lkml.org 
[lkml]   [2020]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 16/99] crypto: af_alg - Use bh_lock_sock in sk_destruct
    3.16.84-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Herbert Xu <herbert@gondor.apana.org.au>

    commit 37f96694cf73ba116993a9d2d99ad6a75fa7fdb0 upstream.

    As af_alg_release_parent may be called from BH context (most notably
    due to an async request that only completes after socket closure,
    or as reported here because of an RCU-delayed sk_destruct call), we
    must use bh_lock_sock instead of lock_sock.

    Reported-by: syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com
    Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
    Fixes: c840ac6af3f8 ("crypto: af_alg - Disallow bind/setkey/...")
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    crypto/af_alg.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    --- a/crypto/af_alg.c
    +++ b/crypto/af_alg.c
    @@ -136,11 +136,13 @@ void af_alg_release_parent(struct sock *
    sk = ask->parent;
    ask = alg_sk(sk);

    - lock_sock(sk);
    + local_bh_disable();
    + bh_lock_sock(sk);
    ask->nokey_refcnt -= nokey;
    if (!last)
    last = !--ask->refcnt;
    - release_sock(sk);
    + bh_unlock_sock(sk);
    + local_bh_enable();

    if (last)
    sock_put(sk);
    \
     
     \ /
      Last update: 2020-05-20 16:29    [W:4.103 / U:0.432 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site