diff options
| author | Jakub Kicinski <jakub.kicinski@netronome.com> | 2019-08-10 04:36:23 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-08-10 05:55:22 +0300 |
| commit | 57c722e932cfb82e9820bbaae1b1f7222ea97b52 (patch) | |
| tree | 293fcf87b9004d4fc8b4af374cebbe46c65f5bfd | |
| parent | 6d0d779dca73cd5acb649c54f81401f93098b298 (diff) | |
| download | linux-57c722e932cfb82e9820bbaae1b1f7222ea97b52.tar.xz | |
net/tls: swap sk_write_space on close
Now that we swap the original proto and clear the ULP pointer
on close we have to make sure no callback will try to access
the freed state. sk_write_space is not part of sk_prot, remember
to swap it.
Reported-by: syzbot+dcdc9deefaec44785f32@syzkaller.appspotmail.com
Fixes: 95fa145479fb ("bpf: sockmap/tls, close can race with map free")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/tls/tls_main.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index 9cbbae606ced..ce6ef56a65ef 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -308,6 +308,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout) if (free_ctx) icsk->icsk_ulp_data = NULL; sk->sk_prot = ctx->sk_proto; + sk->sk_write_space = ctx->sk_write_space; write_unlock_bh(&sk->sk_callback_lock); release_sock(sk); if (ctx->tx_conf == TLS_SW) |