Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1333829

[PATCH 3.10 55/64] crypto: af_alg - Disallow bind/setkey/... after accept(2)

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 3.10 55/64] crypto: af_alg - Disallow bind/setkey/... after accept(2)
Date 2016-02-15 00:40 +0100
Message-ID <r2eqK-1c5-35@gated-at.bofh.it> (permalink)
References <r2dO1-Ir-9@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

commit c840ac6af3f8713a71b4d2363419145760bd6044 upstream.

Each af_alg parent socket obtained by socket(2) corresponds to a
tfm object once bind(2) has succeeded.  An accept(2) call on that
parent socket creates a context which then uses the tfm object.

Therefore as long as any child sockets created by accept(2) exist
the parent socket must not be modified or freed.

This patch guarantees this by using locks and a reference count
on the parent socket.  Any attempt to modify the parent socket will
fail with EBUSY.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/af_alg.c         |   35 ++++++++++++++++++++++++++++++++---
 include/crypto/if_alg.h |    8 +++-----
 2 files changed, 35 insertions(+), 8 deletions(-)

--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -125,6 +125,23 @@ int af_alg_release(struct socket *sock)
 }
 EXPORT_SYMBOL_GPL(af_alg_release);
 
+void af_alg_release_parent(struct sock *sk)
+{
+	struct alg_sock *ask = alg_sk(sk);
+	bool last;
+
+	sk = ask->parent;
+	ask = alg_sk(sk);
+
+	lock_sock(sk);
+	last = !--ask->refcnt;
+	release_sock(sk);
+
+	if (last)
+		sock_put(sk);
+}
+EXPORT_SYMBOL_GPL(af_alg_release_parent);
+
 static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
 	struct sock *sk = sock->sk;
@@ -132,6 +149,7 @@ static int alg_bind(struct socket *sock,
 	struct sockaddr_alg *sa = (void *)uaddr;
 	const struct af_alg_type *type;
 	void *private;
+	int err;
 
 	if (sock->state == SS_CONNECTED)
 		return -EINVAL;
@@ -157,16 +175,22 @@ static int alg_bind(struct socket *sock,
 		return PTR_ERR(private);
 	}
 
+	err = -EBUSY;
 	lock_sock(sk);
+	if (ask->refcnt)
+		goto unlock;
 
 	swap(ask->type, type);
 	swap(ask->private, private);
 
+	err = 0;
+
+unlock:
 	release_sock(sk);
 
 	alg_do_release(type, private);
 
-	return 0;
+	return err;
 }
 
 static int alg_setkey(struct sock *sk, char __user *ukey,
@@ -199,11 +223,15 @@ static int alg_setsockopt(struct socket
 	struct sock *sk = sock->sk;
 	struct alg_sock *ask = alg_sk(sk);
 	const struct af_alg_type *type;
-	int err = -ENOPROTOOPT;
+	int err = -EBUSY;
 
 	lock_sock(sk);
+	if (ask->refcnt)
+		goto unlock;
+
 	type = ask->type;
 
+	err = -ENOPROTOOPT;
 	if (level != SOL_ALG || !type)
 		goto unlock;
 
@@ -254,7 +282,8 @@ int af_alg_accept(struct sock *sk, struc
 
 	sk2->sk_family = PF_ALG;
 
-	sock_hold(sk);
+	if (!ask->refcnt++)
+		sock_hold(sk);
 	alg_sk(sk2)->parent = sk;
 	alg_sk(sk2)->type = type;
 
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -30,6 +30,8 @@ struct alg_sock {
 
 	struct sock *parent;
 
+	unsigned int refcnt;
+
 	const struct af_alg_type *type;
 	void *private;
 };
@@ -64,6 +66,7 @@ int af_alg_register_type(const struct af
 int af_alg_unregister_type(const struct af_alg_type *type);
 
 int af_alg_release(struct socket *sock);
+void af_alg_release_parent(struct sock *sk);
 int af_alg_accept(struct sock *sk, struct socket *newsock);
 
 int af_alg_make_sg(struct af_alg_sgl *sgl, void __user *addr, int len,
@@ -80,11 +83,6 @@ static inline struct alg_sock *alg_sk(st
 	return (struct alg_sock *)sk;
 }
 
-static inline void af_alg_release_parent(struct sock *sk)
-{
-	sock_put(alg_sk(sk)->parent);
-}
-
 static inline void af_alg_init_completion(struct af_alg_completion *completion)
 {
 	init_completion(&completion->completion);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 03/64] crypto: algif_hash - Only export and import on sockets with data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 31/64] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 55/64] crypto: af_alg - Disallow bind/setkey/... after accept(2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 25/64] fix sysvfs symlinks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 01/64] recordmcount: Fix endianness handling bug for nop_mcount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 37/64] ALSA: seq: Fix lockdep warnings due to double mutex locks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 60/64] crypto: algif_hash - wait for crypto_ahash_init() to complete Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 59/64] ahci: Intel DNV device IDs SATA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 07/64] kernel/signal.c: unexport sigsuspend() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 24/64] [media] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 39/64] ALSA: timer: Fix leftover link at closing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 28/64] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 23/64] [media] v4l2-compat-ioctl32: fix alignment for ARM64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 05/64] HID: usbhid: fix recursive deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 57/64] AHCI: Fix softreset failed issue of Port Multiplier Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 04/64] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:40 +0100
  [PATCH 3.10 16/64] vTPM: fix memory allocation flag for rtce buffer at kernel boot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 14/64] wlcore/wl12xx: spi: fix oops on firmware load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 15/64] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 22/64] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 19/64] [PATCH] fix calculation of meta_bg descriptor backups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 18/64] jbd2: Fix unreclaimed pages after truncate in data=journal mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 17/64] mtd: mtdpart: fix add_mtd_partitions error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 12/64] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 21/64] parisc: Fix syscall restarts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 11/64] Revert "dm mpath: fix stalls when handling invalid ioctls" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 13/64] spi: fix parent-device reference leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  [PATCH 3.10 02/64] xhci: fix placement of call to usb_disabled() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 00:50 +0100
  Re: [PATCH 3.10 00/64] 3.10.97-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-15 06:30 +0100
    Re: [PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 19:20 +0100
  Re: [PATCH 3.10 00/64] 3.10.97-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-15 16:50 +0100
  Re: [PATCH 3.10 00/64] 3.10.97-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-15 18:20 +0100
    Re: [PATCH 3.10 00/64] 3.10.97-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-17 21:40 +0100
      Re: [PATCH 3.10 00/64] 3.10.97-stable review Willy Tarreau <w@1wt.eu> - 2016-02-18 00:30 +0100
        Re: [PATCH 3.10 00/64] 3.10.97-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-18 00:40 +0100
          Re: [PATCH 3.10 00/64] 3.10.97-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-18 04:30 +0100
            Re: [PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-19 23:30 +0100
    Re: [PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-17 21:40 +0100

csiph-web