[3.16.y-ckt stable] Patch "crypto: af_alg - Fix socket double-free when accept fails" has been added to the 3.16.y-ckt tree
Luis Henriques
luis.henriques at canonical.com
Wed Feb 3 14:02:14 UTC 2016
This is a note to let you know that I have just added a patch titled
crypto: af_alg - Fix socket double-free when accept fails
to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree
which can be found at:
http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-queue
This patch is scheduled to be released in version 3.16.7-ckt24.
If you, or anyone else, feels it should not be added to this tree, please
reply to this email.
For more information about the 3.16.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable
Thanks.
-Luis
---8<------------------------------------------------------------
>From 080df2ea773d11a359a39c71a2501e2673363cc8 Mon Sep 17 00:00:00 2001
From: Herbert Xu <herbert at gondor.apana.org.au>
Date: Wed, 30 Dec 2015 20:24:17 +0800
Subject: crypto: af_alg - Fix socket double-free when accept fails
commit a383292c86663bbc31ac62cc0c04fc77504636a6 upstream.
When we fail an accept(2) call we will end up freeing the socket
twice, once due to the direct sk_free call and once again through
newsock.
This patch fixes this by removing the sk_free call.
Reported-by: Dmitry Vyukov <dvyukov at google.com>
Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
crypto/af_alg.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index abb828a3e424..1971f3ccb09a 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -275,10 +275,8 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
security_sk_clone(sk, sk2);
err = type->accept(ask->private, sk2);
- if (err) {
- sk_free(sk2);
+ if (err)
goto unlock;
- }
sk2->sk_family = PF_ALG;
More information about the kernel-team
mailing list