Commit 37f96694 authored Dec 05, 2019 by Herbert Xu

crypto: af_alg - Use bh_lock_sock in sk_destruct



As af_alg_release_parent may be called from BH context (most notably
due to an async request that only completes after socket closure,
or as reported here because of an RCU-delayed sk_destruct call), we
must use bh_lock_sock instead of lock_sock.

Reported-by:  <syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com>
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: c840ac6a ("crypto: af_alg - Disallow bind/setkey/...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

parent bfcdcef8

crypto/af_alg.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -134,11 +134,13 @@ void af_alg_release_parent(struct sock *sk)
		sk = ask->parent;
		ask = alg_sk(sk);

		lock_sock(sk);
		local_bh_disable();
		bh_lock_sock(sk);
		ask->nokey_refcnt -= nokey;
		if (!last)
		last = !--ask->refcnt;
		release_sock(sk);
		bh_unlock_sock(sk);
		local_bh_enable();

		if (last)
		sock_put(sk);

Admin message