crypto: af_alg - Use bh_lock_sock in sk_destruct
commit5.4-rM2-2.2.x-imx-squashed37f96694cf
upstream. As af_alg_release_parent may be called from BH context (most notably due to an async request that only completes after socket closure, or as reported here because of an RCU-delayed sk_destruct call), we must use bh_lock_sock instead of lock_sock. Reported-by: syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Fixes:c840ac6af3
("crypto: af_alg - Disallow bind/setkey/...") Cc: <stable@vger.kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
ac39443b7b
commit
9d9b578ffe
|
@ -134,11 +134,13 @@ void af_alg_release_parent(struct sock *sk)
|
|||
sk = ask->parent;
|
||||
ask = alg_sk(sk);
|
||||
|
||||
lock_sock(sk);
|
||||
local_bh_disable();
|
||||
bh_lock_sock(sk);
|
||||
ask->nokey_refcnt -= nokey;
|
||||
if (!last)
|
||||
last = !--ask->refcnt;
|
||||
release_sock(sk);
|
||||
bh_unlock_sock(sk);
|
||||
local_bh_enable();
|
||||
|
||||
if (last)
|
||||
sock_put(sk);
|
||||
|
|
Loading…
Reference in New Issue