Commit 1b34cbbf authored by Herbert Xu's avatar Herbert Xu
Browse files

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg 



Issuing two writes to the same af_alg socket is bogus as the
data will be interleaved in an unpredictable fashion.  Furthermore,
concurrent writes may create inconsistencies in the internal
socket state.

Disallow this by adding a new ctx->write field that indiciates
exclusive ownership for writing.

Fixes: 8ff59090 ("crypto: algif_skcipher - User-space interface for skcipher operations")
Reported-by: default avatarMuhammad Alifa Ramdhan <ramdhan@starlabs.sg>
Reported-by: default avatarBing-Jhong Billy Jheng <billy@starlabs.sg>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 9574b233

crypto/af_alg.c

+7 −0
Original line number Diff line number Diff line
@@ -970,6 +970,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, 
	}



	lock_sock(sk);

	if (ctx->write) {

		release_sock(sk);

		return -EBUSY;

	}

	ctx->write = true;



	if (ctx->init && !ctx->more) {

		if (ctx->used) {

			err = -EINVAL;
@@ -1105,6 +1111,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, 


unlock:

	af_alg_data_wakeup(sk);

	ctx->write = false;

	release_sock(sk);



	return copied ?: err;

include/crypto/if_alg.h

+6 −4
Original line number Diff line number Diff line
@@ -135,6 +135,7 @@ struct af_alg_async_req { 
 *			SG?

 * @enc:		Cryptographic operation to be performed when

 *			recvmsg is invoked.

 * @write:		True if we are in the middle of a write.

 * @init:		True if metadata has been sent.

 * @len:		Length of memory allocated for this data structure.

 * @inflight:		Non-zero when AIO requests are in flight.
@@ -151,10 +152,11 @@ struct af_alg_ctx { 
	size_t used;

	atomic_t rcvused;



	bool more;

	bool merge;

	bool enc;

	bool init;

	u32		more:1,

			merge:1,

			enc:1,

			write:1,

			init:1;



	unsigned int len;