| From 5586411e534d2a8135b51d8bce5d4fe778ea73d7 Mon Sep 17 00:00:00 2001 |
| From: Herbert Xu <herbert@gondor.apana.org.au> |
| Date: Thu, 5 Dec 2019 13:45:05 +0800 |
| Subject: [PATCH] crypto: af_alg - Use bh_lock_sock in sk_destruct |
| |
| commit 37f96694cf73ba116993a9d2d99ad6a75fa7fdb0 upstream. |
| |
| As af_alg_release_parent may be called from BH context (most notably |
| due to an async request that only completes after socket closure, |
| or as reported here because of an RCU-delayed sk_destruct call), we |
| must use bh_lock_sock instead of lock_sock. |
| |
| Reported-by: syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com |
| Reported-by: Eric Dumazet <eric.dumazet@gmail.com> |
| Fixes: c840ac6af3f8 ("crypto: af_alg - Disallow bind/setkey/...") |
| Cc: <stable@vger.kernel.org> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/crypto/af_alg.c b/crypto/af_alg.c |
| index 0dceaabc6321..3d8e53010cda 100644 |
| --- a/crypto/af_alg.c |
| +++ b/crypto/af_alg.c |
| @@ -134,11 +134,13 @@ void af_alg_release_parent(struct sock *sk) |
| sk = ask->parent; |
| ask = alg_sk(sk); |
| |
| - lock_sock(sk); |
| + local_bh_disable(); |
| + bh_lock_sock(sk); |
| ask->nokey_refcnt -= nokey; |
| if (!last) |
| last = !--ask->refcnt; |
| - release_sock(sk); |
| + bh_unlock_sock(sk); |
| + local_bh_enable(); |
| |
| if (last) |
| sock_put(sk); |
| -- |
| 2.7.4 |
| |
