FAILED: patch "[PATCH] crypto: algif_hash - Fix race condition in hash_check_key" failed to apply to 3.14-stable tree

PATCH [email protected] 1 participant 1 message Feb 14, 2016

Subsystems (2)

Stable branch Crypto API

lore

Share & tools

lore

[email protected]

author maintainer

2016-02-14 21:48 UTC #0 lore raw

The patch below does not apply to the 3.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

Quoted 1 line

From ad46d7e33219218605ea619e32553daf4f346b9f Mon Sep 17 00:00:00 2001

From: Herbert Xu <[email protected]>
Date: Fri, 15 Jan 2016 22:01:08 +0800
Subject: [PATCH] crypto: algif_hash - Fix race condition in hash_check_key

We need to lock the child socket in hash_check_key as otherwise two simultaneous calls can cause the parent socket to be freed.

Cc [email protected]

Signed-off-by Herbert Xu <[email protected]>

crypto/algif_hash.c +6 -3

index 3653ab60ec79..608a7562839d 100644
@@ -242,22 +242,23 @@ static struct proto_ops algif_hash_ops = {
 
 static int hash_check_key(struct socket *sock)
 {
-	int err;
+	int err = 0;
 	struct sock *psk;
 	struct alg_sock *pask;
 	struct algif_hash_tfm *tfm;
 	struct sock *sk = sock->sk;
 	struct alg_sock *ask = alg_sk(sk);
 
+	lock_sock(sk);
 	if (ask->refcnt)
-		return 0;
+		goto unlock_child;
 
 	psk = ask->parent;
 	pask = alg_sk(ask->parent);
 	tfm = pask->private;
 
 	err = -ENOKEY;
-	lock_sock(psk);
+	lock_sock_nested(psk, SINGLE_DEPTH_NESTING);
 	if (!tfm->has_key)
 		goto unlock;

@@ -271,6 +272,8 @@ static int hash_check_key(struct socket *sock)
 
 unlock:
 	release_sock(psk);
+unlock_child:
+	release_sock(sk);
 
 	return err;
 }