[lkml]   [2022]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 5.10 23/65] net/tls: Remove the context from the list in tls_device_down
    From: Maxim Mikityanskiy <>

    commit f6336724a4d4220c89a4ec38bca84b03b178b1a3 upstream.

    tls_device_down takes a reference on all contexts it's going to move to
    the degraded state (software fallback). If sk_destruct runs afterwards,
    it can reduce the reference counter back to 1 and return early without
    destroying the context. Then tls_device_down will release the reference
    it took and call tls_device_free_ctx. However, the context will still
    stay in tls_device_down_list forever. The list will contain an item,
    memory for which is released, making a memory corruption possible.

    Fix the above bug by properly removing the context from all lists before
    any call to tls_device_free_ctx.

    Fixes: 3740651bf7e2 ("tls: Fix context leak on tls_device_down")
    Signed-off-by: Maxim Mikityanskiy <>
    Reviewed-by: Tariq Toukan <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
    net/tls/tls_device.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    --- a/net/tls/tls_device.c
    +++ b/net/tls/tls_device.c
    @@ -1349,8 +1349,13 @@ static int tls_device_down(struct net_de
    * by tls_device_free_ctx. rx_conf and tx_conf stay in TLS_HW.
    * Now release the ref taken above.
    - if (refcount_dec_and_test(&ctx->refcount))
    + if (refcount_dec_and_test(&ctx->refcount)) {
    + /* sk_destruct ran after tls_device_down took a ref, and
    + * it returned early. Complete the destruction here.
    + */
    + list_del(&ctx->list);
    + }


     \ /
      Last update: 2022-08-01 13:54    [W:2.891 / U:0.396 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site