Commit 57c722e9 authored Aug 09, 2019 by Jakub Kicinski Committed by David S. Miller Aug 09, 2019

net/tls: swap sk_write_space on close



Now that we swap the original proto and clear the ULP pointer
on close we have to make sure no callback will try to access
the freed state. sk_write_space is not part of sk_prot, remember
to swap it.

Reported-by:  <syzbot+dcdc9deefaec44785f32@syzkaller.appspotmail.com>
Fixes: 95fa1454 ("bpf: sockmap/tls, close can race with map free")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 6d0d779d

net/tls/tls_main.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -308,6 +308,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
		if (free_ctx)
		icsk->icsk_ulp_data = NULL;
		sk->sk_prot = ctx->sk_proto;
		sk->sk_write_space = ctx->sk_write_space;
		write_unlock_bh(&sk->sk_callback_lock);
		release_sock(sk);
		if (ctx->tx_conf == TLS_SW)

Admin message