af_key: Fix send_acquire race with pfkey_register
authorHerbert Xu <herbert@gondor.apana.org.au>
Tue, 25 Oct 2022 06:06:48 +0000 (14:06 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 2 Dec 2022 16:39:58 +0000 (17:39 +0100)
commitb7000254c12537ea63d9304ac8b2f5379fdc258e
tree02f45da182f4b2a662e9395c4c71680203db3446
parent51969d679ba4567e10f6c15061d1dad1063406e7
af_key: Fix send_acquire race with pfkey_register

[ Upstream commit 7f57f8165cb6d2c206e2b9ada53b9e2d6d8af42f ]

The function pfkey_send_acquire may race with pfkey_register
(which could even be in a different name space).  This may result
in a buffer overrun.

Allocating the maximum amount of memory that could be used prevents
this.

Reported-by: syzbot+1e9af9185d8850e2c2fa@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/key/af_key.c