diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2020-04-10 16:09:42 +1000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-06-07 11:32:59 +0200 |
| commit | 3927c3cd9a7a9c9f4a753688d3973d65b63fc38a (patch) | |
| tree | 178b7ae1a432cf2c96752638fa6ca1d33a52409a /crypto/internal.h | |
| parent | e7b57188a55b8b60fee61bba766c961780c8dbba (diff) | |
crypto: api - Fix use-after-free and race in crypto_spawn_alg
commit 6603523bf5e432c7c8490fb500793bb15d4e5f61 upstream.
There are two problems in crypto_spawn_alg. First of all it may
return spawn->alg even if spawn->dead is set. This results in a
double-free as detected by syzbot.
Secondly the setting of the DYING flag is racy because we hold
the read-lock instead of the write-lock. We should instead call
crypto_shoot_alg in a safe manner by gaining a refcount, dropping
the lock, and then releasing the refcount.
This patch fixes both problems.
Reported-by: syzbot+fc0674cde00b66844470@syzkaller.appspotmail.com
Fixes: 4f87ee118d16 ("crypto: api - Do not zap spawn->alg")
Fixes: 73669cc55646 ("crypto: api - Fix race condition in...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'crypto/internal.h')
| -rw-r--r-- | crypto/internal.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/crypto/internal.h b/crypto/internal.h index d5ebc60c5143..ff06a3bd1ca1 100644 --- a/crypto/internal.h +++ b/crypto/internal.h @@ -65,6 +65,7 @@ void crypto_alg_tested(const char *name, int err); void crypto_remove_spawns(struct crypto_alg *alg, struct list_head *list, struct crypto_alg *nalg); void crypto_remove_final(struct list_head *list); +void crypto_shoot_alg(struct crypto_alg *alg); struct crypto_tfm *__crypto_alloc_tfm(struct crypto_alg *alg, u32 type, u32 mask); void *crypto_create_tfm(struct crypto_alg *alg, |