net/tls: don't leak IV and record seq when offload fails (12c76861) · Commits · 戴 / test

When device refuses the offload in tls_set_device_offload_rx() it calls tls_sw_free_resources_rx() to clean up software context state. Unfortunately, tls_sw_free_resources_rx() does not free all the state tls_set_sw_offload() allocated - it leaks IV and sequence number buffers. All other code paths which lead to tls_sw_release_resources_rx() (which tls_sw_free_resources_rx() calls) free those right before the call. Avoid the leak by moving freeing of iv and rec_seq into tls_sw_release_resources_rx(). Fixes: ("tls: Add rx inline crypto offload") Signed-off-by:

Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by:

Dirk van der Merwe <dirk.vandermerwe@netronome.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/tls/tls_device.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -941,8 +941,6 @@ void tls_device_offload_cleanup_rx(struct sock *sk)
		}
		out:
		up_read(&device_offload_lock);
		kfree(tls_ctx->rx.rec_seq);
		kfree(tls_ctx->rx.iv);
		tls_sw_release_resources_rx(sk);
		}

net/tls/tls_main.c

+1 −4

Original line number	Diff line number	Diff line
		@@ -293,11 +293,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
		#endif
		}

		if (ctx->rx_conf == TLS_SW) {
		kfree(ctx->rx.rec_seq);
		kfree(ctx->rx.iv);
		if (ctx->rx_conf == TLS_SW)
		tls_sw_free_resources_rx(sk);
		}

		#ifdef CONFIG_TLS_DEVICE
		if (ctx->rx_conf == TLS_HW)

net/tls/tls_sw.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -2078,6 +2078,9 @@ void tls_sw_release_resources_rx(struct sock *sk)
		struct tls_context *tls_ctx = tls_get_ctx(sk);
		struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);

		kfree(tls_ctx->rx.rec_seq);
		kfree(tls_ctx->rx.iv);

		if (ctx->aead_recv) {
		kfree_skb(ctx->recv_pkt);
		ctx->recv_pkt = NULL;

Admin message