linux/net/tls
Dae R. Jeong 91e61dd7a0 tls: fix missing memory barrier in tls_init
In tls_init(), a write memory barrier is missing, and store-store
reordering may cause NULL dereference in tls_{setsockopt,getsockopt}.

CPU0                               CPU1
-----                              -----
// In tls_init()
// In tls_ctx_create()
ctx = kzalloc()
ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)

// In update_sk_prot()
WRITE_ONCE(sk->sk_prot, tls_prots)     -(2)

                                   // In sock_common_setsockopt()
                                   READ_ONCE(sk->sk_prot)->setsockopt()

                                   // In tls_{setsockopt,getsockopt}()
                                   ctx->sk_proto->setsockopt()    -(3)

In the above scenario, when (1) and (2) are reordered, (3) can observe
the NULL value of ctx->sk_proto, causing NULL dereference.

To fix it, we rely on rcu_assign_pointer() which implies the release
barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is
initialized, we can ensure that ctx->sk_proto are visible when
changing sk->sk_prot.

Fixes: d5bee7374b ("net/tls: Annotate access to sk_prot with READ_ONCE/WRITE_ONCE")
Signed-off-by: Yewon Choi <woni9911@gmail.com>
Signed-off-by: Dae R. Jeong <threeearcat@gmail.com>
Link: https://lore.kernel.org/netdev/ZU4OJG56g2V9z_H7@dragonet/T/
Link: https://lore.kernel.org/r/Zkx4vjSFp0mfpjQ2@libra05
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2024-05-23 12:03:26 +02:00
..
Kconfig net: skbuff: generalize the skb->decrypted bit 2024-04-06 17:34:31 +01:00
Makefile tls: rx: async: hold onto the input skb 2022-07-18 11:24:11 +01:00
tls_device_fallback.c Revert "net: mirror skb frag ref/unref helpers" 2024-05-03 16:05:53 -07:00
tls_device.c net: move skb ref helpers to new header 2024-04-11 19:29:22 -07:00
tls_main.c tls: fix missing memory barrier in tls_init 2024-05-23 12:03:26 +02:00
tls_proc.c tls: rx: add counter for NoPad violations 2022-07-11 19:48:33 -07:00
tls_strp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-04-25 12:41:37 -07:00
tls_sw.c tls: remove redundant assignment to variable decrypted 2024-04-11 20:00:22 -07:00
tls_toe.c tls: create an internal header 2022-07-08 18:38:45 -07:00
tls.h tls: fix lockless read of strp->msg_ready in ->poll 2024-04-25 08:32:37 -07:00
trace.c net/tls: add tracing for device/offload events 2019-10-05 16:29:00 -07:00
trace.h net/tls: add device decrypted trace point 2019-10-05 16:29:00 -07:00