net/tls: Remove the context from the list in tls_device_down
authorMaxim Mikityanskiy <maximmi@nvidia.com>
Thu, 21 Jul 2022 09:11:27 +0000 (12:11 +0300)
committerDavid S. Miller <davem@davemloft.net>
Sun, 24 Jul 2022 20:40:56 +0000 (21:40 +0100)
commitf6336724a4d4220c89a4ec38bca84b03b178b1a3
tree3582a1d195afd0bc4728011d04bba50d579ed75b
parent4d8f24eeedc58d5f87b650ddda73c16e8ba56559
net/tls: Remove the context from the list in tls_device_down

tls_device_down takes a reference on all contexts it's going to move to
the degraded state (software fallback). If sk_destruct runs afterwards,
it can reduce the reference counter back to 1 and return early without
destroying the context. Then tls_device_down will release the reference
it took and call tls_device_free_ctx. However, the context will still
stay in tls_device_down_list forever. The list will contain an item,
memory for which is released, making a memory corruption possible.

Fix the above bug by properly removing the context from all lists before
any call to tls_device_free_ctx.

Fixes: 3740651bf7e2 ("tls: Fix context leak on tls_device_down")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tls/tls_device.c