diff options
author | Herbert Xu <herbert@gondor.apana.org.au> | 2020-04-10 16:09:42 +1000 |
---|---|---|
committer | Herbert Xu <herbert@gondor.apana.org.au> | 2020-04-16 16:49:22 +1000 |
commit | 086ccda8f29040866eb21efc9056e401fd0cccf8 (patch) | |
tree | b58695699d6e207884b2536a5a72af2c815b673d /crypto/af_alg.c | |
parent | 01f8445e237766d4d488c0e7cec9cf8827fb41c2 (diff) | |
download | linux-crypto-086ccda8f29040866eb21efc9056e401fd0cccf8.tar.gz linux-crypto-086ccda8f29040866eb21efc9056e401fd0cccf8.zip |
crypto: api - Fix use-after-free and race in crypto_spawn_alg
There are two problems in crypto_spawn_alg. First of all it may
return spawn->alg even if spawn->dead is set. This results in a
double-free as detected by syzbot.
Secondly the setting of the DYING flag is racy because we hold
the read-lock instead of the write-lock. We should instead call
crypto_shoot_alg in a safe manner by gaining a refcount, dropping
the lock, and then releasing the refcount.
This patch fixes both problems.
Reported-by: syzbot+fc0674cde00b66844470@syzkaller.appspotmail.com
Fixes: 4e81fac9e408 ("crypto: api - Do not zap spawn->alg")
Fixes: bc1d8cb6169a ("crypto: api - Fix race condition in...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions