From 086ccda8f29040866eb21efc9056e401fd0cccf8 Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Fri, 10 Apr 2020 16:09:42 +1000 Subject: crypto: api - Fix use-after-free and race in crypto_spawn_alg There are two problems in crypto_spawn_alg. First of all it may return spawn->alg even if spawn->dead is set. This results in a double-free as detected by syzbot. Secondly the setting of the DYING flag is racy because we hold the read-lock instead of the write-lock. We should instead call crypto_shoot_alg in a safe manner by gaining a refcount, dropping the lock, and then releasing the refcount. This patch fixes both problems. Reported-by: syzbot+fc0674cde00b66844470@syzkaller.appspotmail.com Fixes: 4e81fac9e408 ("crypto: api - Do not zap spawn->alg") Fixes: bc1d8cb6169a ("crypto: api - Fix race condition in...") Cc: Signed-off-by: Herbert Xu --- crypto/api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'crypto/api.c') diff --git a/crypto/api.c b/crypto/api.c index 7d71a9b1..edcf6908 100644 --- a/crypto/api.c +++ b/crypto/api.c @@ -333,12 +333,13 @@ static unsigned int crypto_ctxsize(struct crypto_alg *alg, u32 type, u32 mask) return len; } -static void crypto_shoot_alg(struct crypto_alg *alg) +void crypto_shoot_alg(struct crypto_alg *alg) { down_write(&crypto_alg_sem); alg->cra_flags |= CRYPTO_ALG_DYING; up_write(&crypto_alg_sem); } +EXPORT_SYMBOL_GPL(crypto_shoot_alg); struct crypto_tfm *__crypto_alloc_tfm(struct crypto_alg *alg, u32 type, u32 mask) -- cgit v1.2.3