queue-4.19/net-tls-avoid-null-pointer-deref-on-nskb-sk-in-fallback.patch

   1 From foo@baz Sat 04 May 2019 09:23:44 AM CEST
   2 From: Jakub Kicinski <jakub.kicinski@netronome.com>
   3 Date: Mon, 29 Apr 2019 12:19:12 -0700
   4 Subject: net/tls: avoid NULL pointer deref on nskb->sk in fallback
   5
   6 From: Jakub Kicinski <jakub.kicinski@netronome.com>
   7
   8 [ Upstream commit 2dcb003314032c6efb13a065ffae60d164b2dd35 ]
   9
  10 update_chksum() accesses nskb->sk before it has been set
  11 by complete_skb(), move the init up.
  12
  13 Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
  14 Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
  15 Reviewed-by: Simon Horman <simon.horman@netronome.com>
  16 Signed-off-by: David S. Miller <davem@davemloft.net>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18 ---
  19  net/tls/tls_device_fallback.c |    3 ++-
  20  1 file changed, 2 insertions(+), 1 deletion(-)
  21
  22 --- a/net/tls/tls_device_fallback.c
  23 +++ b/net/tls/tls_device_fallback.c
  24 @@ -200,13 +200,14 @@ static void complete_skb(struct sk_buff
  25
  26         skb_put(nskb, skb->len);
  27         memcpy(nskb->data, skb->data, headln);
  28 -       update_chksum(nskb, headln);
  29
  30         nskb->destructor = skb->destructor;
  31         nskb->sk = sk;
  32         skb->destructor = NULL;
  33         skb->sk = NULL;
  34
  35 +       update_chksum(nskb, headln);
  36 +
  37         delta = nskb->truesize - skb->truesize;
  38         if (likely(delta < 0))
  39                 WARN_ON_ONCE(refcount_sub_and_test(-delta, &sk->sk_wmem_alloc));