path: root/crypto/internal.h
diff options
authorHerbert Xu <>2020-04-10 16:09:42 +1000
committerHerbert Xu <>2020-04-16 16:49:22 +1000
commit6603523bf5e432c7c8490fb500793bb15d4e5f61 (patch)
treea55f489fb787cdc482819bcf29a1a0327549637e /crypto/internal.h
parenteebac678556d6927f09a992872f4464cf3aecc76 (diff)
crypto: api - Fix use-after-free and race in crypto_spawn_alg
There are two problems in crypto_spawn_alg. First of all it may return spawn->alg even if spawn->dead is set. This results in a double-free as detected by syzbot. Secondly the setting of the DYING flag is racy because we hold the read-lock instead of the write-lock. We should instead call crypto_shoot_alg in a safe manner by gaining a refcount, dropping the lock, and then releasing the refcount. This patch fixes both problems. Reported-by: Fixes: 4f87ee118d16 ("crypto: api - Do not zap spawn->alg") Fixes: 73669cc55646 ("crypto: api - Fix race condition in...") Cc: <> Signed-off-by: Herbert Xu <>
Diffstat (limited to 'crypto/internal.h')
1 files changed, 1 insertions, 0 deletions
diff --git a/crypto/internal.h b/crypto/internal.h
index d5ebc60c5143..ff06a3bd1ca1 100644
--- a/crypto/internal.h
+++ b/crypto/internal.h
@@ -65,6 +65,7 @@ void crypto_alg_tested(const char *name, int err);
void crypto_remove_spawns(struct crypto_alg *alg, struct list_head *list,
struct crypto_alg *nalg);
void crypto_remove_final(struct list_head *list);
+void crypto_shoot_alg(struct crypto_alg *alg);
struct crypto_tfm *__crypto_alloc_tfm(struct crypto_alg *alg, u32 type,
u32 mask);
void *crypto_create_tfm(struct crypto_alg *alg,