[5.17,046/114] tls: Fix context leak on tls_device_down

Message ID	20220516193626.815898749@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Maxim Mikityanskiy <maximmi@nvidia.com>, Tariq Toukan <tariqt@nvidia.com>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.17 046/114] tls: Fix context leak on tls_device_down Date: Mon, 16 May 2022 21:36:20 +0200 Message-Id: <20220516193626.815898749@linuxfoundation.org> In-Reply-To: <20220516193625.489108457@linuxfoundation.org> References: <20220516193625.489108457@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,002/114] iwlwifi: iwl-dbg: Use del_timer_sync() before freeing [5.17,003/114] hwmon: (tmp401) Add OF device ID table [5.17,004/114] mac80211: Reset MBSSID parameters upon connection [5.17,005/114] net: rds: use maybe_get_net() when acquiring refcount on TCP sockets [5.17,006/114] net: Fix features skip in for_each_netdev_feature() [5.17,007/114] net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted [5.17,008/114] net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups [5.17,009/114] net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0 [5.17,010/114] net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters [5.17,011/114] fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,012/114] fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,013/114] fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,014/114] platform/surface: aggregator: Fix initialization order when compiling as builtin m... [5.17,015/114] ice: Fix race during aux device (un)plugging [5.17,016/114] ice: clear stale Tx queue settings before configuring [5.17,017/114] ice: fix PTP stale Tx timestamps cleanup [5.17,018/114] ipv4: drop dst in multicast routing path [5.17,019/114] drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name() [5.17,020/114] netlink: do not reset transport header in netlink_recvmsg() [5.17,021/114] net: chelsio: cxgb4: Avoid potential negative array offset [5.17,022/114] fbdev: efifb: Fix a use-after-free due early fb_info cleanup [5.17,023/114] net: sfc: fix memory leak due to ptp channel [5.17,024/114] fanotify: do not allow setting dirent events in mask of non-dir [5.17,025/114] mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection [5.17,026/114] nfs: fix broken handling of the softreval mount option [5.17,027/114] ionic: fix missing pci_release_regions() on error in ionic_probe() [5.17,028/114] dim: initialize all struct fields [5.17,029/114] hwmon: (ltq-cputemp) restrict it to SOC_XWAY [5.17,030/114] procfs: prevent unprivileged processes accessing fdinfo dir [5.17,031/114] selftests: vm: Makefile: rename TARGETS to VMTARGETS [5.17,032/114] net: dsa: flush switchdev workqueue on bridge join error path [5.17,033/114] arm64: vdso: fix makefile dependency on vdso.so [5.17,034/114] virtio: fix virtio transitional ids [5.17,035/114] s390/ctcm: fix variable dereferenced before check [5.17,036/114] s390/ctcm: fix potential memory leak [5.17,037/114] s390/lcs: fix variable dereferenced before check [5.17,038/114] net/sched: act_pedit: really ensure the skb is writable [5.17,039/114] net: ethernet: mediatek: ppe: fix wrong size passed to memset() [5.17,040/114] net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral [5.17,041/114] drm/vc4: hdmi: Fix build error for implicit function declaration [5.17,042/114] mlxsw: Avoid warning during ip6gre device removal [5.17,043/114] net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down() [5.17,044/114] net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending [5.17,045/114] net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() [5.17,046/114] tls: Fix context leak on tls_device_down [5.17,047/114] drm/vmwgfx: Fix fencing on SVGAv3 [5.17,048/114] gfs2: Fix filesystem block deallocation for short writes [5.17,049/114] hwmon: (asus_wmi_sensors) Fix CROSSHAIR VI HERO name [5.17,050/114] hwmon: (f71882fg) Fix negative temperature [5.17,051/114] RDMA/irdma: Fix deadlock in irdma_cleanup_cm_core() [5.17,052/114] iommu: arm-smmu: disable large page mappings for Nvidia arm-smmu [5.17,053/114] ASoC: max98090: Reject invalid values in custom control put() [5.17,054/114] ASoC: max98090: Generate notifications on changes for custom control [5.17,055/114] ASoC: ops: Validate input values in snd_soc_put_volsw_range() [5.17,056/114] s390: disable -Warray-bounds [5.17,057/114] ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback [5.17,058/114] io_uring: assign non-fixed early for async work [5.17,059/114] net: emaclite: Dont advertise 1000BASE-T and do auto negotiation [5.17,060/114] net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT [5.17,061/114] secure_seq: use the 64 bits of the siphash for port offset calculation [5.17,062/114] tcp: use different parts of the port_offset for index and offset [5.17,063/114] tcp: resalt the secret every 10 seconds [5.17,064/114] tcp: add small random increments to the source port [5.17,065/114] tcp: dynamically allocate the perturb table used by source ports [5.17,066/114] tcp: increase source port perturb table to 2^16 [5.17,067/114] tcp: drop the hash_32() part from the index calculation [5.17,068/114] block: Do not call folio_next() on an unreferenced folio [5.17,069/114] interconnect: Restore sync state by ignoring ipa-virt in provider count [5.17,070/114] perf tests: Fix coresight `perf test` failure. [5.17,071/114] firmware_loader: use kernel credentials when reading firmware [5.17,072/114] KVM: PPC: Book3S PR: Enable MSR_DR for switch_mmu_context() [5.17,073/114] usb: xhci-mtk: fix fs isocs transfer error [5.17,074/114] x86/mm: Fix marking of unused sub-pmd ranges [5.17,075/114] tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe() [5.17,076/114] tty: n_gsm: fix buffer over-read in gsm_dlci_data() [5.17,077/114] tty: n_gsm: fix mux activation issues in gsm_config() [5.17,078/114] tty: n_gsm: fix invalid gsmtty_write_room() result [5.17,079/114] usb: gadget: uvc: allow for application to cleanly shutdown [5.17,080/114] usb: cdc-wdm: fix reading stuck on device close [5.17,081/114] usb: typec: tcpci: Dont skip cleanup in .remove() on error [5.17,082/114] usb: typec: tcpci_mt6360: Update for BMC PHY setting [5.17,083/114] USB: serial: pl2303: add device id for HP LM930 Display [5.17,084/114] USB: serial: qcserial: add support for Sierra Wireless EM7590 [5.17,085/114] USB: serial: option: add Fibocom L610 modem [5.17,086/114] USB: serial: option: add Fibocom MA510 modem [5.17,087/114] slimbus: qcom: Fix IRQ check in qcom_slim_probe [5.17,088/114] fsl_lpuart: Dont enable interrupts too early [5.17,089/114] genirq: Remove WARN_ON_ONCE() in generic_handle_domain_irq() [5.17,090/114] serial: 8250_mtk: Fix UART_EFR register address [5.17,091/114] serial: 8250_mtk: Fix register address for XON/XOFF character [5.17,092/114] ceph: fix setting of xattrs on async created inodes [5.17,093/114] Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()" [5.17,094/114] mm/huge_memory: do not overkill when splitting huge_zero_page [5.17,095/114] mm: mremap: fix sign for EFAULT error return value [5.17,096/114] drm/vmwgfx: Disable command buffers on svga3 without gbobjects [5.17,097/114] drm/nouveau/tegra: Stop using iommu_present() [5.17,098/114] i40e: i40e_main: fix a missing check on list iterator [5.17,099/114] net: atlantic: always deep reset on pm op, fixing up my null deref regression [5.17,100/114] net: phy: Fix race condition on link status change [5.17,101/114] writeback: Avoid skipping inode writeback [5.17,102/114] cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() [5.17,103/114] ping: fix address binding wrt vrf [5.17,104/114] ath11k: reduce the wait time of 11d scan and hw scan while add interface [5.17,105/114] arm[64]/memremap: dont abuse pfn_valid() to ensure presence of linear map [5.17,106/114] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061 [5.17,107/114] net: phy: micrel: Pass .probe for KS8737 [5.17,108/114] SUNRPC: Ensure that the gssproxy client can start in a connected state [5.17,109/114] drm/vmwgfx: Initialize drm_mode_fb_cmd2 [5.17,110/114] Revert "drm/amd/pm: keep the BACO feature enabled for suspend" [5.17,111/114] dma-buf: call dma_buf_stats_setup after dmabuf is in valid list [5.17,112/114] mm/hwpoison: use pr_err() instead of dump_page() in get_any_page() [5.17,113/114] net: phy: micrel: Fix incorrect variable type in micrel [5.17,114/114] mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool

Message ID

20220516193626.815898749@linuxfoundation.org

State

Superseded

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        stable@vger.kernel.org, Maxim Mikityanskiy <maximmi@nvidia.com>,
        Tariq Toukan <tariqt@nvidia.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.17 046/114] tls: Fix context leak on tls_device_down
Date: Mon, 16 May 2022 21:36:20 +0200
Message-Id: <20220516193626.815898749@linuxfoundation.org>
In-Reply-To: <20220516193625.489108457@linuxfoundation.org>
References: <20220516193625.489108457@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg Kroah-Hartman May 16, 2022, 7:36 p.m. UTC

From: Maxim Mikityanskiy <maximmi@nvidia.com>

[ Upstream commit 3740651bf7e200109dd42d5b2fb22226b26f960a ]

The commit cited below claims to fix a use-after-free condition after
tls_device_down. Apparently, the description wasn't fully accurate. The
context stayed alive, but ctx->netdev became NULL, and the offload was
torn down without a proper fallback, so a bug was present, but a
different kind of bug.

Due to misunderstanding of the issue, the original patch dropped the
refcount_dec_and_test line for the context to avoid the alleged
premature deallocation. That line has to be restored, because it matches
the refcount_inc_not_zero from the same function, otherwise the contexts
that survived tls_device_down are leaked.

This patch fixes the described issue by restoring refcount_dec_and_test.
After this change, there is no leak anymore, and the fallback to
software kTLS still works.

Fixes: c55dcdd435aa ("net/tls: Fix use-after-free after the TLS device goes down and up")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://lore.kernel.org/r/20220512091830.678684-1-maximmi@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tls/tls_device.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index a40553e83f8b..f3e3d009cf1c 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -1347,7 +1347,10 @@  static int tls_device_down(struct net_device *netdev)
 
 		/* Device contexts for RX and TX will be freed in on sk_destruct
 		 * by tls_device_free_ctx. rx_conf and tx_conf stay in TLS_HW.
+		 * Now release the ref taken above.
 		 */
+		if (refcount_dec_and_test(&ctx->refcount))
+			tls_device_free_ctx(ctx);
 	}
 
 	up_write(&device_offload_lock);

[5.17,046/114] tls: Fix context leak on tls_device_down

Commit Message

Patch