Herbert Xu 9a8ecc6a3e crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() ... commit 34c86f4c4a7be3b3e35aa48bd18299d4c756064d upstream. The locking in af_alg_release_parent is broken as the BH socket lock can only be taken if there is a code-path to handle the case where the lock is owned by process-context. Instead of adding such handling, we can fix this by changing the ref counts to atomic_t. This patch also modifies the main refcnt to include both normal and nokey sockets. This way we don't have to fudge the nokey ref count when a socket changes from nokey to normal. Credits go to Mauricio Faria de Oliveira who diagnosed this bug and sent a patch for it: https://lore.kernel.org/linux-crypto/20200605161657.535043-1-mfo@canonical.com/ Reported-by: Brian Moyles <bmoyles@netflix.com> Reported-by: Mauricio Faria de Oliveira <mfo@canonical.com> Fixes: 37f96694cf73 ("crypto: af_alg - Use bh_lock_sock in...") Cc: <stable@vger.kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-07-09 09:37:10 +02:00
..
asymmetric_keys
async_tx
842.c
ablkcipher.c
acompress.c
aead.c
aegis.h
aegis128.c
aegis128l.c
aegis256.c
aes_generic.c
aes_ti.c
af_alg.c	crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()	2020-07-09 09:37:10 +02:00
ahash.c
akcipher.c
algapi.c	crypto: api - Fix race condition in crypto_spawn_alg	2020-02-11 04:34:05 -08:00
algboss.c	crypto: algboss - don't wait during notifier callback	2020-06-25 15:33:09 +02:00
algif_aead.c	crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()	2020-07-09 09:37:10 +02:00
algif_hash.c	crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()	2020-07-09 09:37:10 +02:00
algif_rng.c
algif_skcipher.c	crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()	2020-07-09 09:37:10 +02:00
ansi_cprng.c
anubis.c
api.c	crypto: api - Fix race condition in crypto_spawn_alg	2020-02-11 04:34:05 -08:00
arc4.c
authenc.c
authencesn.c
blkcipher.c
blowfish_common.c
blowfish_generic.c
camellia_generic.c
cast5_generic.c
cast6_generic.c
cast_common.c
cbc.c
ccm.c
cfb.c
chacha20_generic.c
chacha20poly1305.c
cipher.c
cmac.c
compress.c
crc32_generic.c
crc32c_generic.c
crct10dif_common.c
crct10dif_generic.c
cryptd.c
crypto_engine.c
crypto_null.c
crypto_user.c
crypto_wq.c
ctr.c
cts.c
deflate.c
des_generic.c
dh.c
dh_helper.c
drbg.c
ecb.c
ecc.c
ecc.h
ecc_curve_defs.h
ecdh.c
ecdh_helper.c
echainiv.c
fcrypt.c
fips.c
gcm.c
gf128mul.c
ghash-generic.c
hash_info.c
hmac.c
internal.h	crypto: api - Fix race condition in crypto_spawn_alg	2020-02-11 04:34:05 -08:00
jitterentropy-kcapi.c
jitterentropy.c
Kconfig
keywrap.c
khazad.c
kpp.c
lrw.c	gcc-10: avoid shadowing standard library 'free()' in crypto	2020-05-20 08:18:46 +02:00
lz4.c
lz4hc.c
lzo.c
Makefile
mcryptd.c
md4.c
md5.c
memneq.c
michael_mic.c
morus640.c
morus1280.c
pcbc.c
pcrypt.c	crypto: pcrypt - Do not clear MAY_SLEEP flag in original request	2020-02-11 04:34:05 -08:00
poly1305_generic.c
proc.c
ripemd.h
rmd128.c
rmd160.c
rmd256.c
rmd320.c
rng.c
rsa-pkcs1pad.c
rsa.c
rsa_helper.c
rsaprivkey.asn1
rsapubkey.asn1
salsa20_generic.c
scatterwalk.c
scompress.c
seed.c
seqiv.c
serpent_generic.c
sha1_generic.c
sha3_generic.c
sha256_generic.c
sha512_generic.c
shash.c
simd.c
skcipher.c
sm3_generic.c
sm4_generic.c
tcrypt.c
tcrypt.h
tea.c
testmgr.c
testmgr.h
tgr192.c	crypto: tgr192 - fix unaligned memory access	2020-01-27 14:50:13 +01:00
twofish_common.c
twofish_generic.c
vmac.c
wp512.c
xcbc.c
xor.c
xts.c	gcc-10: avoid shadowing standard library 'free()' in crypto	2020-05-20 08:18:46 +02:00
zstd.c