forked from Minki/linux
f6336724a4
tls_device_down takes a reference on all contexts it's going to move to
the degraded state (software fallback). If sk_destruct runs afterwards,
it can reduce the reference counter back to 1 and return early without
destroying the context. Then tls_device_down will release the reference
it took and call tls_device_free_ctx. However, the context will still
stay in tls_device_down_list forever. The list will contain an item,
memory for which is released, making a memory corruption possible.
Fix the above bug by properly removing the context from all lists before
any call to tls_device_free_ctx.
Fixes:
|
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
tls_device_fallback.c | ||
tls_device.c | ||
tls_main.c | ||
tls_proc.c | ||
tls_sw.c | ||
tls_toe.c | ||
trace.c | ||
trace.h |