Commit 1f723710 authored by Herbert Xu's avatar Herbert Xu
Browse files

crypto: api - Fix races in crypto_unregister_instance



There are multiple problems in crypto_unregister_instance:

1) The cra_refcnt BUG_ON check is racy and can cause crashes.
2) The cra_refcnt check shouldn't exist at all.
3) There is no reference on tmpl to protect the tmpl->free call.

This patch rewrites the function using crypto_remove_spawn which
now morphs into crypto_remove_instance.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 13cf394c
...@@ -99,10 +99,9 @@ static struct list_head *crypto_more_spawns(struct crypto_alg *alg, ...@@ -99,10 +99,9 @@ static struct list_head *crypto_more_spawns(struct crypto_alg *alg,
return &n->list == stack ? top : &n->inst->alg.cra_users; return &n->list == stack ? top : &n->inst->alg.cra_users;
} }
static void crypto_remove_spawn(struct crypto_spawn *spawn, static void crypto_remove_instance(struct crypto_instance *inst,
struct list_head *list) struct list_head *list)
{ {
struct crypto_instance *inst = spawn->inst;
struct crypto_template *tmpl = inst->tmpl; struct crypto_template *tmpl = inst->tmpl;
if (crypto_is_dead(&inst->alg)) if (crypto_is_dead(&inst->alg))
...@@ -167,7 +166,7 @@ void crypto_remove_spawns(struct crypto_alg *alg, struct list_head *list, ...@@ -167,7 +166,7 @@ void crypto_remove_spawns(struct crypto_alg *alg, struct list_head *list,
if (spawn->alg) if (spawn->alg)
list_move(&spawn->list, &spawn->alg->cra_users); list_move(&spawn->list, &spawn->alg->cra_users);
else else
crypto_remove_spawn(spawn, list); crypto_remove_instance(spawn->inst, list);
} }
} }
EXPORT_SYMBOL_GPL(crypto_remove_spawns); EXPORT_SYMBOL_GPL(crypto_remove_spawns);
...@@ -554,28 +553,20 @@ EXPORT_SYMBOL_GPL(crypto_register_instance); ...@@ -554,28 +553,20 @@ EXPORT_SYMBOL_GPL(crypto_register_instance);
int crypto_unregister_instance(struct crypto_alg *alg) int crypto_unregister_instance(struct crypto_alg *alg)
{ {
int err;
struct crypto_instance *inst = (void *)alg; struct crypto_instance *inst = (void *)alg;
struct crypto_template *tmpl = inst->tmpl; LIST_HEAD(list);
LIST_HEAD(users);
if (!(alg->cra_flags & CRYPTO_ALG_INSTANCE)) if (!(alg->cra_flags & CRYPTO_ALG_INSTANCE))
return -EINVAL; return -EINVAL;
BUG_ON(atomic_read(&alg->cra_refcnt) != 1);
down_write(&crypto_alg_sem); down_write(&crypto_alg_sem);
hlist_del_init(&inst->list); crypto_remove_spawns(alg, &list, NULL);
err = crypto_remove_alg(alg, &users); crypto_remove_instance(inst, &list);
up_write(&crypto_alg_sem); up_write(&crypto_alg_sem);
if (err) crypto_remove_final(&list);
return err;
tmpl->free(inst);
crypto_remove_final(&users);
return 0; return 0;
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment