| From 2e64e6db176b5ee44d1661aa61de8d0ed689fc35 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 14 May 2025 21:20:13 +0800 |
| Subject: net/tls: fix kernel panic when alloc_page failed |
| |
| From: Pengtao He <hept.hept.hept@gmail.com> |
| |
| [ Upstream commit 491deb9b8c4ad12fe51d554a69b8165b9ef9429f ] |
| |
| We cannot set frag_list to NULL pointer when alloc_page failed. |
| It will be used in tls_strp_check_queue_ok when the next time |
| tls_strp_read_sock is called. |
| |
| This is because we don't reset full_len in tls_strp_flush_anchor_copy() |
| so the recv path will try to continue handling the partial record |
| on the next call but we dettached the rcvq from the frag list. |
| Alternative fix would be to reset full_len. |
| |
| Unable to handle kernel NULL pointer dereference |
| at virtual address 0000000000000028 |
| Call trace: |
| tls_strp_check_rcv+0x128/0x27c |
| tls_strp_data_ready+0x34/0x44 |
| tls_data_ready+0x3c/0x1f0 |
| tcp_data_ready+0x9c/0xe4 |
| tcp_data_queue+0xf6c/0x12d0 |
| tcp_rcv_established+0x52c/0x798 |
| |
| Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") |
| Signed-off-by: Pengtao He <hept.hept.hept@gmail.com> |
| Link: https://patch.msgid.link/20250514132013.17274-1-hept.hept.hept@gmail.com |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/tls/tls_strp.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c |
| index 5df08d848b5c9..1852fac3e72b7 100644 |
| --- a/net/tls/tls_strp.c |
| +++ b/net/tls/tls_strp.c |
| @@ -395,7 +395,6 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort) |
| return 0; |
| |
| shinfo = skb_shinfo(strp->anchor); |
| - shinfo->frag_list = NULL; |
| |
| /* If we don't know the length go max plus page for cipher overhead */ |
| need_spc = strp->stm.full_len ?: TLS_MAX_PAYLOAD_SIZE + PAGE_SIZE; |
| @@ -411,6 +410,8 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort) |
| page, 0, 0); |
| } |
| |
| + shinfo->frag_list = NULL; |
| + |
| strp->copy_mode = 1; |
| strp->stm.offset = 0; |
| |
| -- |
| 2.39.5 |
| |
