netdev - [PATCH net] net/tls: Fix kernel panic when socket is in tls toe mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat,  5 Dec 2020 02:39:30 +0530
From:   Vinay Kumar Yadav <vinay.yadav@...lsio.com>
To:     netdev@...r.kernel.org, davem@...emloft.net, kuba@...nel.org
Cc:     secdev@...lsio.com, Vinay Kumar Yadav <vinay.yadav@...lsio.com>,
        Rohit Maheshwari <rohitm@...lsio.com>
Subject: [PATCH net] net/tls: Fix kernel panic when socket is in tls toe mode

When socket is in tls-toe (TLS_HW_RECORD) and connections
are established in kernel stack, on every connection close
it clears tls context which is created once on socket creation,
causing kernel panic. fix it by not initializing listen in
kernel stack incase of tls-toe, allow listen in only adapter.

Fixes: dd0bed1665d6 ("tls: support for Inline tls record")
Signed-off-by: Rohit Maheshwari <rohitm@...lsio.com>
Signed-off-by: Vinay Kumar Yadav <vinay.yadav@...lsio.com>
---
 net/tls/tls_toe.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/net/tls/tls_toe.c b/net/tls/tls_toe.c
index 7e1330f19..f74b647d3 100644
--- a/net/tls/tls_toe.c
+++ b/net/tls/tls_toe.c
@@ -81,7 +81,6 @@ int tls_toe_bypass(struct sock *sk)
 
 void tls_toe_unhash(struct sock *sk)
 {
-	struct tls_context *ctx = tls_get_ctx(sk);
 	struct tls_toe_device *dev;
 
 	spin_lock_bh(&device_spinlock);
@@ -95,16 +94,13 @@ void tls_toe_unhash(struct sock *sk)
 		}
 	}
 	spin_unlock_bh(&device_spinlock);
-	ctx->sk_proto->unhash(sk);
 }
 
 int tls_toe_hash(struct sock *sk)
 {
-	struct tls_context *ctx = tls_get_ctx(sk);
 	struct tls_toe_device *dev;
 	int err;
 
-	err = ctx->sk_proto->hash(sk);
 	spin_lock_bh(&device_spinlock);
 	list_for_each_entry(dev, &device_list, dev_list) {
 		if (dev->hash) {
-- 
2.18.1