* [PATCH net] net/tls: swap sk_write_space on close
@ 2019-08-10 1:36 Jakub Kicinski
2019-08-10 2:56 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Jakub Kicinski @ 2019-08-10 1:36 UTC (permalink / raw)
To: davem
Cc: netdev, willemb, davejwatson, borisp, aviadye, john.fastabend,
daniel, oss-drivers, Jakub Kicinski, syzbot+dcdc9deefaec44785f32
Now that we swap the original proto and clear the ULP pointer
on close we have to make sure no callback will try to access
the freed state. sk_write_space is not part of sk_prot, remember
to swap it.
Reported-by: syzbot+dcdc9deefaec44785f32@syzkaller.appspotmail.com
Fixes: 95fa145479fb ("bpf: sockmap/tls, close can race with map free")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
net/tls/tls_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 9cbbae606ced..ce6ef56a65ef 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -308,6 +308,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
if (free_ctx)
icsk->icsk_ulp_data = NULL;
sk->sk_prot = ctx->sk_proto;
+ sk->sk_write_space = ctx->sk_write_space;
write_unlock_bh(&sk->sk_callback_lock);
release_sock(sk);
if (ctx->tx_conf == TLS_SW)
--
2.21.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] net/tls: swap sk_write_space on close
2019-08-10 1:36 [PATCH net] net/tls: swap sk_write_space on close Jakub Kicinski
@ 2019-08-10 2:56 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-08-10 2:56 UTC (permalink / raw)
To: jakub.kicinski
Cc: netdev, willemb, davejwatson, borisp, aviadye, john.fastabend,
daniel, oss-drivers, syzbot+dcdc9deefaec44785f32
From: Jakub Kicinski <jakub.kicinski@netronome.com>
Date: Fri, 9 Aug 2019 18:36:23 -0700
> Now that we swap the original proto and clear the ULP pointer
> on close we have to make sure no callback will try to access
> the freed state. sk_write_space is not part of sk_prot, remember
> to swap it.
>
> Reported-by: syzbot+dcdc9deefaec44785f32@syzkaller.appspotmail.com
> Fixes: 95fa145479fb ("bpf: sockmap/tls, close can race with map free")
> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Applied, thanks Jakub.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-08-10 2:56 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-08-10 1:36 [PATCH net] net/tls: swap sk_write_space on close Jakub Kicinski
2019-08-10 2:56 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).