[net 0/2] tipc: revert two patches

[net 0/2] tipc: revert two patches

[Tuong Lien]

We revert two patches:

tipc: Fix potential tipc_node refcnt leak in tipc_rcv
tipc: Fix potential tipc_aead refcnt leak in tipc_crypto_rcv

which prevented TIPC encryption from working properly and caused kernel
panic.

Tuong Lien (2):
  Revert "tipc: Fix potential tipc_node refcnt leak in tipc_rcv"
  Revert "tipc: Fix potential tipc_aead refcnt leak in tipc_crypto_rcv"

 net/tipc/crypto.c | 1 -
 net/tipc/node.c   | 1 -
 2 files changed, 2 deletions(-)

-- 
2.13.7

[net 1/2] Revert "tipc: Fix potential tipc_node refcnt leak in tipc_rcv"

[Tuong Lien]

This reverts commit de058420767df21e2b6b0f3bb36d1616fb962032.

There is no actual tipc_node refcnt leak as stated in the above commit.
The refcnt is hold carefully for the case of an asynchronous decryption
(i.e. -EINPROGRESS/-EBUSY and skb = NULL is returned), so that the node
object cannot be freed in the meantime. The counter will be re-balanced
when the operation's callback arrives with the decrypted buffer if any.
In other cases, e.g. a synchronous crypto the counter will be decreased
immediately when it is done.

Now with that commit, a kernel panic will occur when there is no node
found (i.e. n = NULL) in the 'tipc_rcv()' or a premature release of the
node object.

This commit solves the issues by reverting the said commit, but keeping
one valid case that the 'skb_linearize()' is failed.

Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
---
 net/tipc/node.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 0312fb181d94..a4c2816c3746 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -2038,7 +2038,6 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b)
 		n = tipc_node_find_by_id(net, ehdr->id);
 	}
 	tipc_crypto_rcv(net, (n) ? n->crypto_rx : NULL, &skb, b);
-	tipc_node_put(n);
 	if (!skb)
 		return;
 
-- 
2.13.7

[net 2/2] Revert "tipc: Fix potential tipc_aead refcnt leak in tipc_crypto_rcv"

[Tuong Lien]

This reverts commit 441870ee4240cf67b5d3ab8e16216a9ff42eb5d6.

Like the previous patch in this series, we revert the above commit that
causes similar issues with the 'aead' object.

Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
---
 net/tipc/crypto.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
index 8c47ded2edb6..c8c47fc72653 100644
--- a/net/tipc/crypto.c
+++ b/net/tipc/crypto.c
@@ -1712,7 +1712,6 @@ int tipc_crypto_rcv(struct net *net, struct tipc_crypto *rx,
 	case -EBUSY:
 		this_cpu_inc(stats->stat[STAT_ASYNC]);
 		*skb = NULL;
-		tipc_aead_put(aead);
 		return rc;
 	default:
 		this_cpu_inc(stats->stat[STAT_NOK]);
-- 
2.13.7

Re: [net 1/2] Revert "tipc: Fix potential tipc_node refcnt leak in tipc_rcv"

[hoang.h.le]

On Tue, Jun 02, 2020 at 11:46:40AM +0700, Tuong Lien wrote:
Tested-by: Hoang Le <hoang.h.le@dektech.com.au>

> This reverts commit de058420767df21e2b6b0f3bb36d1616fb962032.
> 
> There is no actual tipc_node refcnt leak as stated in the above commit.
> The refcnt is hold carefully for the case of an asynchronous decryption
> (i.e. -EINPROGRESS/-EBUSY and skb = NULL is returned), so that the node
> object cannot be freed in the meantime. The counter will be re-balanced
> when the operation's callback arrives with the decrypted buffer if any.
> In other cases, e.g. a synchronous crypto the counter will be decreased
> immediately when it is done.
> 
> Now with that commit, a kernel panic will occur when there is no node
> found (i.e. n = NULL) in the 'tipc_rcv()' or a premature release of the
> node object.
> 
> This commit solves the issues by reverting the said commit, but keeping
> one valid case that the 'skb_linearize()' is failed.
> 
> Acked-by: Jon Maloy <jmaloy@redhat.com>
> Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
> ---
>  net/tipc/node.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/net/tipc/node.c b/net/tipc/node.c
> index 0312fb181d94..a4c2816c3746 100644
> --- a/net/tipc/node.c
> +++ b/net/tipc/node.c
> @@ -2038,7 +2038,6 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b)
>  		n = tipc_node_find_by_id(net, ehdr->id);
>  	}
>  	tipc_crypto_rcv(net, (n) ? n->crypto_rx : NULL, &skb, b);
> -	tipc_node_put(n);
>  	if (!skb)
>  		return;
>  

Re: [net 0/2] tipc: revert two patches

[David Miller]

From: Tuong Lien <tuong.t.lien@dektech.com.au>
Date: Tue,  2 Jun 2020 11:46:39 +0700

> We revert two patches:
> 
> tipc: Fix potential tipc_node refcnt leak in tipc_rcv
> tipc: Fix potential tipc_aead refcnt leak in tipc_crypto_rcv
> 
> which prevented TIPC encryption from working properly and caused kernel
> panic.

Series applied.