Commit 57c722e9 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by David S. Miller

net/tls: swap sk_write_space on close

Now that we swap the original proto and clear the ULP pointer
on close we have to make sure no callback will try to access
the freed state. sk_write_space is not part of sk_prot, remember
to swap it.

Reported-by: syzbot+dcdc9deefaec44785f32@syzkaller.appspotmail.com
Fixes: 95fa1454 ("bpf: sockmap/tls, close can race with map free")
Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6d0d779d
...@@ -308,6 +308,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout) ...@@ -308,6 +308,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
if (free_ctx) if (free_ctx)
icsk->icsk_ulp_data = NULL; icsk->icsk_ulp_data = NULL;
sk->sk_prot = ctx->sk_proto; sk->sk_prot = ctx->sk_proto;
sk->sk_write_space = ctx->sk_write_space;
write_unlock_bh(&sk->sk_callback_lock); write_unlock_bh(&sk->sk_callback_lock);
release_sock(sk); release_sock(sk);
if (ctx->tx_conf == TLS_SW) if (ctx->tx_conf == TLS_SW)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment