| From a383292c86663bbc31ac62cc0c04fc77504636a6 Mon Sep 17 00:00:00 2001 |
| From: Herbert Xu <herbert@gondor.apana.org.au> |
| Date: Wed, 30 Dec 2015 20:24:17 +0800 |
| Subject: crypto: af_alg - Fix socket double-free when accept fails |
| |
| From: Herbert Xu <herbert@gondor.apana.org.au> |
| |
| commit a383292c86663bbc31ac62cc0c04fc77504636a6 upstream. |
| |
| When we fail an accept(2) call we will end up freeing the socket |
| twice, once due to the direct sk_free call and once again through |
| newsock. |
| |
| This patch fixes this by removing the sk_free call. |
| |
| Reported-by: Dmitry Vyukov <dvyukov@google.com> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| crypto/af_alg.c | 4 +--- |
| 1 file changed, 1 insertion(+), 3 deletions(-) |
| |
| --- a/crypto/af_alg.c |
| +++ b/crypto/af_alg.c |
| @@ -275,10 +275,8 @@ int af_alg_accept(struct sock *sk, struc |
| security_sk_clone(sk, sk2); |
| |
| err = type->accept(ask->private, sk2); |
| - if (err) { |
| - sk_free(sk2); |
| + if (err) |
| goto unlock; |
| - } |
| |
| sk2->sk_family = PF_ALG; |
| |
