From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756165AbcBIAOI (ORCPT ); Mon, 8 Feb 2016 19:14:08 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:59784 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755762AbcBHXyi (ORCPT ); Mon, 8 Feb 2016 18:54:38 -0500 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Herbert Xu" , "Dmitry Vyukov" Date: Mon, 08 Feb 2016 23:53:51 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.2 60/87] crypto: af_alg - Fix socket double-free when accept fails In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:a11:96ff:fe28:a980 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.2.77-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Herbert Xu commit a383292c86663bbc31ac62cc0c04fc77504636a6 upstream. When we fail an accept(2) call we will end up freeing the socket twice, once due to the direct sk_free call and once again through newsock. This patch fixes this by removing the sk_free call. Reported-by: Dmitry Vyukov Signed-off-by: Herbert Xu Signed-off-by: Ben Hutchings --- crypto/af_alg.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -247,10 +247,8 @@ int af_alg_accept(struct sock *sk, struc security_sk_clone(sk, sk2); err = type->accept(ask->private, sk2); - if (err) { - sk_free(sk2); + if (err) goto unlock; - } sk2->sk_family = PF_ALG;