summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorIlya Lesokhin <ilyal@mellanox.com>2018-01-16 15:31:52 +0200
committerDavid S. Miller <davem@davemloft.net>2018-01-17 16:05:28 -0500
commitd91c3e17f75f218022140dee18cf515292184a8f (patch)
tree16091e4f64022c88fd6d90704d133b945b2d0a5f /net
parentf8b39039cbf2a15f2b8c9f081e1cbd5dee00aaf5 (diff)
downloadlinux-stable-d91c3e17f75f218022140dee18cf515292184a8f.tar.gz
linux-stable-d91c3e17f75f218022140dee18cf515292184a8f.tar.bz2
linux-stable-d91c3e17f75f218022140dee18cf515292184a8f.zip
net/tls: Only attach to sockets in ESTABLISHED state
Calling accept on a TCP socket with a TLS ulp attached results in two sockets that share the same ulp context. The ulp context is freed while a socket is destroyed, so after one of the sockets is released, the second second will trigger a use after free when it tries to access the ulp context attached to it. We restrict the TLS ulp to sockets in ESTABLISHED state to prevent the scenario above. Fixes: 3c4d7559159b ("tls: kernel TLS support") Reported-by: syzbot+904e7cd6c5c741609228@syzkaller.appspotmail.com Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/tls/tls_main.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index e07ee3ae0023..7b7a70e22d90 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -454,6 +454,15 @@ static int tls_init(struct sock *sk)
struct tls_context *ctx;
int rc = 0;
+ /* The TLS ulp is currently supported only for TCP sockets
+ * in ESTABLISHED state.
+ * Supporting sockets in LISTEN state will require us
+ * to modify the accept implementation to clone rather then
+ * share the ulp context.
+ */
+ if (sk->sk_state != TCP_ESTABLISHED)
+ return -ENOTSUPP;
+
/* allocate tls context */
ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
if (!ctx) {