Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 87536a81 authored by Nikolay Aleksandrov's avatar Nikolay Aleksandrov Committed by Steffen Klassert
Browse files

net: af_key: fix sleeping under rcu 



There's a kmalloc with GFP_KERNEL in a helper
(pfkey_sadb2xfrm_user_sec_ctx) used in pfkey_compile_policy which is
called under rcu_read_lock. Adjust pfkey_sadb2xfrm_user_sec_ctx to have
a gfp argument and adjust the users.

CC: Dave Jones <davej@redhat.com>
CC: Steffen Klassert <steffen.klassert@secunet.com>
CC: Fan Du <fan.du@windriver.com>
CC: David S. Miller <davem@davemloft.net>

Signed-off-by: default avatarNikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent a8d9bc2e

net/key/af_key.c

+7 −6
Original line number Diff line number Diff line
@@ -433,12 +433,13 @@ static inline int verify_sec_ctx_len(const void *p) 
	return 0;

}



static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(const struct sadb_x_sec_ctx *sec_ctx)

static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(const struct sadb_x_sec_ctx *sec_ctx,

								     gfp_t gfp)

{

	struct xfrm_user_sec_ctx *uctx = NULL;

	int ctx_size = sec_ctx->sadb_x_ctx_len;



	uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL);

	uctx = kmalloc((sizeof(*uctx)+ctx_size), gfp);



	if (!uctx)

		return NULL;
@@ -1124,7 +1125,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, 


	sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];

	if (sec_ctx != NULL) {

		struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);

		struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);



		if (!uctx)

			goto out;
@@ -2231,7 +2232,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_ 


	sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];

	if (sec_ctx != NULL) {

		struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);

		struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);



		if (!uctx) {

			err = -ENOBUFS;
@@ -2335,7 +2336,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa 


	sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];

	if (sec_ctx != NULL) {

		struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);

		struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);



		if (!uctx)

			return -ENOMEM;
@@ -3239,7 +3240,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt, 
		}

		if ((*dir = verify_sec_ctx_len(p)))

			goto out;

		uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);

		uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_ATOMIC);

		*dir = security_xfrm_policy_alloc(&xp->security, uctx);

		kfree(uctx);