| From 53220a369f8f8b84cee73d9a4c14a1f75500883b Mon Sep 17 00:00:00 2001 |
| From: Xiyu Yang <xiyuyang19@fudan.edu.cn> |
| Date: Sat, 25 Apr 2020 20:54:37 +0800 |
| Subject: [PATCH] net/tls: Fix sk_psock refcnt leak in bpf_exec_tx_verdict() |
| |
| commit 095f5614bfe16e5b3e191b34ea41b10d6fdd4ced upstream. |
| |
| bpf_exec_tx_verdict() invokes sk_psock_get(), which returns a reference |
| of the specified sk_psock object to "psock" with increased refcnt. |
| |
| When bpf_exec_tx_verdict() returns, local variable "psock" becomes |
| invalid, so the refcount should be decreased to keep refcount balanced. |
| |
| The reference counting issue happens in one exception handling path of |
| bpf_exec_tx_verdict(). When "policy" equals to NULL but "psock" is not |
| NULL, the function forgets to decrease the refcnt increased by |
| sk_psock_get(), causing a refcnt leak. |
| |
| Fix this issue by calling sk_psock_put() on this error path before |
| bpf_exec_tx_verdict() returns. |
| |
| Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> |
| Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c |
| index 8f624be6cc02..1ae5c297b6ed 100644 |
| --- a/net/tls/tls_sw.c |
| +++ b/net/tls/tls_sw.c |
| @@ -798,6 +798,8 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, |
| tls_free_open_rec(sk); |
| err = -sk->sk_err; |
| } |
| + if (psock) |
| + sk_psock_put(sk, psock); |
| return err; |
| } |
| more_data: |
| -- |
| 2.7.4 |
| |
