diff options
| author | Ziyang Xuan <william.xuanziyang@huawei.com> | 2022-06-20 12:35:08 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-29 09:03:24 +0200 |
| commit | be64f54a0db2dbf399f3bca45458d06c833641f0 (patch) | |
| tree | 61681cf13d0192117456c19abbf0e53a004b2442 /net | |
| parent | a3b2470399f679587c45abe56e551caf10becca2 (diff) | |
| download | linux-be64f54a0db2dbf399f3bca45458d06c833641f0.tar.gz linux-be64f54a0db2dbf399f3bca45458d06c833641f0.tar.bz2 linux-be64f54a0db2dbf399f3bca45458d06c833641f0.zip | |
net/tls: fix tls_sk_proto_close executed repeatedly
[ Upstream commit 69135c572d1f84261a6de2a1268513a7e71753e2 ]
After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by
tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When
close the sock, tls_sk_proto_close() is called for sock->sk_prot->close
is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later
in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly
occurred. That will trigger the following bug.
=================================================================
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 net/tls/tls_main.c:306
Call Trace:
<TASK>
tls_sk_proto_close+0x356/0xaf0 net/tls/tls_main.c:329
inet_release+0x12e/0x280 net/ipv4/af_inet.c:428
__sock_release+0xcd/0x280 net/socket.c:650
sock_close+0x18/0x20 net/socket.c:1365
Updating a proto which is same with sock->sk_prot is incorrect. Add proto
and sock->sk_prot equality check at the head of tls_update() to fix it.
Fixes: 95fa145479fb ("bpf: sockmap/tls, close can race with map free")
Reported-by: syzbot+29c3c12f3214b85ad081@syzkaller.appspotmail.com
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/tls/tls_main.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index 9aac9c60d786..057c1af6182a 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -790,6 +790,9 @@ static void tls_update(struct sock *sk, struct proto *p, { struct tls_context *ctx; + if (sk->sk_prot == p) + return; + ctx = tls_get_ctx(sk); if (likely(ctx)) { ctx->sk_write_space = write_space; |