Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9d9b578f authored by Herbert Xu's avatar Herbert Xu Committed by Greg Kroah-Hartman
Browse files

crypto: af_alg - Use bh_lock_sock in sk_destruct 



commit 37f96694cf73ba116993a9d2d99ad6a75fa7fdb0 upstream.

As af_alg_release_parent may be called from BH context (most notably
due to an async request that only completes after socket closure,
or as reported here because of an RCU-delayed sk_destruct call), we
must use bh_lock_sock instead of lock_sock.

Reported-by: default avatar <syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com>
Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Fixes: c840ac6a ("crypto: af_alg - Disallow bind/setkey/...")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ac39443b

crypto/af_alg.c

+4 −2
Original line number Diff line number Diff line
@@ -134,11 +134,13 @@ void af_alg_release_parent(struct sock *sk) 
	sk = ask->parent;

	ask = alg_sk(sk);



	lock_sock(sk);

	local_bh_disable();

	bh_lock_sock(sk);

	ask->nokey_refcnt -= nokey;

	if (!last)

		last = !--ask->refcnt;

	release_sock(sk);

	bh_unlock_sock(sk);

	local_bh_enable();



	if (last)

		sock_put(sk);