diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2020-06-29 10:06:26 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2020-06-29 10:06:26 -0700 |
| commit | 2cfa46dadd203eef88cc70131df7a81ebc34b8ff (patch) | |
| tree | 22a5ef040f6407cec847249ace82de3b2af0f5ec /crypto/algif_hash.c | |
| parent | b6509f6a8c4313c068c69785c001451415969e44 (diff) | |
| parent | e04ec0de61c1eb9693179093e83ab8ca68a30d08 (diff) | |
| download | linux-2cfa46dadd203eef88cc70131df7a81ebc34b8ff.tar.gz linux-2cfa46dadd203eef88cc70131df7a81ebc34b8ff.tar.bz2 linux-2cfa46dadd203eef88cc70131df7a81ebc34b8ff.zip | |
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
"This fixes two race conditions, one in padata and one in af_alg"
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
padata: upgrade smp_mb__after_atomic to smp_mb in padata_do_serial
crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()
Diffstat (limited to 'crypto/algif_hash.c')
| -rw-r--r-- | crypto/algif_hash.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c index da1ffa4f7f8d..e71727c25a7d 100644 --- a/crypto/algif_hash.c +++ b/crypto/algif_hash.c @@ -301,7 +301,7 @@ static int hash_check_key(struct socket *sock) struct alg_sock *ask = alg_sk(sk); lock_sock(sk); - if (ask->refcnt) + if (!atomic_read(&ask->nokey_refcnt)) goto unlock_child; psk = ask->parent; @@ -313,11 +313,8 @@ static int hash_check_key(struct socket *sock) if (crypto_ahash_get_flags(tfm) & CRYPTO_TFM_NEED_KEY) goto unlock; - if (!pask->refcnt++) - sock_hold(psk); - - ask->refcnt = 1; - sock_put(psk); + atomic_dec(&pask->nokey_refcnt); + atomic_set(&ask->nokey_refcnt, 0); err = 0; |