From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Jonathan Cameron , Herbert Xu , Sasha Levin Subject: [PATCH AUTOSEL for 4.14 052/110] crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t Date: Sat, 3 Feb 2018 18:00:53 +0000 Message-ID: <20180203180015.29073-52-alexander.levin@microsoft.com> References: <20180203180015.29073-1-alexander.levin@microsoft.com> In-Reply-To: <20180203180015.29073-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: From: Jonathan Cameron [ Upstream commit af955bf15d2c27496b0269b1f05c26f758c68314 ] This variable was increased and decreased without any protection. Result was an occasional misscount and negative wrap around resulting in false resource allocation failures. Fixes: 7d2c3f54e6f6 ("crypto: af_alg - remove locking in async callback") Signed-off-by: Jonathan Cameron Reviewed-by: Stephan Mueller Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin --- crypto/af_alg.c | 4 ++-- crypto/algif_aead.c | 2 +- crypto/algif_skcipher.c | 2 +- include/crypto/if_alg.h | 5 +++-- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 53b7fa4cf4ab..4e4640bb82b9 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -693,7 +693,7 @@ void af_alg_free_areq_sgls(struct af_alg_async_req *are= q) unsigned int i; =20 list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) { - ctx->rcvused -=3D rsgl->sg_num_bytes; + atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused); af_alg_free_sg(&rsgl->sgl); list_del(&rsgl->list); if (rsgl !=3D &areq->first_rsgl) @@ -1192,7 +1192,7 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *m= sg, int flags, =20 areq->last_rsgl =3D rsgl; len +=3D err; - ctx->rcvused +=3D err; + atomic_add(err, &ctx->rcvused); rsgl->sg_num_bytes =3D err; iov_iter_advance(&msg->msg_iter, err); } diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c index 782cb8fec323..f138af18b500 100644 --- a/crypto/algif_aead.c +++ b/crypto/algif_aead.c @@ -571,7 +571,7 @@ static int aead_accept_parent_nokey(void *private, stru= ct sock *sk) INIT_LIST_HEAD(&ctx->tsgl_list); ctx->len =3D len; ctx->used =3D 0; - ctx->rcvused =3D 0; + atomic_set(&ctx->rcvused, 0); ctx->more =3D 0; ctx->merge =3D 0; ctx->enc =3D 0; diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c index 7a3e663d54d5..90bc4e0f0785 100644 --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@ -391,7 +391,7 @@ static int skcipher_accept_parent_nokey(void *private, = struct sock *sk) INIT_LIST_HEAD(&ctx->tsgl_list); ctx->len =3D len; ctx->used =3D 0; - ctx->rcvused =3D 0; + atomic_set(&ctx->rcvused, 0); ctx->more =3D 0; ctx->merge =3D 0; ctx->enc =3D 0; diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h index aeec003a566b..ac0eae8372ab 100644 --- a/include/crypto/if_alg.h +++ b/include/crypto/if_alg.h @@ -18,6 +18,7 @@ #include #include #include +#include #include =20 #include @@ -155,7 +156,7 @@ struct af_alg_ctx { struct af_alg_completion completion; =20 size_t used; - size_t rcvused; + atomic_t rcvused; =20 bool more; bool merge; @@ -228,7 +229,7 @@ static inline int af_alg_rcvbuf(struct sock *sk) struct af_alg_ctx *ctx =3D ask->private; =20 return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) - - ctx->rcvused, 0); + atomic_read(&ctx->rcvused), 0); } =20 /** --=20 2.11.0