diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2019-12-05 13:45:05 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-02-01 09:32:59 +0000 |
| commit | 31d8141f704b6df766571a07962480a03ffb356c (patch) | |
| tree | 99bbc203cd9d4d1c7ad1ed49bb3d9cd9aaefc695 | |
| parent | 8e2812b6c937f8e106eb72ae47ea684b8e5f45f0 (diff) | |
| download | linux-31d8141f704b6df766571a07962480a03ffb356c.tar.gz linux-31d8141f704b6df766571a07962480a03ffb356c.tar.bz2 linux-31d8141f704b6df766571a07962480a03ffb356c.zip | |
crypto: af_alg - Use bh_lock_sock in sk_destruct
commit 37f96694cf73ba116993a9d2d99ad6a75fa7fdb0 upstream.
As af_alg_release_parent may be called from BH context (most notably
due to an async request that only completes after socket closure,
or as reported here because of an RCU-delayed sk_destruct call), we
must use bh_lock_sock instead of lock_sock.
Reported-by: syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: c840ac6af3f8 ("crypto: af_alg - Disallow bind/setkey/...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | crypto/af_alg.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 0dceaabc6321..3d8e53010cda 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -134,11 +134,13 @@ void af_alg_release_parent(struct sock *sk) sk = ask->parent; ask = alg_sk(sk); - lock_sock(sk); + local_bh_disable(); + bh_lock_sock(sk); ask->nokey_refcnt -= nokey; if (!last) last = !--ask->refcnt; - release_sock(sk); + bh_unlock_sock(sk); + local_bh_enable(); if (last) sock_put(sk); |