crypto: af_alg - Use bh_lock_sock in sk_destruct

BugLink: https://bugs.launchpad.net/bugs/1864904
commit 37f96694cf73ba116993a9d2d99ad6a75fa7fdb0 upstream.

As af_alg_release_parent may be called from BH context (most notably
due to an async request that only completes after socket closure,
or as reported here because of an RCU-delayed sk_destruct call), we
must use bh_lock_sock instead of lock_sock.

Reported-by: syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: c840ac6af3f8 ("crypto: af_alg - Disallow bind/setkey/...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index e915abfed8e4c6f3c972434900b16065b44f4075..ff6d7d32e92fcfed5afb2f115c4bf504382a429c 100644 (file)
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -139,11 +139,13 @@ void af_alg_release_parent(struct sock *sk)
        sk = ask->parent;
        ask = alg_sk(sk);
 
-       lock_sock(sk);
+       local_bh_disable();
+       bh_lock_sock(sk);
        ask->nokey_refcnt -= nokey;
        if (!last)
                last = !--ask->refcnt;
-       release_sock(sk);
+       bh_unlock_sock(sk);
+       local_bh_enable();
 
        if (last)
                sock_put(sk);