• Ziyang Xuan's avatar
    net/tls: fix tls_sk_proto_close executed repeatedly · 69135c57
    Ziyang Xuan authored
    After setting the sock ktls, update ctx->sk_proto to sock->sk_prot by
    tls_update(), so now ctx->sk_proto->close is tls_sk_proto_close(). When
    close the sock, tls_sk_proto_close() is called for sock->sk_prot->close
    is tls_sk_proto_close(). But ctx->sk_proto->close() will be executed later
    in tls_sk_proto_close(). Thus tls_sk_proto_close() executed repeatedly
    occurred. That will trigger the following bug.
    
    =================================================================
    KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
    RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 net/tls/tls_main.c:306
    Call Trace:
     <TASK>
     tls_sk_proto_close+0x356/0xaf0 net/tls/tls_main.c:329
     inet_release+0x12e/0x280 net/ipv4/af_inet.c:428
     __sock_release+0xcd/0x280 net/socket.c:650
     sock_close+0x18/0x20 net/socket.c:1365
    
    Updating a proto which is same with sock->sk_prot is incorrect. Add proto
    and sock->sk_prot equality check at the head of tls_update() to fix it.
    
    Fixes: 95fa1454 ("bpf: sockmap/tls, close can race with map free")
    Reported-by: syzbot+29c3c12f3214b85ad081@syzkaller.appspotmail.com
    Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    69135c57
tls_main.c 25.9 KB