Ziyang Xuan 69135c572d net/tls: fix tls_sk_proto_close executed repeatedly ... After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When close the sock, tls_sk_proto_close() is called for sock->sk_prot->close is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly occurred. That will trigger the following bug. ================================================================= KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 net/tls/tls_main.c:306 Call Trace: <TASK> tls_sk_proto_close+0x356/0xaf0 net/tls/tls_main.c:329 inet_release+0x12e/0x280 net/ipv4/af_inet.c:428 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x18/0x20 net/socket.c:1365 Updating a proto which is same with sock->sk_prot is incorrect. Add proto and sock->sk_prot equality check at the head of tls_update() to fix it. Fixes: 95fa145479 ("bpf: sockmap/tls, close can race with map free") Reported-by: syzbot+29c3c12f3214b85ad081@syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2022-06-20 10:01:52 +01:00
..
Kconfig	net/tls: Select SOCK_RX_QUEUE_MAPPING from TLS_DEVICE	2021-02-11 19:08:06 -08:00
Makefile	net/tls: add skeleton of MIB statistics	2019-10-05 16:29:00 -07:00
tls_device_fallback.c	net/tls: Fix use-after-free after the TLS device goes down and up	2021-06-01 15:58:05 -07:00
tls_device.c	tls: Add opt-in zerocopy mode of sendfile()	2022-05-19 12:14:11 +02:00
tls_main.c	net/tls: fix tls_sk_proto_close executed repeatedly	2022-06-20 10:01:52 +01:00
tls_proc.c	net: fix proc_fs init handling in af_packet and tls	2020-12-14 19:39:30 -08:00
tls_sw.c	net: tls: fix messing up lists when bpf enabled	2022-05-19 17:55:06 -07:00
tls_toe.c	net/tls: rename tls_hw_* functions tls_toe_*	2019-10-04 14:07:07 -07:00
trace.c	net/tls: add tracing for device/offload events	2019-10-05 16:29:00 -07:00
trace.h	net/tls: add device decrypted trace point	2019-10-05 16:29:00 -07:00