crypto: af_alg - wait for data at beginning of recvmsg (11edb555) · Commits · 戴 / test

The wait for data is a non-atomic operation that can sleep and therefore potentially release the socket lock. The release of the socket lock allows another thread to modify the context data structure. The waiting operation for new data therefore must be called at the beginning of recvmsg. This prevents a race condition where checks of the members of the context data structure are performed by recvmsg while there is a potential for modification of these values. Fixes: ("crypto: algif_skcipher - overhaul memory management") Fixes: ("crypto: algif_aead - overhaul memory management") Reported-by:

syzbot <syzkaller@googlegroups.com> Cc: <stable@vger.kernel.org> # v4.14+ Signed-off-by:

Stephan Mueller <smueller@chronox.de> Signed-off-by:

Herbert Xu <herbert@gondor.apana.org.au>

crypto/af_alg.c

+0 −6

Original line number	Diff line number	Diff line
		@@ -1137,12 +1137,6 @@ int af_alg_get_rsgl(struct sock sk, struct msghdr msg, int flags,
		if (!af_alg_readable(sk))
		break;

		if (!ctx->used) {
		err = af_alg_wait_for_data(sk, flags);
		if (err)
		return err;
		}

		seglen = min_t(size_t, (maxsize - len),
		msg_data_left(msg));

crypto/algif_aead.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -111,6 +111,12 @@ static int _aead_recvmsg(struct socket sock, struct msghdr msg,
		size_t usedpages = 0; /* [in] RX bufs to be used from user */
		size_t processed = 0; /* [in] TX bufs to be consumed */

		if (!ctx->used) {
		err = af_alg_wait_for_data(sk, flags);
		if (err)
		return err;
		}

		/*
		* Data length provided by caller via sendmsg/sendpage that has not
		* yet been processed.

crypto/algif_skcipher.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -72,6 +72,12 @@ static int _skcipher_recvmsg(struct socket sock, struct msghdr msg,
		int err = 0;
		size_t len = 0;

		if (!ctx->used) {
		err = af_alg_wait_for_data(sk, flags);
		if (err)
		return err;
		}

		/* Allocate cipher request for current operation. */
		areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) +
		crypto_skcipher_reqsize(tfm));

Admin message