* [PATCH net] net/tls: fix tls_sk_proto_close executed repeatedly
@ 2022-06-20 4:35 Ziyang Xuan
2022-06-20 9:20 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 3+ messages in thread
From: Ziyang Xuan @ 2022-06-20 4:35 UTC (permalink / raw)
To: borisp, john.fastabend, daniel, kuba, davem, edumazet, pabeni, netdev
Cc: linux-kernel
After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by
tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When
close the sock, tls_sk_proto_close() is called for sock->sk_prot->close
is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later
in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly
occurred. That will trigger the following bug.
=================================================================
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 net/tls/tls_main.c:306
Call Trace:
<TASK>
tls_sk_proto_close+0x356/0xaf0 net/tls/tls_main.c:329
inet_release+0x12e/0x280 net/ipv4/af_inet.c:428
__sock_release+0xcd/0x280 net/socket.c:650
sock_close+0x18/0x20 net/socket.c:1365
Updating a proto which is same with sock->sk_prot is incorrect. Add proto
and sock->sk_prot equality check at the head of tls_update() to fix it.
Fixes: 95fa145479fb ("bpf: sockmap/tls, close can race with map free")
Reported-by: syzbot+29c3c12f3214b85ad081@syzkaller.appspotmail.com
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
---
net/tls/tls_main.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index da176411c1b5..46bd5f26338b 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -921,6 +921,9 @@ static void tls_update(struct sock *sk, struct proto *p,
{
struct tls_context *ctx;
+ if (sk->sk_prot == p)
+ return;
+
ctx = tls_get_ctx(sk);
if (likely(ctx)) {
ctx->sk_write_space = write_space;
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] net/tls: fix tls_sk_proto_close executed repeatedly
2022-06-20 4:35 [PATCH net] net/tls: fix tls_sk_proto_close executed repeatedly Ziyang Xuan
@ 2022-06-20 9:20 ` patchwork-bot+netdevbpf
2022-06-20 18:18 ` Jakub Kicinski
0 siblings, 1 reply; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-06-20 9:20 UTC (permalink / raw)
To: Ziyang Xuan
Cc: borisp, john.fastabend, daniel, kuba, davem, edumazet, pabeni,
netdev, linux-kernel
Hello:
This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:
On Mon, 20 Jun 2022 12:35:08 +0800 you wrote:
> After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by
> tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When
> close the sock, tls_sk_proto_close() is called for sock->sk_prot->close
> is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later
> in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly
> occurred. That will trigger the following bug.
>
> [...]
Here is the summary with links:
- [net] net/tls: fix tls_sk_proto_close executed repeatedly
https://git.kernel.org/netdev/net/c/69135c572d1f
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] net/tls: fix tls_sk_proto_close executed repeatedly
2022-06-20 9:20 ` patchwork-bot+netdevbpf
@ 2022-06-20 18:18 ` Jakub Kicinski
0 siblings, 0 replies; 3+ messages in thread
From: Jakub Kicinski @ 2022-06-20 18:18 UTC (permalink / raw)
To: patchwork-bot+netdevbpf
Cc: Ziyang Xuan, borisp, john.fastabend, daniel, davem, edumazet,
pabeni, netdev, linux-kernel
On Mon, 20 Jun 2022 09:20:12 +0000 patchwork-bot+netdevbpf@kernel.org
wrote:
> On Mon, 20 Jun 2022 12:35:08 +0800 you wrote:
> > After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by
> > tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When
> > close the sock, tls_sk_proto_close() is called for sock->sk_prot->close
> > is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later
> > in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly
> > occurred. That will trigger the following bug.
> >
> > [...]
>
> Here is the summary with links:
> - [net] net/tls: fix tls_sk_proto_close executed repeatedly
> https://git.kernel.org/netdev/net/c/69135c572d1f
No, this is not the right fix. The AF_UNIX restructuring has moved the
ULP check too late. I'll send a revert and the correct fix.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-06-20 18:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-20 4:35 [PATCH net] net/tls: fix tls_sk_proto_close executed repeatedly Ziyang Xuan
2022-06-20 9:20 ` patchwork-bot+netdevbpf
2022-06-20 18:18 ` Jakub Kicinski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.