diff options
| author | Jia-Ju Bai <baijiaju1990@163.com> | 2017-10-03 10:25:22 +0800 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2017-10-07 12:04:32 +0800 |
| commit | 9039f3ef446e9ffa200200c934f049add9e58426 (patch) | |
| tree | 43f987e78052880c69f8e7f2b93fcf3dfafc8fd7 /crypto | |
| parent | 5125e4e867ab888f2d4b443a1ce463adefb370db (diff) | |
| download | linux-stable-9039f3ef446e9ffa200200c934f049add9e58426.tar.gz linux-stable-9039f3ef446e9ffa200200c934f049add9e58426.tar.bz2 linux-stable-9039f3ef446e9ffa200200c934f049add9e58426.zip | |
crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned
The SCTP program may sleep under a spinlock, and the function call path is:
sctp_generate_t3_rtx_event (acquire the spinlock)
sctp_do_sm
sctp_side_effects
sctp_cmd_interpreter
sctp_make_init_ack
sctp_pack_cookie
crypto_shash_setkey
shash_setkey_unaligned
kmalloc(GFP_KERNEL)
For the same reason, the orinoco driver may sleep in interrupt handler,
and the function call path is:
orinoco_rx_isr_tasklet
orinoco_rx
orinoco_mic
crypto_shash_setkey
shash_setkey_unaligned
kmalloc(GFP_KERNEL)
To fix it, GFP_KERNEL is replaced with GFP_ATOMIC.
This bug is found by my static analysis tool and my code review.
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/shash.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/crypto/shash.c b/crypto/shash.c index 5e31c8d776df..8fcecc66741d 100644 --- a/crypto/shash.c +++ b/crypto/shash.c @@ -41,7 +41,7 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, int err; absize = keylen + (alignmask & ~(crypto_tfm_ctx_alignment() - 1)); - buffer = kmalloc(absize, GFP_KERNEL); + buffer = kmalloc(absize, GFP_ATOMIC); if (!buffer) return -ENOMEM; |