eCryptfs: move ecryptfs_find_auth_tok_for_sig() call before mutex_lock
The ecryptfs_find_auth_tok_for_sig() call is moved before the mutex_lock(s->tfm_mutex) instruction in order to avoid possible deadlocks that may occur by holding the lock on the two semaphores 'key->sem' and 's->tfm_mutex' in reverse order. Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
This commit is contained in:
parent
0e1fc5ef47
commit
950983fc04
|
@ -635,6 +635,16 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes,
|
||||||
}
|
}
|
||||||
s->desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
|
s->desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
|
||||||
(*packet_size) = 0;
|
(*packet_size) = 0;
|
||||||
|
rc = ecryptfs_find_auth_tok_for_sig(
|
||||||
|
&auth_tok_key,
|
||||||
|
&s->auth_tok, mount_crypt_stat,
|
||||||
|
mount_crypt_stat->global_default_fnek_sig);
|
||||||
|
if (rc) {
|
||||||
|
printk(KERN_ERR "%s: Error attempting to find auth tok for "
|
||||||
|
"fnek sig [%s]; rc = [%d]\n", __func__,
|
||||||
|
mount_crypt_stat->global_default_fnek_sig, rc);
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
rc = ecryptfs_get_tfm_and_mutex_for_cipher_name(
|
rc = ecryptfs_get_tfm_and_mutex_for_cipher_name(
|
||||||
&s->desc.tfm,
|
&s->desc.tfm,
|
||||||
&s->tfm_mutex, mount_crypt_stat->global_default_fn_cipher_name);
|
&s->tfm_mutex, mount_crypt_stat->global_default_fn_cipher_name);
|
||||||
|
@ -720,16 +730,6 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes,
|
||||||
goto out_free_unlock;
|
goto out_free_unlock;
|
||||||
}
|
}
|
||||||
dest[s->i++] = s->cipher_code;
|
dest[s->i++] = s->cipher_code;
|
||||||
rc = ecryptfs_find_auth_tok_for_sig(
|
|
||||||
&auth_tok_key,
|
|
||||||
&s->auth_tok, mount_crypt_stat,
|
|
||||||
mount_crypt_stat->global_default_fnek_sig);
|
|
||||||
if (rc) {
|
|
||||||
printk(KERN_ERR "%s: Error attempting to find auth tok for "
|
|
||||||
"fnek sig [%s]; rc = [%d]\n", __func__,
|
|
||||||
mount_crypt_stat->global_default_fnek_sig, rc);
|
|
||||||
goto out_free_unlock;
|
|
||||||
}
|
|
||||||
/* TODO: Support other key modules than passphrase for
|
/* TODO: Support other key modules than passphrase for
|
||||||
* filename encryption */
|
* filename encryption */
|
||||||
if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
|
if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
|
||||||
|
@ -983,6 +983,15 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size,
|
||||||
__func__, s->cipher_code);
|
__func__, s->cipher_code);
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
rc = ecryptfs_find_auth_tok_for_sig(&auth_tok_key,
|
||||||
|
&s->auth_tok, mount_crypt_stat,
|
||||||
|
s->fnek_sig_hex);
|
||||||
|
if (rc) {
|
||||||
|
printk(KERN_ERR "%s: Error attempting to find auth tok for "
|
||||||
|
"fnek sig [%s]; rc = [%d]\n", __func__, s->fnek_sig_hex,
|
||||||
|
rc);
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
rc = ecryptfs_get_tfm_and_mutex_for_cipher_name(&s->desc.tfm,
|
rc = ecryptfs_get_tfm_and_mutex_for_cipher_name(&s->desc.tfm,
|
||||||
&s->tfm_mutex,
|
&s->tfm_mutex,
|
||||||
s->cipher_string);
|
s->cipher_string);
|
||||||
|
@ -1029,15 +1038,6 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size,
|
||||||
* >= ECRYPTFS_MAX_IV_BYTES. */
|
* >= ECRYPTFS_MAX_IV_BYTES. */
|
||||||
memset(s->iv, 0, ECRYPTFS_MAX_IV_BYTES);
|
memset(s->iv, 0, ECRYPTFS_MAX_IV_BYTES);
|
||||||
s->desc.info = s->iv;
|
s->desc.info = s->iv;
|
||||||
rc = ecryptfs_find_auth_tok_for_sig(&auth_tok_key,
|
|
||||||
&s->auth_tok, mount_crypt_stat,
|
|
||||||
s->fnek_sig_hex);
|
|
||||||
if (rc) {
|
|
||||||
printk(KERN_ERR "%s: Error attempting to find auth tok for "
|
|
||||||
"fnek sig [%s]; rc = [%d]\n", __func__, s->fnek_sig_hex,
|
|
||||||
rc);
|
|
||||||
goto out_free_unlock;
|
|
||||||
}
|
|
||||||
/* TODO: Support other key modules than passphrase for
|
/* TODO: Support other key modules than passphrase for
|
||||||
* filename encryption */
|
* filename encryption */
|
||||||
if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
|
if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
|
||||||
|
|
Loading…
Reference in a new issue