]> git.baikalelectronics.ru Git - kernel.git/commit
net/tls: Remove the context from the list in tls_device_down
authorMaxim Mikityanskiy <maximmi@nvidia.com>
Thu, 21 Jul 2022 09:11:27 +0000 (12:11 +0300)
committerDavid S. Miller <davem@davemloft.net>
Sun, 24 Jul 2022 20:40:56 +0000 (21:40 +0100)
commitb516be679337a105efd45cf987de2faca377743b
tree3582a1d195afd0bc4728011d04bba50d579ed75b
parent50b6b74acb305c445e0798100fd3a75ca6367b7b
net/tls: Remove the context from the list in tls_device_down

tls_device_down takes a reference on all contexts it's going to move to
the degraded state (software fallback). If sk_destruct runs afterwards,
it can reduce the reference counter back to 1 and return early without
destroying the context. Then tls_device_down will release the reference
it took and call tls_device_free_ctx. However, the context will still
stay in tls_device_down_list forever. The list will contain an item,
memory for which is released, making a memory corruption possible.

Fix the above bug by properly removing the context from all lists before
any call to tls_device_free_ctx.

Fixes: bf5c2d483b13 ("tls: Fix context leak on tls_device_down")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tls/tls_device.c