Patch "crypto: algif_skcipher - Fix race condition in skcipher_check_key" has been added to the 4.4-stable tree

Patch "crypto: algif_skcipher - Fix race condition in skcipher_check_key" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    crypto: algif_skcipher - Fix race condition in skcipher_check_key

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     crypto-algif_skcipher-fix-race-condition-in-skcipher_check_key.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 1822793a523e5d5730b19cc21160ff1717421bc8 Mon Sep 17 00:00:00 2001
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Fri, 15 Jan 2016 22:02:20 +0800
Subject: crypto: algif_skcipher - Fix race condition in skcipher_check_key

From: Herbert Xu <herbert@gondor.apana.org.au>

commit 1822793a523e5d5730b19cc21160ff1717421bc8 upstream.

We need to lock the child socket in skcipher_check_key as otherwise
two simultaneous calls can cause the parent socket to be freed.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/algif_skcipher.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -755,22 +755,23 @@ static struct proto_ops algif_skcipher_o
 
 static int skcipher_check_key(struct socket *sock)
 {
-	int err;
+	int err = 0;
 	struct sock *psk;
 	struct alg_sock *pask;
 	struct skcipher_tfm *tfm;
 	struct sock *sk = sock->sk;
 	struct alg_sock *ask = alg_sk(sk);
 
+	lock_sock(sk);
 	if (ask->refcnt)
-		return 0;
+		goto unlock_child;
 
 	psk = ask->parent;
 	pask = alg_sk(ask->parent);
 	tfm = pask->private;
 
 	err = -ENOKEY;
-	lock_sock(psk);
+	lock_sock_nested(psk, SINGLE_DEPTH_NESTING);
 	if (!tfm->has_key)
 		goto unlock;
 
@@ -784,6 +785,8 @@ static int skcipher_check_key(struct soc
 
 unlock:
 	release_sock(psk);
+unlock_child:
+	release_sock(sk);
 
 	return err;
 }


Patches currently in stable-queue which might be from herbert@gondor.apana.org.au are

queue-4.4/crypto-af_alg-disallow-bind-setkey-...-after-accept-2.patch
queue-4.4/crypto-crc32c-fix-crc32c-soft-dependency.patch
queue-4.4/crypto-af_alg-forbid-bind-2-when-nokey-child-sockets-are-present.patch
queue-4.4/crypto-algif_hash-fix-race-condition-in-hash_check_key.patch
queue-4.4/crypto-skcipher-add-crypto_skcipher_has_setkey.patch
queue-4.4/crypto-chacha20-ssse3-align-stack-pointer-to-64-bytes.patch
queue-4.4/crypto-algif_skcipher-add-key-check-exception-for-cipher_null.patch
queue-4.4/crypto-algif_hash-remove-custom-release-parent-function.patch
queue-4.4/crypto-algif_skcipher-load-tx-sg-list-after-waiting.patch
queue-4.4/crypto-algif_skcipher-require-setkey-before-accept-2.patch
queue-4.4/crypto-algif_skcipher-add-nokey-compatibility-path.patch
queue-4.4/crypto-shash-fix-has_key-setting.patch
queue-4.4/crypto-algif_skcipher-remove-custom-release-parent-function.patch
queue-4.4/crypto-af_alg-allow-af_af_alg_release_parent-to-be-called-on-nokey-path.patch
queue-4.4/crypto-hash-add-crypto_ahash_has_setkey.patch
queue-4.4/crypto-af_alg-add-nokey-compatibility-path.patch
queue-4.4/crypto-sun4i-ss-add-missing-statesize.patch
queue-4.4/crypto-algif_hash-require-setkey-before-accept-2.patch
queue-4.4/crypto-algif_skcipher-sendmsg-sg-marking-is-off-by-one.patch
queue-4.4/crypto-algif_skcipher-fix-race-condition-in-skcipher_check_key.patch
queue-4.4/crypto-caam-make-write-transactions-bufferable-on-ppc-platforms.patch
queue-4.4/crypto-af_alg-fix-socket-double-free-when-accept-fails.patch