Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53db6523 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Greg Kroah-Hartman
Browse files

net/tls: don't leak IV and record seq when offload fails 



[ Upstream commit 12c7686111326148b4b5db189130522a4ad1be4a ]

When device refuses the offload in tls_set_device_offload_rx()
it calls tls_sw_free_resources_rx() to clean up software context
state.

Unfortunately, tls_sw_free_resources_rx() does not free all
the state tls_set_sw_offload() allocated - it leaks IV and
sequence number buffers.  All other code paths which lead to
tls_sw_release_resources_rx() (which tls_sw_free_resources_rx()
calls) free those right before the call.

Avoid the leak by moving freeing of iv and rec_seq into
tls_sw_release_resources_rx().

Fixes: 4799ac81 ("tls: Add rx inline crypto offload")
Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: default avatarDirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d3bdd359

net/tls/tls_device.c

+0 −2
Original line number Diff line number Diff line
@@ -911,8 +911,6 @@ void tls_device_offload_cleanup_rx(struct sock *sk) 
	}

out:

	up_read(&device_offload_lock);

	kfree(tls_ctx->rx.rec_seq);

	kfree(tls_ctx->rx.iv);

	tls_sw_release_resources_rx(sk);

}

net/tls/tls_main.c

+1 −4
Original line number Diff line number Diff line
@@ -290,11 +290,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout) 
		tls_sw_free_resources_tx(sk);

	}



	if (ctx->rx_conf == TLS_SW) {

		kfree(ctx->rx.rec_seq);

		kfree(ctx->rx.iv);

	if (ctx->rx_conf == TLS_SW)

		tls_sw_free_resources_rx(sk);

	}



#ifdef CONFIG_TLS_DEVICE

	if (ctx->rx_conf == TLS_HW)

net/tls/tls_sw.c

+3 −0
Original line number Diff line number Diff line
@@ -1118,6 +1118,9 @@ void tls_sw_release_resources_rx(struct sock *sk) 
	struct tls_context *tls_ctx = tls_get_ctx(sk);

	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);



	kfree(tls_ctx->rx.rec_seq);

	kfree(tls_ctx->rx.iv);



	if (ctx->aead_recv) {

		kfree_skb(ctx->recv_pkt);

		ctx->recv_pkt = NULL;