net/tls: swap sk_write_space on close

Now that we swap the original proto and clear the ULP pointer on close we have to make sure no callback will try to access the freed state. sk_write_space is not part of sk_prot, remember to swap it. Reported-by: [email protected] Fixes: 95fa145 ("bpf: sockmap/tls, close can race with map free") Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: David S. Miller <[email protected]>
simonjhall · Aug 10, 2019 · 57c722e · 57c722e
1 parent 6d0d779
commit 57c722e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
@@ -308,6 +308,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
 	if (free_ctx)
 		icsk->icsk_ulp_data = NULL;
 	sk->sk_prot = ctx->sk_proto;
+	sk->sk_write_space = ctx->sk_write_space;
 	write_unlock_bh(&sk->sk_callback_lock);
 	release_sock(sk);
 	if (ctx->tx_conf == TLS_SW)