[Devel] [PATCH RHEL7 COMMIT] ms/crypto: af_alg - Fix socket double-free when accept fails

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-327.36.1.vz7.19.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.36.1.vz7.19.3
------>
commit f9ec8e06b854742b66d69768ad3cafff2829b256
Author: Herbert Xu <herbert at gondor.apana.org.au>
Date:   Mon Oct 24 16:34:02 2016 +0400

    ms/crypto: af_alg - Fix socket double-free when accept fails
    
    When we fail an accept(2) call we will end up freeing the socket
    twice, once due to the direct sk_free call and once again through
    newsock.
    
    This patch fixes this by removing the sk_free call.
    
    Cc: stable at vger.kernel.org
    Reported-by: Dmitry Vyukov <dvyukov at google.com>
    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
    (cherry picked from commit a383292c86663bbc31ac62cc0c04fc77504636a6)
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 crypto/af_alg.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 4311214..5a2902e 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -275,10 +275,8 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
 	security_sk_clone(sk, sk2);
 
 	err = type->accept(ask->private, sk2);
-	if (err) {
-		sk_free(sk2);
+	if (err)
 		goto unlock;
-	}
 
 	sk2->sk_family = PF_ALG;