[PATCH 098/104] crypto: api - Fix race condition in larval lookup

From: Luis Henriques
Date: Mon Sep 30 2013 - 06:13:52 EST -stable review patch. If anyone has any objections, please let me know.


From: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>

commit 77dbd7a95e4a4f15264c333a9e9ab97ee27dc2aa upstream.

crypto_larval_lookup should only return a larval if it created one.
Any larval created by another entity must be processed through
crypto_larval_wait before being returned.

Otherwise this will lead to a larval being killed twice, which
will most likely lead to a crash.

Reported-by: Kees Cook <keescook@xxxxxxxxxxxx>
Tested-by: Kees Cook <keescook@xxxxxxxxxxxx>
Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
[ luis: backported to 3.5: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@xxxxxxxxxxxxx>
crypto/api.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/crypto/api.c b/crypto/api.c
index 033a714..cea3cf6 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -34,6 +34,8 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem);

+static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
@@ -150,8 +152,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,

- if (alg != &larval->alg)
+ if (alg != &larval->alg) {
+ if (crypto_is_larval(alg))
+ alg = crypto_larval_wait(alg);
+ }

return alg;

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/