Re: [PATCH 4.19 13/36] crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()

On Tue, Jul 07, 2020 at 11:25:31PM +0200, Pavel Machek wrote:

...

@@ -308,12 +302,14 @@ int af_alg_accept(struct sock *sk, struc sk2->sk_family = PF_ALG;

• if (nokey || !ask->refcnt++)

• if (atomic_inc_return_relaxed(&ask->refcnt) == 1) sock_hold(sk);

• ask->nokey_refcnt += nokey;

• if (nokey) {

• atomic_inc(&ask->nokey_refcnt);
  

• atomic_set(&alg_sk(sk2)->nokey_refcnt, 1);
  

• }

Should we set the nokey_refcnt to 0 using atomic_set, too? Aternatively, should the nokey_refcnt be initialized using ATOMIC_INIT()?

What are you asking for? It's already being set with atomic_set. Or are you asking it to be set to 0 instead of 1? No it needs to be 1 for the socket destructor.

Cheers,