• Dirk van der Merwe's avatar
    net/tls: fix page double free on TX cleanup · 9354544c
    Dirk van der Merwe authored
    With commit 94850257 ("tls: Fix tls_device handling of partial records")
    a new path was introduced to cleanup partial records during sk_proto_close.
    This path does not handle the SW KTLS tx_list cleanup.
    
    This is unnecessary though since the free_resources calls for both
    SW and offload paths will cleanup a partial record.
    
    The visible effect is the following warning, but this bug also causes
    a page double free.
    
        WARNING: CPU: 7 PID: 4000 at net/core/stream.c:206 sk_stream_kill_queues+0x103/0x110
        RIP: 0010:sk_stream_kill_queues+0x103/0x110
        RSP: 0018:ffffb6df87e07bd0 EFLAGS: 00010206
        RAX: 0000000000000000 RBX: ffff8c21db4971c0 RCX: 0000000000000007
        RDX: ffffffffffffffa0 RSI: 000000000000001d RDI: ffff8c21db497270
        RBP: ffff8c21db497270 R08: ffff8c29f4748600 R09: 000000010020001a
        R10: ffffb6df87e07aa0 R11: ffffffff9a445600 R12: 0000000000000007
        R13: 0000000000000000 R14: ffff8c21f03f2900 R15: ffff8c21f03b8df0
        Call Trace:
         inet_csk_destroy_sock+0x55/0x100
         tcp_close+0x25d/0x400
         ? tcp_check_oom+0x120/0x120
         tls_sk_proto_close+0x127/0x1c0
         inet_release+0x3c/0x60
         __sock_release+0x3d/0xb0
         sock_close+0x11/0x20
         __fput+0xd8/0x210
         task_work_run+0x84/0xa0
         do_exit+0x2dc/0xb90
         ? release_sock+0x43/0x90
         do_group_exit+0x3a/0xa0
         get_signal+0x295/0x720
         do_signal+0x36/0x610
         ? SYSC_recvfrom+0x11d/0x130
         exit_to_usermode_loop+0x69/0xb0
         do_syscall_64+0x173/0x180
         entry_SYSCALL_64_after_hwframe+0x3d/0xa2
        RIP: 0033:0x7fe9b9abc10d
        RSP: 002b:00007fe9b19a1d48 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
        RAX: fffffffffffffe00 RBX: 0000000000000006 RCX: 00007fe9b9abc10d
        RDX: 0000000000000002 RSI: 0000000000000080 RDI: 00007fe948003430
        RBP: 00007fe948003410 R08: 00007fe948003430 R09: 0000000000000000
        R10: 0000000000000000 R11: 0000000000000246 R12: 00005603739d9080
        R13: 00007fe9b9ab9f90 R14: 00007fe948003430 R15: 0000000000000000
    
    Fixes: 94850257 ("tls: Fix tls_device handling of partial records")
    Signed-off-by: default avatarDirk van der Merwe <dirk.vandermerwe@netronome.com>
    Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    9354544c
tls_main.c 19.5 KB