crypto: af_alg - remove locking in async callback

The code paths protected by the socket-lock do not use or modify the
socket in a non-atomic fashion. The actions pertaining the socket do not
even need to be handled as an atomic operation. Thus, the socket-lock
can be safely ignored.

This fixes a bug regarding scheduling in atomic as the callback function
may be invoked in interrupt context.

In addition, the sock_hold is moved before the AIO encrypt/decrypt
operation to ensure that the socket is always present. This avoids a
tiny race window where the socket is unprotected and yet used by the AIO
operation.

Finally, the release of resources for a crypto operation is moved into a
common function of af_alg_free_resources.

Cc: <stable@vger.kernel.org>
Fixes: e870456d8e7c8 ("crypto: algif_skcipher - overhaul memory management")
Fixes: d887c52d6ae43 ("crypto: algif_aead - overhaul memory management")
Reported-by: Romain Izard <romain.izard.pro@gmail.com>
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Tested-by: Romain Izard <romain.izard.pro@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

1 files changed, 12 insertions, 11 deletions

diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index e2068b78993c..805f485ddf1b 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -283,12 +283,23 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
 
         if (msg->msg_iocb && !is_sync_kiocb(msg->msg_iocb)) {
                 /* AIO operation */
+                sock_hold(sk);
                 areq->iocb = msg->msg_iocb;
                 aead_request_set_callback(&areq->cra_u.aead_req,
                                           CRYPTO_TFM_REQ_MAY_BACKLOG,
                                           af_alg_async_cb, areq);
                 err = ctx->enc ? crypto_aead_encrypt(&areq->cra_u.aead_req) :
                                  crypto_aead_decrypt(&areq->cra_u.aead_req);
+
+                /* AIO operation in progress */
+                if (err == -EINPROGRESS || err == -EBUSY) {
+                        /* Remember output size that will be generated. */
+                        areq->outlen = outlen;
+
+                        return -EIOCBQUEUED;
+                }
+
+                sock_put(sk);
         } else {
                 /* Synchronous operation */
                 aead_request_set_callback(&areq->cra_u.aead_req,
@@ -300,19 +311,9 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
                                 &ctx->wait);
         }
 
-        /* AIO operation in progress */
-        if (err == -EINPROGRESS) {
-                sock_hold(sk);
-
-                /* Remember output size that will be generated. */
-                areq->outlen = outlen;
-
-                return -EIOCBQUEUED;
-        }
 
 free:
-        af_alg_free_areq_sgls(areq);
-        sock_kfree_s(sk, areq, areq->areqlen);
+        af_alg_free_resources(areq);
 
         return err ? err : outlen;
 }