[PATCH] crypto: api - Check spawn->alg under lock in crypto_drop_spawn

[PATCH] crypto: api - Check spawn->alg under lock in crypto_drop_spawn

[Herbert Xu]

We need to check whether spawn->alg is NULL under lock as otherwise
the algorithm could be removed from under us after we have checked
it and found it to be non-NULL.  This could cause us to remove the
spawn from a non-existent list.

Fixes: 6bfd48096ff8 ("[CRYPTO] api: Added spawns")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/algapi.c b/crypto/algapi.c
index 783006f4d339..6869feb31c99 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -668,11 +668,9 @@ EXPORT_SYMBOL_GPL(crypto_grab_spawn);
 
 void crypto_drop_spawn(struct crypto_spawn *spawn)
 {
-	if (!spawn->alg)
-		return;
-
 	down_write(&crypto_alg_sem);
-	list_del(&spawn->list);
+	if (spawn->alg)
+		list_del(&spawn->list);
 	up_write(&crypto_alg_sem);
 }
 EXPORT_SYMBOL_GPL(crypto_drop_spawn);
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] crypto: api - Check spawn->alg under lock in crypto_drop_spawn

[Eric Biggers]

On Fri, Dec 06, 2019 at 01:55:17PM +0800, Herbert Xu wrote:
> We need to check whether spawn->alg is NULL under lock as otherwise
> the algorithm could be removed from under us after we have checked
> it and found it to be non-NULL.  This could cause us to remove the
> spawn from a non-existent list.
> 
> Fixes: 6bfd48096ff8 ("[CRYPTO] api: Added spawns")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> 
> diff --git a/crypto/algapi.c b/crypto/algapi.c
> index 783006f4d339..6869feb31c99 100644
> --- a/crypto/algapi.c
> +++ b/crypto/algapi.c
> @@ -668,11 +668,9 @@ EXPORT_SYMBOL_GPL(crypto_grab_spawn);
>  
>  void crypto_drop_spawn(struct crypto_spawn *spawn)
>  {
> -	if (!spawn->alg)
> -		return;
> -
>  	down_write(&crypto_alg_sem);
> -	list_del(&spawn->list);
> +	if (spawn->alg)
> +		list_del(&spawn->list);
>  	up_write(&crypto_alg_sem);
>  }
>  EXPORT_SYMBOL_GPL(crypto_drop_spawn);

Seems the Fixes tag is wrong.  It should be:

Fixes: 7ede5a5ba55a ("crypto: api - Fix crypto_drop_spawn crash on blank spawns")

- Eric

Re: [PATCH] crypto: api - Check spawn->alg under lock in crypto_drop_spawn

[Herbert Xu]

On Tue, Dec 10, 2019 at 07:36:18PM -0800, Eric Biggers wrote:
>
> Seems the Fixes tag is wrong.  It should be:
> 
> Fixes: 7ede5a5ba55a ("crypto: api - Fix crypto_drop_spawn crash on blank spawns")

Thanks, I'll change it when I apply this patch.  FWIW the patch
does need to all the way back to the original spawn commit but
of course you need to apply 7ede5a first before you can apply this
one.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt