• Maxim Mikityanskiy's avatar
    tls: Fix context leak on tls_device_down · 3740651b
    Maxim Mikityanskiy authored
    The commit cited below claims to fix a use-after-free condition after
    tls_device_down. Apparently, the description wasn't fully accurate. The
    context stayed alive, but ctx->netdev became NULL, and the offload was
    torn down without a proper fallback, so a bug was present, but a
    different kind of bug.
    
    Due to misunderstanding of the issue, the original patch dropped the
    refcount_dec_and_test line for the context to avoid the alleged
    premature deallocation. That line has to be restored, because it matches
    the refcount_inc_not_zero from the same function, otherwise the contexts
    that survived tls_device_down are leaked.
    
    This patch fixes the described issue by restoring refcount_dec_and_test.
    After this change, there is no leak anymore, and the fallback to
    software kTLS still works.
    
    Fixes: c55dcdd4 ("net/tls: Fix use-after-free after the TLS device goes down and up")
    Signed-off-by: default avatarMaxim Mikityanskiy <maximmi@nvidia.com>
    Reviewed-by: default avatarTariq Toukan <tariqt@nvidia.com>
    Link: https://lore.kernel.org/r/20220512091830.678684-1-maximmi@nvidia.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    3740651b
tls_device.c 36 KB