crypto: algif_skcipher - Fix race condition in skcipher_check_key

commit 1822793a523e5d5730b19cc21160ff1717421bc8 upstream.

We need to lock the child socket in skcipher_check_key as otherwise
two simultaneous calls can cause the parent socket to be freed.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 397205c..a9f4201 100644 (file)
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -551,22 +551,23 @@ static struct proto_ops algif_skcipher_ops = {
 
 static int skcipher_check_key(struct socket *sock)
 {
 
 static int skcipher_check_key(struct socket *sock)
 {

-       int err;
+       int err = 0;

        struct sock *psk;
        struct alg_sock *pask;
        struct skcipher_tfm *tfm;
        struct sock *sk = sock->sk;
        struct alg_sock *ask = alg_sk(sk);
 
        struct sock *psk;
        struct alg_sock *pask;
        struct skcipher_tfm *tfm;
        struct sock *sk = sock->sk;
        struct alg_sock *ask = alg_sk(sk);
 

+       lock_sock(sk);

        if (ask->refcnt)
        if (ask->refcnt)

-               return 0;
+               goto unlock_child;

 
        psk = ask->parent;
        pask = alg_sk(ask->parent);
        tfm = pask->private;
 
        err = -ENOKEY;
 
        psk = ask->parent;
        pask = alg_sk(ask->parent);
        tfm = pask->private;
 
        err = -ENOKEY;

-       lock_sock(psk);
+       lock_sock_nested(psk, SINGLE_DEPTH_NESTING);

        if (!tfm->has_key)
                goto unlock;
 
        if (!tfm->has_key)
                goto unlock;
 


@@ -580,6 +581,8 @@ static int skcipher_check_key(struct socket *sock)
 
 unlock:
        release_sock(psk);
 
 unlock:
        release_sock(psk);

+unlock_child:
+       release_sock(sk);

 
        return err;
 }
 
        return err;
 }