Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7855e916 authored by Herbert Xu's avatar Herbert Xu Committed by Sasha Levin
Browse files

crypto: algif_skcipher - Fix race condition in skcipher_check_key 



    commit 1822793a523e5d5730b19cc21160ff1717421bc8 upstream.

    We need to lock the child socket in skcipher_check_key as otherwise
    two simultaneous calls can cause the parent socket to be freed.

    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>

Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
parent 801492e2

crypto/algif_skcipher.c

+6 −3
Original line number Diff line number Diff line
@@ -551,22 +551,23 @@ static struct proto_ops algif_skcipher_ops = { 


static int skcipher_check_key(struct socket *sock)

{

	int err;

	int err = 0;

	struct sock *psk;

	struct alg_sock *pask;

	struct skcipher_tfm *tfm;

	struct sock *sk = sock->sk;

	struct alg_sock *ask = alg_sk(sk);



	lock_sock(sk);

	if (ask->refcnt)

		return 0;

		goto unlock_child;



	psk = ask->parent;

	pask = alg_sk(ask->parent);

	tfm = pask->private;



	err = -ENOKEY;

	lock_sock(psk);

	lock_sock_nested(psk, SINGLE_DEPTH_NESTING);

	if (!tfm->has_key)

		goto unlock;
@@ -580,6 +581,8 @@ static int skcipher_check_key(struct socket *sock) 


unlock:

	release_sock(psk);

unlock_child:

	release_sock(sk);



	return err;

}