Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit af955bf1 authored by Jonathan Cameron's avatar Jonathan Cameron Committed by Herbert Xu
Browse files

crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t 



This variable was increased and decreased without any protection.
Result was an occasional misscount and negative wrap around resulting
in false resource allocation failures.

Fixes: 7d2c3f54 ("crypto: af_alg - remove locking in async callback")
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: default avatarStephan Mueller <smueller@chronox.de>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent e57121d0

crypto/af_alg.c

+2 −2
Original line number Diff line number Diff line
@@ -664,7 +664,7 @@ void af_alg_free_areq_sgls(struct af_alg_async_req *areq) 
	unsigned int i;



	list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) {

		ctx->rcvused -= rsgl->sg_num_bytes;

		atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused);

		af_alg_free_sg(&rsgl->sgl);

		list_del(&rsgl->list);

		if (rsgl != &areq->first_rsgl)
@@ -1162,7 +1162,7 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, 


		areq->last_rsgl = rsgl;

		len += err;

		ctx->rcvused += err;

		atomic_add(err, &ctx->rcvused);

		rsgl->sg_num_bytes = err;

		iov_iter_advance(&msg->msg_iter, err);

	}

crypto/algif_aead.c

+1 −1
Original line number Diff line number Diff line
@@ -571,7 +571,7 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) 
	INIT_LIST_HEAD(&ctx->tsgl_list);

	ctx->len = len;

	ctx->used = 0;

	ctx->rcvused = 0;

	atomic_set(&ctx->rcvused, 0);

	ctx->more = 0;

	ctx->merge = 0;

	ctx->enc = 0;

crypto/algif_skcipher.c

+1 −1
Original line number Diff line number Diff line
@@ -390,7 +390,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) 
	INIT_LIST_HEAD(&ctx->tsgl_list);

	ctx->len = len;

	ctx->used = 0;

	ctx->rcvused = 0;

	atomic_set(&ctx->rcvused, 0);

	ctx->more = 0;

	ctx->merge = 0;

	ctx->enc = 0;

include/crypto/if_alg.h

+3 −2
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ 
#include <linux/if_alg.h>

#include <linux/scatterlist.h>

#include <linux/types.h>

#include <linux/atomic.h>

#include <net/sock.h>



#include <crypto/aead.h>
@@ -150,7 +151,7 @@ struct af_alg_ctx { 
	struct crypto_wait wait;



	size_t used;

	size_t rcvused;

	atomic_t rcvused;



	bool more;

	bool merge;
@@ -215,7 +216,7 @@ static inline int af_alg_rcvbuf(struct sock *sk) 
	struct af_alg_ctx *ctx = ask->private;



	return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) -

			  ctx->rcvused, 0);

		     atomic_read(&ctx->rcvused), 0);

}



/**