0;
221 } 221 }
222 222
223 /** 223 /**
224 * rsa_engine_get_priv_key() - read a private key from given engine 224 * rsa_engine_get_priv_key() - read a private key from given engine
225 * 225 *
226 * @keydir: Key prefix 226 * @keydir: Key prefix
227 * @name Name of key 227 * @name Name of key
228 * @engine Engine to use 228 * @engine Engine to use
229 * @rsap Returns RSA object, or NULL on failure 229 * @rsap Returns RSA object, or NULL on failure
230 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 230 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL)
231 */ 231 */
232 static int rsa_engine_get_priv_key(const char *keydir, const char *name, 232 static int rsa_engine_get_priv_key(const char *keydir, const char *name,
233 ENGINE *engine, RSA **rsap) 233 ENGINE *engine, RSA **rsap)
234 { 234 {
235 const char *engine_id; 235 const char *engine_id;
236 char key_id[1024]; 236 char key_id[1024];
237 EVP_PKEY *key; 237 EVP_PKEY *key;
238 RSA *rsa; 238 RSA *rsa;
239 int ret; 239 int ret;
240 240
241 *rsap = NULL; 241 *rsap = NULL;
242 242
243 engine_id = ENGINE_get_id(engine); 243 engine_id = ENGINE_get_id(engine);
244 244
245 if (engine_id && !strcmp(engine_id, "pkcs11")) { 245 if (engine_id && !strcmp(engine_id, "pkcs11")) {
246 if (keydir) 246 if (keydir)
247 snprintf(key_id, sizeof(key_id), 247 snprintf(key_id, sizeof(key_id),
248 "pkcs11:%s;object=%s;type=private", 248 "pkcs11:%s;object=%s;type=private",
249 keydir, name); 249 keydir, name);
250 else 250 else
251 snprintf(key_id, sizeof(key_id), 251 snprintf(key_id, sizeof(key_id),
252 "pkcs11:object=%s;type=private", 252 "pkcs11:object=%s;type=private",
253 name); 253 name);
254 } else { 254 } else {
255 fprintf(stderr, "Engine not supported\n"); 255 fprintf(stderr, "Engine not supported\n");
256 return -ENOTSUP; 256 return -ENOTSUP;
257 } 257 }
258 258
259 key = ENGINE_load_private_key(engine, key_id, NULL, NULL); 259 key = ENGINE_load_private_key(engine, key_id, NULL, NULL);
260 if (!key) 260 if (!key)
261 return rsa_err("Failure loading private key from engine"); 261 return rsa_err("Failure loading private key from engine");
262 262
263 /* Convert to a RSA_style key. */ 263 /* Convert to a RSA_style key. */
264 rsa = EVP_PKEY_get1_RSA(key); 264 rsa = EVP_PKEY_get1_RSA(key);
265 if (!rsa) { 265 if (!rsa) {
266 rsa_err("Couldn't convert to a RSA style key"); 266 rsa_err("Couldn't convert to a RSA style key");
267 ret = -EINVAL; 267 ret = -EINVAL;
268 goto err_rsa; 268 goto err_rsa;
269 } 269 }
270 270
271 EVP_PKEY_free(key); 271 EVP_PKEY_free(key);
272 *rsap = rsa; 272 *rsap = rsa;
273 273
274 return 0; 274 return 0;
275 275
276 err_rsa: 276 err_rsa:
277 EVP_PKEY_free(key); 277 EVP_PKEY_free(key);
278 return ret; 278 return ret;
279 } 279 }
280 280
281 /** 281 /**
282 * rsa_get_priv_key() - read a private key 282 * rsa_get_priv_key() - read a private key
283 * 283 *
284 * @keydir: Directory containing the key (PEM file) or key prefix (engine) 284 * @keydir: Directory containing the key (PEM file) or key prefix (engine)
285 * @name Name of key 285 * @name Name of key
286 * @engine Engine to use for signing 286 * @engine Engine to use for signing
287 * @rsap Returns RSA object, or NULL on failure 287 * @rsap Returns RSA object, or NULL on failure
288 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 288 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL)
289 */ 289 */
290 static int rsa_get_priv_key(const char *keydir, const char *name, 290 static int rsa_get_priv_key(const char *keydir, const char *name,
291 ENGINE *engine, RSA **rsap) 291 ENGINE *engine, RSA **rsap)
292 { 292 {
293 if (engine) 293 if (engine)
294 return rsa_engine_get_priv_key(keydir, name, engine, rsap); 294 return rsa_engine_get_priv_key(keydir, name, engine, rsap);
295 return rsa_pem_get_priv_key(keydir, name, rsap); 295 return rsa_pem_get_priv_key(keydir, name, rsap);
296 } 296 }
297 297
298 static int rsa_init(void) 298 static int rsa_init(void)
299 { 299 {
300 int ret; 300 int ret;
301 301
302 #if OPENSSL_VERSION_NUMBER < 0x10100000L 302 #if OPENSSL_VERSION_NUMBER < 0x10100000L
303 ret = SSL_library_init(); 303 ret = SSL_library_init();
304 #else 304 #else
305 ret = OPENSSL_init_ssl(0, NULL); 305 ret = OPENSSL_init_ssl(0, NULL);
306 #endif 306 #endif
307 if (!ret) { 307 if (!ret) {
308 fprintf(stderr, "Failure to init SSL library\n"); 308 fprintf(stderr, "Failure to init SSL library\n");
309 return -1; 309 return -1;
310 } 310 }
311 #if OPENSSL_VERSION_NUMBER < 0x10100000L 311 #if OPENSSL_VERSION_NUMBER < 0x10100000L
312 SSL_load_error_strings(); 312 SSL_load_error_strings();
313 313
314 OpenSSL_add_all_algorithms(); 314 OpenSSL_add_all_algorithms();
315 OpenSSL_add_all_digests(); 315 OpenSSL_add_all_digests();
316 OpenSSL_add_all_ciphers(); 316 OpenSSL_add_all_ciphers();
317 #endif 317 #endif
318 318
319 return 0; 319 return 0;
320 } 320 }
321 321
322 static int rsa_engine_init(const char *engine_id, ENGINE **pe) 322 static int rsa_engine_init(const char *engine_id, ENGINE **pe)
323 { 323 {
324 ENGINE *e; 324 ENGINE *e;
325 int ret; 325 int ret;
326 326
327 ENGINE_load_builtin_engines(); 327 ENGINE_load_builtin_engines();
328 328
329 e = ENGINE_by_id(engine_id); 329 e = ENGINE_by_id(engine_id);
330 if (!e) { 330 if (!e) {
331 fprintf(stderr, "Engine isn't available\n"); 331 fprintf(stderr, "Engine isn't available\n");
332 ret = -1; 332 ret = -1;
333 goto err_engine_by_id; 333 goto err_engine_by_id;
334 } 334 }
335 335
336 if (!ENGINE_init(e)) { 336 if (!ENGINE_init(e)) {
337 fprintf(stderr, "Couldn't initialize engine\n"); 337 fprintf(stderr, "Couldn't initialize engine\n");
338 ret = -1; 338 ret = -1;
339 goto err_engine_init; 339 goto err_engine_init;
340 } 340 }
341 341
342 if (!ENGINE_set_default_RSA(e)) { 342 if (!ENGINE_set_default_RSA(e)) {
343 fprintf(stderr, "Couldn't set engine as default for RSA\n"); 343 fprintf(stderr, "Couldn't set engine as default for RSA\n");
344 ret = -1; 344 ret = -1;
345 goto err_set_rsa; 345 goto err_set_rsa;
346 } 346 }
347 347
348 *pe = e; 348 *pe = e;
349 349
350 return 0; 350 return 0;
351 351
352 err_set_rsa: 352 err_set_rsa:
353 ENGINE_finish(e); 353 ENGINE_finish(e);
354 err_engine_init: 354 err_engine_init:
355 ENGINE_free(e); 355 ENGINE_free(e);
356 err_engine_by_id: 356 err_engine_by_id:
357 #if OPENSSL_VERSION_NUMBER < 0x10100000L 357 #if OPENSSL_VERSION_NUMBER < 0x10100000L
358 ENGINE_cleanup(); 358 ENGINE_cleanup();
359 #endif 359 #endif
360 return ret; 360 return ret;
361 } 361 }
362 362
363 static void rsa_remove(void) 363 static void rsa_remove(void)
364 { 364 {
365 #if OPENSSL_VERSION_NUMBER < 0x10100000L 365 #if OPENSSL_VERSION_NUMBER < 0x10100000L
366 CRYPTO_cleanup_all_ex_data(); 366 CRYPTO_cleanup_all_ex_data();
367 ERR_free_strings(); 367 ERR_free_strings();
368 #ifdef HAVE_ERR_REMOVE_THREAD_STATE 368 #ifdef HAVE_ERR_REMOVE_THREAD_STATE
369 ERR_remove_thread_state(NULL); 369 ERR_remove_thread_state(NULL);
370 #else 370 #else
371 ERR_remove_state(0); 371 ERR_remove_state(0);
372 #endif 372 #endif
373 EVP_cleanup(); 373 EVP_cleanup();
374 #endif 374 #endif
375 } 375 }
376 376
377 static void rsa_engine_remove(ENGINE *e) 377 static void rsa_engine_remove(ENGINE *e)
378 { 378 {
379 if (e) { 379 if (e) {
380 ENGINE_finish(e); 380 ENGINE_finish(e);
381 ENGINE_free(e); 381 ENGINE_free(e);
382 } 382 }
383 } 383 }
384 384
385 static int rsa_sign_with_key(RSA *rsa, struct checksum_algo *checksum_algo, 385 static int rsa_sign_with_key(RSA *rsa, struct checksum_algo *checksum_algo,
386 const struct image_region region[], int region_count, 386 const struct image_region region[], int region_count,
387 uint8_t **sigp, uint *sig_size) 387 uint8_t **sigp, uint *sig_size)
388 { 388 {
389 EVP_PKEY *key; 389 EVP_PKEY *key;
390 EVP_MD_CTX *context; 390 EVP_MD_CTX *context;
391 int size, ret = 0; 391 int size, ret = 0;
392 uint8_t *sig; 392 uint8_t *sig;
393 int i; 393 int i;
394 394
395 key = EVP_PKEY_new(); 395 key = EVP_PKEY_new();
396 if (!key) 396 if (!key)
397 return rsa_err("EVP_PKEY object creation failed"); 397 return rsa_err("EVP_PKEY object creation failed");
398 398
399 if (!EVP_PKEY_set1_RSA(key, rsa)) { 399 if (!EVP_PKEY_set1_RSA(key, rsa)) {
400 ret = rsa_err("EVP key setup failed"); 400 ret = rsa_err("EVP key setup failed");
401 goto err_set; 401 goto err_set;
402 } 402 }
403 403
404 size = EVP_PKEY_size(key); 404 size = EVP_PKEY_size(key);
405 sig = malloc(size); 405 sig = malloc(size);
406 if (!sig) { 406 if (!sig) {
407 fprintf(stderr, "Out of memory for signature (%d bytes)\n", 407 fprintf(stderr, "Out of memory for signature (%d bytes)\n",
408 size); 408 size);
409 ret = -ENOMEM; 409 ret = -ENOMEM;
410 goto err_alloc; 410 goto err_alloc;
411 } 411 }
412 412
413 context = EVP_MD_CTX_create(); 413 context = EVP_MD_CTX_create();
414 if (!context) { 414 if (!context) {
415 ret = rsa_err("EVP context creation failed"); 415 ret = rsa_err("EVP context creation failed");
416 goto err_create; 416 goto err_create;
417 } 417 }
418 EVP_MD_CTX_init(context); 418 EVP_MD_CTX_init(context);
419 if (!EVP_SignInit(context, checksum_algo->calculate_sign())) { 419 if (!EVP_SignInit(context, checksum_algo->calculate_sign())) {
420 ret = rsa_err("Signer setup failed"); 420 ret = rsa_err("Signer setup failed");
421 goto err_sign; 421 goto err_sign;
422 } 422 }
423 423
424 for (i = 0; i < region_count; i++) { 424 for (i = 0; i < region_count; i++) {
425 if (!EVP_SignUpdate(context, region[i].data, region[i].size)) { 425 if (!EVP_SignUpdate(context, region[i].data, region[i].size)) {
426 ret = rsa_err("Signing data failed"); 426 ret = rsa_err("Signing data failed");
427 goto err_sign; 427 goto err_sign;
428 } 428 }
429 } 429 }
430 430
431 if (!EVP_SignFinal(context, sig, sig_size, key)) { 431 if (!EVP_SignFinal(context, sig, sig_size, key)) {
432 ret = rsa_err("Could not obtain signature"); 432 ret = rsa_err("Could not obtain signature");
433 goto err_sign; 433 goto err_sign;
434 } 434 }
435 #if OPENSSL_VERSION_NUMBER < 0x10100000L 435 #if OPENSSL_VERSION_NUMBER < 0x10100000L
436 EVP_MD_CTX_cleanup(context); 436 EVP_MD_CTX_cleanup(context);
437 #else 437 #else
438 EVP_MD_CTX_reset(context); 438 EVP_MD_CTX_reset(context);
439 #endif 439 #endif
440 EVP_MD_CTX_destroy(context); 440 EVP_MD_CTX_destroy(context);
441 EVP_PKEY_free(key); 441 EVP_PKEY_free(key);
442 442
443 debug("Got signature: %d bytes, expected %d\n", *sig_size, size); 443 debug("Got signature: %d bytes, expected %d\n", *sig_size, size);
444 *sigp = sig; 444 *sigp = sig;
445 *sig_size = size; 445 *sig_size = size;
446 446
447 return 0; 447 return 0;
448 448
449 err_sign: 449 err_sign:
450 EVP_MD_CTX_destroy(context); 450 EVP_MD_CTX_destroy(context);
451 err_create: 451 err_create:
452 free(sig); 452 free(sig);
453 err_alloc: 453 err_alloc:
454 err_set: 454 err_set:
455 EVP_PKEY_free(key); 455 EVP_PKEY_free(key);
456 return ret; 456 return ret;
457 } 457 }
458 458
459 int rsa_sign(struct image_sign_info *info, 459 int rsa_sign(struct image_sign_info *info,
460 const struct image_region region[], int region_count, 460 const struct image_region region[], int region_count,
461 uint8_t **sigp, uint *sig_len) 461 uint8_t **sigp, uint *sig_len)
462 { 462 {
463 RSA *rsa; 463 RSA *rsa;
464 ENGINE *e = NULL; 464 ENGINE *e = NULL;
465 int ret; 465 int ret;
466 466
467 ret = rsa_init(); 467 ret = rsa_init();
468 if (ret) 468 if (ret)
469 return ret; 469 return ret;
470 470
471 if (info->engine_id) { 471 if (info->engine_id) {
472 ret = rsa_engine_init(info->engine_id, &e); 472 ret = rsa_engine_init(info->engine_id, &e);
473 if (ret) 473 if (ret)
474 goto err_engine; 474 goto err_engine;
475 } 475 }
476 476
477 ret = rsa_get_priv_key(info->keydir, info->keyname, e, &rsa); 477 ret = rsa_get_priv_key(info->keydir, info->keyname, e, &rsa);
478 if (ret) 478 if (ret)
479 goto err_priv; 479 goto err_priv;
480 ret = rsa_sign_with_key(rsa, info->checksum, region, 480 ret = rsa_sign_with_key(rsa, info->checksum, region,
481 region_count, sigp, sig_len); 481 region_count, sigp, sig_len);
482 if (ret) 482 if (ret)
483 goto err_sign; 483 goto err_sign;
484 484
485 RSA_free(rsa); 485 RSA_free(rsa);
486 if (info->engine_id) 486 if (info->engine_id)
487 rsa_engine_remove(e); 487 rsa_engine_remove(e);
488 rsa_remove(); 488 rsa_remove();
489 489
490 return ret; 490 return ret;
491 491
492 err_sign: 492 err_sign:
493 RSA_free(rsa); 493 RSA_free(rsa);
494 err_priv: 494 err_priv:
495 if (info->engine_id) 495 if (info->engine_id)
496 rsa_engine_remove(e); 496 rsa_engine_remove(e);
497 err_engine: 497 err_engine:
498 rsa_remove(); 498 rsa_remove();
499 return ret; 499 return ret;
500 } 500 }
501 501
502 /* 502 /*
503 * rsa_get_exponent(): - Get the public exponent from an RSA key 503 * rsa_get_exponent(): - Get the public exponent from an RSA key
504 */ 504 */
505 static int rsa_get_exponent(RSA *key, uint64_t *e) 505 static int rsa_get_exponent(RSA *key, uint64_t *e)
506 { 506 {
507 int ret; 507 int ret;
508 BIGNUM *bn_te; 508 BIGNUM *bn_te;
509 const BIGNUM *key_e; 509 const BIGNUM *key_e;
510 uint64_t te; 510 uint64_t te;
511 511
512 ret = -EINVAL; 512 ret = -EINVAL;
513 bn_te = NULL; 513 bn_te = NULL;
514 514
515 if (!e) 515 if (!e)
516 goto cleanup; 516 goto cleanup;
517 517
518 RSA_get0_key(key, NULL, &key_e, NULL); 518 RSA_get0_key(key, NULL, &key_e, NULL);
519 if (BN_num_bits(key_e) > 64) 519 if (BN_num_bits(key_e) > 64)
520 goto cleanup; 520 goto cleanup;
521 521
522 *e = BN_get_word(key_e); 522 *e = BN_get_word(key_e);
523 523
524 if (BN_num_bits(key_e) < 33) { 524 if (BN_num_bits(key_e) < 33) {
525 ret = 0; 525 ret = 0;
526 goto cleanup; 526 goto cleanup;
527 } 527 }
528 528
529 bn_te = BN_dup(key_e); 529 bn_te = BN_dup(key_e);
530 if (!bn_te) 530 if (!bn_te)
531 goto cleanup; 531 goto cleanup;
532 532
533 if (!BN_rshift(bn_te, bn_te, 32)) 533 if (!BN_rshift(bn_te, bn_te, 32))
534 goto cleanup; 534 goto cleanup;
535 535
536 if (!BN_mask_bits(bn_te, 32)) 536 if (!BN_mask_bits(bn_te, 32))
537 goto cleanup; 537 goto cleanup;
538 538
539 te = BN_get_word(bn_te); 539 te = BN_get_word(bn_te);
540 te <<= 32; 540 te <<= 32;
541 *e |= te; 541 *e |= te;
542 ret = 0; 542 ret = 0;
543 543
544 cleanup: 544 cleanup:
545 if (bn_te) 545 if (bn_te)
546 BN_free(bn_te); 546 BN_free(bn_te);
547 547
548 return ret; 548 return ret;
549 } 549 }
550 550
551 /* 551 /*
552 * rsa_get_params(): - Get the important parameters of an RSA public key 552 * rsa_get_params(): - Get the important parameters of an RSA public key
553 */ 553 */
554 int rsa_get_params(RSA *key, uint64_t *exponent, uint32_t *n0_invp, 554 int rsa_get_params(RSA *key, uint64_t *exponent, uint32_t *n0_invp,
555 BIGNUM **modulusp, BIGNUM **r_squaredp) 555 BIGNUM **modulusp, BIGNUM **r_squaredp)
556 { 556 {
557 BIGNUM *big1, *big2, *big32, *big2_32; 557 BIGNUM *big1, *big2, *big32, *big2_32;
558 BIGNUM *n, *r, *r_squared, *tmp; 558 BIGNUM *n, *r, *r_squared, *tmp;
559 const BIGNUM *key_n; 559 const BIGNUM *key_n;
560 BN_CTX *bn_ctx = BN_CTX_new(); 560 BN_CTX *bn_ctx = BN_CTX_new();
561 int ret = 0; 561 int ret = 0;
562 562
563 /* Initialize BIGNUMs */ 563 /* Initialize BIGNUMs */
564 big1 = BN_new(); 564 big1 = BN_new();
565 big2 = BN_new(); 565 big2 = BN_new();
566 big32 = BN_new(); 566 big32 = BN_new();
567 r = BN_new(); 567 r = BN_new();
568 r_squared = BN_new(); 568 r_squared = BN_new();
569 tmp = BN_new(); 569 tmp = BN_new();
570 big2_32 = BN_new(); 570 big2_32 = BN_new();
571 n = BN_new(); 571 n = BN_new();
572 if (!big1 || !big2 || !big32 || !r || !r_squared || !tmp || !big2_32 || 572 if (!big1 || !big2 || !big32 || !r || !r_squared || !tmp || !big2_32 ||
573 !n) { 573 !n) {
574 fprintf(stderr, "Out of memory (bignum)\n"); 574 fprintf(stderr, "Out of memory (bignum)\n");
575 return -ENOMEM; 575 return -ENOMEM;
576 } 576 }
577 577
578 if (0 != rsa_get_exponent(key, exponent)) 578 if (0 != rsa_get_exponent(key, exponent))
579 ret = -1; 579 ret = -1;
580 580
581 RSA_get0_key(key, &key_n, NULL, NULL); 581 RSA_get0_key(key, &key_n, NULL, NULL);
582 if (!BN_copy(n, key_n) || !BN_set_word(big1, 1L) || 582 if (!BN_copy(n, key_n) || !BN_set_word(big1, 1L) ||
583 !BN_set_word(big2, 2L) || !BN_set_word(big32, 32L)) 583 !BN_set_word(big2, 2L) || !BN_set_word(big32, 32L))
584 ret = -1; 584 ret = -1;
585 585
586 /* big2_32 = 2^32 */ 586 /* big2_32 = 2^32 */
587 if (!BN_exp(big2_32, big2, big32, bn_ctx)) 587 if (!BN_exp(big2_32, big2, big32, bn_ctx))
588 ret = -1; 588 ret = -1;
589 589
590 /* Calculate n0_inv = -1 / n[0] mod 2^32 */ 590 /* Calculate n0_inv = -1 / n[0] mod 2^32 */
591 if (!BN_mod_inverse(tmp, n, big2_32, bn_ctx) || 591 if (!BN_mod_inverse(tmp, n, big2_32, bn_ctx) ||
592 !BN_sub(tmp, big2_32, tmp)) 592 !BN_sub(tmp, big2_32, tmp))
593 ret = -1; 593 ret = -1;
594 *n0_invp = BN_get_word(tmp); 594 *n0_invp = BN_get_word(tmp);
595 595
596 /* Calculate R = 2^(# of key bits) */ 596 /* Calculate R = 2^(# of key bits) */
597 if (!BN_set_word(tmp, BN_num_bits(n)) || 597 if (!BN_set_word(tmp, BN_num_bits(n)) ||
598 !BN_exp(r, big2, tmp, bn_ctx)) 598 !BN_exp(r, big2, tmp, bn_ctx))
599 ret = -1; 599 ret = -1;
600 600
601 /* Calculate r_squared = R^2 mod n */ 601 /* Calculate r_squared = R^2 mod n */
602 if (!BN_copy(r_squared, r) || 602 if (!BN_copy(r_squared, r) ||
603 !BN_mul(tmp, r_squared, r, bn_ctx) || 603 !BN_mul(tmp, r_squared, r, bn_ctx) ||
604 !BN_mod(r_squared, tmp, n, bn_ctx)) 604 !BN_mod(r_squared, tmp, n, bn_ctx))
605 ret = -1; 605 ret = -1;
606 606
607 *modulusp = n; 607 *modulusp = n;
608 *r_squaredp = r_squared; 608 *r_squaredp = r_squared;
609 609
610 BN_free(big1); 610 BN_free(big1);
611 BN_free(big2); 611 BN_free(big2);
612 BN_free(big32); 612 BN_free(big32);
613 BN_free(r); 613 BN_free(r);
614 BN_free(tmp); 614 BN_free(tmp);
615 BN_free(big2_32); 615 BN_free(big2_32);
616 if (ret) { 616 if (ret) {
617 fprintf(stderr, "Bignum operations failed\n"); 617 fprintf(stderr, "Bignum operations failed\n");
618 return -ENOMEM; 618 return -ENOMEM;
619 } 619 }
620 620
621 return ret; 621 return ret;
622 } 622 }
623 623
624 static int fdt_add_bignum(void *blob, int noffset, const char *prop_name, 624 static int fdt_add_bignum(void *blob, int noffset, const char *prop_name,
625 BIGNUM *num, int num_bits) 625 BIGNUM *num, int num_bits)
626 { 626 {
627 int nwords = num_bits / 32; 627 int nwords = num_bits / 32;
628 int size; 628 int size;
629 uint32_t *buf, *ptr; 629 uint32_t *buf, *ptr;
630 BIGNUM *tmp, *big2, *big32, *big2_32; 630 BIGNUM *tmp, *big2, *big32, *big2_32;
631 BN_CTX *ctx; 631 BN_CTX *ctx;
632 int ret; 632 int ret;
633 633
634 tmp = BN_new(); 634 tmp = BN_new();
635 big2 = BN_new(); 635 big2 = BN_new();
636 big32 = BN_new(); 636 big32 = BN_new();
637 big2_32 = BN_new(); 637 big2_32 = BN_new();
638
639 /*
640 * Note: This code assumes that all of the above succeed, or all fail.
641 * In practice memory allocations generally do not fail (unless the
642 * process is killed), so it does not seem worth handling each of these
643 * as a separate case. Technicaly this could leak memory on failure,
644 * but a) it won't happen in practice, and b) it doesn't matter as we
645 * will immediately exit with a failure code.
646 */
638 if (!tmp || !big2 || !big32 || !big2_32) { 647 if (!tmp || !big2 || !big32 || !big2_32) {
639 fprintf(stderr, "Out of memory (bignum)\n"); 648 fprintf(stderr, "Out of memory (bignum)\n");
640 return -ENOMEM; 649 return -ENOMEM;
641 } 650 }
642 ctx = BN_CTX_new(); 651 ctx = BN_CTX_new();
643 if (!tmp) { 652 if (!tmp) {
644 fprintf(stderr, "Out of memory (bignum context)\n"); 653 fprintf(stderr, "Out of memory (bignum context)\n");
645 return -ENOMEM; 654 return -ENOMEM;
646 } 655 }
647 BN_set_word(big2, 2L); 656 BN_set_word(big2, 2L);
648 BN_set_word(big32, 32L); 657 BN_set_word(big32, 32L);
649 BN_exp(big2_32, big2, big32, ctx); /* B = 2^32 */ 658 BN_exp(big2_32, big2, big32, ctx); /* B = 2^32 */
650 659
651 size = nwords * sizeof(uint32_t); 660 size = nwords * sizeof(uint32_t);
652 buf = malloc(size); 661 buf = malloc(size);
653 if (!buf) { 662 if (!buf) {
654 fprintf(stderr, "Out of memory (%d bytes)\n", size); 663 fprintf(stderr, "Out of memory (%d bytes)\n", size);
655 return -ENOMEM; 664 return -ENOMEM;
656 } 665 }
657 666
658 /* Write out modulus as big endian array of integers */ 667 /* Write out modulus as big endian array of integers */
659 for (ptr = buf + nwords - 1; ptr >= buf; ptr--) { 668 for (ptr = buf + nwords - 1; ptr >= buf; ptr--) {
660 BN_mod(tmp, num, big2_32, ctx); /* n = N mod B */ 669 BN_mod(tmp, num, big2_32, ctx); /* n = N mod B */
661 *ptr = cpu_to_fdt32(BN_get_word(tmp)); 670 *ptr = cpu_to_fdt32(BN_get_word(tmp));
662 BN_rshift(num, num, 32); /* N = N/B */ 671 BN_rshift(num, num, 32); /* N = N/B */
663 } 672 }
664 673
665 /* 674 /*
666 * We try signing with successively increasing size values, so this 675 * We try signing with successively increasing size values, so this
667 * might fail several times 676 * might fail several times
668 */ 677 */
669 ret = fdt_setprop(blob, noffset, prop_name, buf, size); 678 ret = fdt_setprop(blob, noffset, prop_name, buf, size);
670 if (ret)
671 return -FDT_ERR_NOSPACE;
672 free(buf); 679 free(buf);
673 BN_free(tmp); 680 BN_free(tmp);
674 BN_free(big2); 681 BN_free(big2);
675 BN_free(big32); 682 BN_free(big32);
676 BN_free(big2_32); 683 BN_free(big2_32);
677 684
678 return ret; 685 return ret ? -FDT_ERR_NOSPACE : 0;
679 } 686 }
680 687
681 int rsa_add_verify_data(struct image_sign_info *info, void *keydest) 688 int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
682 { 689 {
683 BIGNUM *modulus, *r_squared; 690 BIGNUM *modulus, *r_squared;
684 uint64_t exponent; 691 uint64_t exponent;
685 uint32_t n0_inv; 692 uint32_t n0_inv;
686 int parent, node; 693 int parent, node;
687 char name[100]; 694 char name[100];
688 int ret; 695 int ret;
689 int bits; 696 int bits;
690 RSA *rsa; 697 RSA *rsa;
691 ENGINE *e = NULL; 698 ENGINE *e = NULL;
692 699
693 debug("%s: Getting verification data\n", __func__); 700 debug("%s: Getting verification data\n", __func__);
694 if (info->engine_id) { 701 if (info->engine_id) {
695 ret = rsa_engine_init(info->engine_id, &e); 702 ret = rsa_engine_init(info->engine_id, &e);
696 if (ret) 703 if (ret)
697 return ret; 704 return ret;
698 } 705 }
699 ret = rsa_get_pub_key(info->keydir, info->keyname, e, &rsa); 706 ret = rsa_get_pub_key(info->keydir, info->keyname, e, &rsa);
700 if (ret) 707 if (ret)
701 goto err_get_pub_key; 708 goto err_get_pub_key;
702 ret = rsa_get_params(rsa, &exponent, &n0_inv, &modulus, &r_squared); 709 ret = rsa_get_params(rsa, &exponent, &n0_inv, &modulus, &r_squared);
703 if (ret) 710 if (ret)
704 goto err_get_params; 711 goto err_get_params;
705 bits = BN_num_bits(modulus); 712 bits = BN_num_bits(modulus);
706 parent = fdt_subnode_offset(keydest, 0, FIT_SIG_NODENAME); 713 parent = fdt_subnode_offset(keydest, 0, FIT_SIG_NODENAME);
707 if (parent == -FDT_ERR_NOTFOUND) { 714 if (parent == -FDT_ERR_NOTFOUND) {
708 parent = fdt_add_subnode(keydest, 0, FIT_SIG_NODENAME); 715 parent = fdt_add_subnode(keydest, 0, FIT_SIG_NODENAME);
709 if (parent < 0) { 716 if (parent < 0) {
710 ret = parent; 717 ret = parent;
711 if (ret != -FDT_ERR_NOSPACE) { 718 if (ret != -FDT_ERR_NOSPACE) {
712 fprintf(stderr, "Couldn't create signature node: %s\n", 719 fprintf(stderr, "Couldn't create signature node: %s\n",
713 fdt_strerror(parent)); 720 fdt_strerror(parent));
714 } 721 }
715 } 722 }
716 } 723 }
717 if (ret) 724 if (ret)
718 goto done; 725 goto done;
719 726
720 /* Either create or overwrite the named key node */ 727 /* Either create or overwrite the named key node */
721 snprintf(name, sizeof(name), "key-%s", info->keyname); 728 snprintf(name, sizeof(name), "key-%s", info->keyname);
722 node = fdt_subnode_offset(keydest, parent, name); 729 node = fdt_subnode_offset(keydest, parent, name);
723 if (node == -FDT_ERR_NOTFOUND) { 730 if (node == -FDT_ERR_NOTFOUND) {
724 node = fdt_add_subnode(keydest, parent, name); 731 node = fdt_add_subnode(keydest, parent, name);
725 if (node < 0) { 732 if (node < 0) {
726 ret = node; 733 ret = node;
727 if (ret != -FDT_ERR_NOSPACE) { 734 if (ret != -FDT_ERR_NOSPACE) {
728 fprintf(stderr, "Could not create key subnode: %s\n", 735 fprintf(stderr, "Could not create key subnode: %s\n",
729 fdt_strerror(node)); 736 fdt_strerror(node));
730 } 737 }
731 } 738 }
732 } else if (node < 0) { 739 } else if (node < 0) {
733 fprintf(stderr, "Cannot select keys parent: %s\n", 740 fprintf(stderr, "Cannot select keys parent: %s\n",
734 fdt_strerror(node)); 741 fdt_strerror(node));
735 ret = node; 742 ret = node;
736 } 743 }
737 744
738 if (!ret) { 745 if (!ret) {
739 ret = fdt_setprop_string(keydest, node, "key-name-hint", 746 ret = fdt_setprop_string(keydest, node, "key-name-hint",
740 info->keyname); 747 info->keyname);
741 } 748 }
742 if (!ret) 749 if (!ret)
743 ret = fdt_setprop_u32(keydest, node, "rsa,num-bits", bits); 750 ret = fdt_setprop_u32(keydest, node, "rsa,num-bits", bits);
744 if (!ret) 751 if (!ret)
745 ret = fdt_setprop_u32(keydest, node, "rsa,n0-inverse", n0_inv); 752 ret = fdt_setprop_u32(keydest, node, "rsa,n0-inverse", n0_inv);
746 if (!ret) { 753 if (!ret) {
747 ret = fdt_setprop_u64(keydest, node, "rsa,exponent", exponent); 754 ret = fdt_setprop_u64(keydest, node, "rsa,exponent", exponent);
748 } 755 }
749 if (!ret) { 756 if (!ret) {
750 ret = fdt_add_bignum(keydest, node, "rsa,modulus", modulus, 757 ret = fdt_add_bignum(keydest, node, "rsa,modulus", modulus,
751 bits); 758 bits);
752 } 759 }
753 if (!ret) { 760 if (!ret) {
754 ret = fdt_add_bignum(keydest, node, "rsa,r-squared", r_squared, 761 ret = fdt_add_bignum(keydest, node, "rsa,r-squared", r_squared,
755 bits); 762 bits);
756 } 763 }
757 if (!ret) { 764 if (!ret) {
758 ret = fdt_setprop_string(keydest, node, FIT_ALGO_PROP, 765 ret = fdt_setprop_string(keydest, node, FIT_ALGO_PROP,
759 info->name); 766 info->name);
760 } 767 }
761 if (!ret && info->require_keys) { 768 if (!ret && info->require_keys) {
762 ret = fdt_setprop_string(keydest, node, "required", 769 ret = fdt_setprop_string(keydest, node, "required",
763 info->require_keys); 770 info->require_keys);
764 } 771 }
765 done: 772 done:
766 BN_free(modulus); 773 BN_free(modulus);
767 BN_free(r_squared); 774 BN_free(r_squared);
768 if (ret) 775 if (ret)
769 ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO; 776 ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO;
770 err_get_params: 777 err_get_params:
771 RSA_free(rsa); 778 RSA_free(rsa);
772 err_get_pub_key: 779 err_get_pub_key:
773 if (info->engine_id) 780 if (info->engine_id)
774 rsa_engine_remove(e); 781 rsa_engine_remove(e);
775 782
776 return ret; 783 return ret;