github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 05:55:44 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net/tls: Remove the context from the list in tls_device_down

Browse Source 
commit f6336724a4 upstream.

tls_device_down takes a reference on all contexts it's going to move to
the degraded state (software fallback). If sk_destruct runs afterwards,
it can reduce the reference counter back to 1 and return early without
destroying the context. Then tls_device_down will release the reference
it took and call tls_device_free_ctx. However, the context will still
stay in tls_device_down_list forever. The list will contain an item,
memory for which is released, making a memory corruption possible.

Fix the above bug by properly removing the context from all lists before
any call to tls_device_free_ctx.

Fixes: 3740651bf7 ("tls: Fix context leak on tls_device_down")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Maxim Mikityanskiy 2022-07-21 12:11:27 +03:00 committed by Greg Kroah-Hartman
parent 8008e797ec
commit 4c1318dabe
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/tls/tls_device.c
View File

@ -1349,9 +1349,14 @@ static int tls_device_down(struct net_device *netdev)
* by tls_device_free_ctx. rx_conf and tx_conf stay in TLS_HW. * by tls_device_free_ctx. rx_conf and tx_conf stay in TLS_HW.
* Now release the ref taken above. * Now release the ref taken above.
*/ */
if (refcount_dec_and_test(&ctx->refcount)) if (refcount_dec_and_test(&ctx->refcount)) {
/* sk_destruct ran after tls_device_down took a ref, and
* it returned early. Complete the destruction here.
*/
list_del(&ctx->list);
tls_device_free_ctx(ctx); tls_device_free_ctx(ctx);
} }
}
up_write(&device_offload_lock); up_write(&device_offload_lock);