Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2016-02-26 12:44:11 +0100
committerSasha Levin <sasha.levin@oracle.com>2016-04-19 07:57:03 -0400
commit7855e916590ab8d97abcba3d0dc735bcfa55561d (patch)
tree00344eae8cefd409555492d3f85dc91c9860e754
parent801492e27fb9f24b4e05bc79047301408d5a6a0d (diff)
crypto: algif_skcipher - Fix race condition in skcipher_check_key
commit 1822793a523e5d5730b19cc21160ff1717421bc8 upstream. We need to lock the child socket in skcipher_check_key as otherwise two simultaneous calls can cause the parent socket to be freed. Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
-rw-r--r--crypto/algif_skcipher.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 9cf9aa5df432..d2cacc7f079f 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -551,22 +551,23 @@ static struct proto_ops algif_skcipher_ops = {
static int skcipher_check_key(struct socket *sock)
{
- int err;
+ int err = 0;
struct sock *psk;
struct alg_sock *pask;
struct skcipher_tfm *tfm;
struct sock *sk = sock->sk;
struct alg_sock *ask = alg_sk(sk);
+ lock_sock(sk);
if (ask->refcnt)
- return 0;
+ goto unlock_child;
psk = ask->parent;
pask = alg_sk(ask->parent);
tfm = pask->private;
err = -ENOKEY;
- lock_sock(psk);
+ lock_sock_nested(psk, SINGLE_DEPTH_NESTING);
if (!tfm->has_key)
goto unlock;
@@ -580,6 +581,8 @@ static int skcipher_check_key(struct socket *sock)
unlock:
release_sock(psk);
+unlock_child:
+ release_sock(sk);
return err;
}