Commit c65f27b9 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Jakub Kicinski
Browse files

tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). 



get_netdev_for_sock() is called during setsockopt(),
so not under RCU.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Note that the only ->ndo_sk_get_lower_dev() user is
bond_sk_get_lower_dev(), which uses RCU.

Fixes: e8f69799 ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 0b0e4d51

net/tls/tls_device.c

+10 −8
Original line number Diff line number Diff line
@@ -123,17 +123,19 @@ static void tls_device_queue_ctx_destruction(struct tls_context *ctx) 
/* We assume that the socket is already connected */

static struct net_device *get_netdev_for_sock(struct sock *sk)

{

	struct dst_entry *dst = sk_dst_get(sk);

	struct net_device *netdev = NULL;

	struct net_device *dev, *lowest_dev = NULL;

	struct dst_entry *dst;



	if (likely(dst)) {

		netdev = netdev_sk_get_lowest_dev(dst->dev, sk);

		dev_hold(netdev);

	rcu_read_lock();

	dst = __sk_dst_get(sk);

	dev = dst ? dst_dev_rcu(dst) : NULL;

	if (likely(dev)) {

		lowest_dev = netdev_sk_get_lowest_dev(dev, sk);

		dev_hold(lowest_dev);

	}

	rcu_read_unlock();



	dst_release(dst);



	return netdev;

	return lowest_dev;

}



static void destroy_record(struct tls_record_info *record)