diff options
| author | Stephan Mueller <smueller@chronox.de> | 2017-11-29 12:02:23 +0100 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2017-12-11 22:29:54 +1100 |
| commit | 11edb555966ed2c66c533d17c604f9d7e580a829 (patch) | |
| tree | dae6e140f8c759c9d966e7cb0e25b5c69f0dae7b /crypto/af_alg.c | |
| parent | 2b4f27c36bcd46e820ddb9a8e6fe6a63fa4250b8 (diff) | |
| download | linux-11edb555966ed2c66c533d17c604f9d7e580a829.tar.gz linux-11edb555966ed2c66c533d17c604f9d7e580a829.tar.bz2 linux-11edb555966ed2c66c533d17c604f9d7e580a829.zip | |
crypto: af_alg - wait for data at beginning of recvmsg
The wait for data is a non-atomic operation that can sleep and therefore
potentially release the socket lock. The release of the socket lock
allows another thread to modify the context data structure. The waiting
operation for new data therefore must be called at the beginning of
recvmsg. This prevents a race condition where checks of the members of
the context data structure are performed by recvmsg while there is a
potential for modification of these values.
Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")
Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management")
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org> # v4.14+
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/af_alg.c')
| -rw-r--r-- | crypto/af_alg.c | 6 |
1 files changed, 0 insertions, 6 deletions
diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 358749c38894..f1a2caf1b59b 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -1137,12 +1137,6 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, if (!af_alg_readable(sk)) break; - if (!ctx->used) { - err = af_alg_wait_for_data(sk, flags); - if (err) - return err; - } - seglen = min_t(size_t, (maxsize - len), msg_data_left(msg)); |