diff options
| author | Maxim Mikityanskiy <maximmi@nvidia.com> | 2022-07-21 12:11:27 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-08-03 12:03:47 +0200 |
| commit | ad6d6ae4a34c0957355886e0754c7b8cf7c47f56 (patch) | |
| tree | b9175d3bcf9f526aeb2f999320b18b0fb281861b | |
| parent | 189e370b8250d9c07091f9cf58b6618945c1ec71 (diff) | |
| download | linux-stable-ad6d6ae4a34c0957355886e0754c7b8cf7c47f56.tar.gz linux-stable-ad6d6ae4a34c0957355886e0754c7b8cf7c47f56.tar.bz2 linux-stable-ad6d6ae4a34c0957355886e0754c7b8cf7c47f56.zip | |
net/tls: Remove the context from the list in tls_device_down
commit f6336724a4d4220c89a4ec38bca84b03b178b1a3 upstream.
tls_device_down takes a reference on all contexts it's going to move to
the degraded state (software fallback). If sk_destruct runs afterwards,
it can reduce the reference counter back to 1 and return early without
destroying the context. Then tls_device_down will release the reference
it took and call tls_device_free_ctx. However, the context will still
stay in tls_device_down_list forever. The list will contain an item,
memory for which is released, making a memory corruption possible.
Fix the above bug by properly removing the context from all lists before
any call to tls_device_free_ctx.
Fixes: 3740651bf7e2 ("tls: Fix context leak on tls_device_down")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/tls/tls_device.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c index 4e33150cfb9e..cf75969375cf 100644 --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -1351,8 +1351,13 @@ static int tls_device_down(struct net_device *netdev) * by tls_device_free_ctx. rx_conf and tx_conf stay in TLS_HW. * Now release the ref taken above. */ - if (refcount_dec_and_test(&ctx->refcount)) + if (refcount_dec_and_test(&ctx->refcount)) { + /* sk_destruct ran after tls_device_down took a ref, and + * it returned early. Complete the destruction here. + */ + list_del(&ctx->list); tls_device_free_ctx(ctx); + } } up_write(&device_offload_lock); |