diff options
| author | Jonathan Cameron <Jonathan.Cameron@huawei.com> | 2017-12-19 10:27:24 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-03-03 10:24:29 +0100 |
| commit | 36d0a678fb25a7bce5bf9b2828c0d9395fa9a990 (patch) | |
| tree | ed500363a67889db4305e94fb294bc653cfe472b /crypto | |
| parent | 99b329b4611a17df15e7122fdf4bbfb8a1245d67 (diff) | |
| download | linux-rpi3-36d0a678fb25a7bce5bf9b2828c0d9395fa9a990.tar.gz linux-rpi3-36d0a678fb25a7bce5bf9b2828c0d9395fa9a990.tar.bz2 linux-rpi3-36d0a678fb25a7bce5bf9b2828c0d9395fa9a990.zip | |
crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t
[ Upstream commit af955bf15d2c27496b0269b1f05c26f758c68314 ]
This variable was increased and decreased without any protection.
Result was an occasional misscount and negative wrap around resulting
in false resource allocation failures.
Fixes: 7d2c3f54e6f6 ("crypto: af_alg - remove locking in async callback")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/af_alg.c | 4 | ||||
| -rw-r--r-- | crypto/algif_aead.c | 2 | ||||
| -rw-r--r-- | crypto/algif_skcipher.c | 2 |
3 files changed, 4 insertions, 4 deletions
diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 53b7fa4cf4ab..4e4640bb82b9 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -693,7 +693,7 @@ void af_alg_free_areq_sgls(struct af_alg_async_req *areq) unsigned int i; list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) { - ctx->rcvused -= rsgl->sg_num_bytes; + atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused); af_alg_free_sg(&rsgl->sgl); list_del(&rsgl->list); if (rsgl != &areq->first_rsgl) @@ -1192,7 +1192,7 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, areq->last_rsgl = rsgl; len += err; - ctx->rcvused += err; + atomic_add(err, &ctx->rcvused); rsgl->sg_num_bytes = err; iov_iter_advance(&msg->msg_iter, err); } diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c index 782cb8fec323..f138af18b500 100644 --- a/crypto/algif_aead.c +++ b/crypto/algif_aead.c @@ -571,7 +571,7 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) INIT_LIST_HEAD(&ctx->tsgl_list); ctx->len = len; ctx->used = 0; - ctx->rcvused = 0; + atomic_set(&ctx->rcvused, 0); ctx->more = 0; ctx->merge = 0; ctx->enc = 0; diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c index 7a3e663d54d5..90bc4e0f0785 100644 --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@ -391,7 +391,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) INIT_LIST_HEAD(&ctx->tsgl_list); ctx->len = len; ctx->used = 0; - ctx->rcvused = 0; + atomic_set(&ctx->rcvused, 0); ctx->more = 0; ctx->merge = 0; ctx->enc = 0; |