From patchwork Fri Jul 28 19:53:12 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yuxuan Luo X-Patchwork-Id: 1814431 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=VfC8vB+H; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RCJGh2YvMz20Fy for ; Sat, 29 Jul 2023 05:53:32 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1qPTWg-00077a-MS; Fri, 28 Jul 2023 19:53:26 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1qPTWd-000769-EW for kernel-team@lists.ubuntu.com; Fri, 28 Jul 2023 19:53:23 +0000 Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 62F9C3FA7C for ; Fri, 28 Jul 2023 19:53:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1690574002; bh=ChKBPoSYwWCyRya4+DwiWs0fMC6v821lh97m/AyDSzk=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=VfC8vB+Hfjs1luavKBwvtWTO1IUQNNx3oK7hGwzjyJdBjUBtKKH7jMLZJVvfESjK7 hn/U8rR0UKG4y6D5g48O75ao1er0YSaYOjt034Owcyw7NksL9sZ9aNqXctlmgnYslO TzeisO0GH7J49nLsBv2KN1p/xlvDDKmWe1H/Lg1qB5U313n0nkcj98HgxQNYS2nyIH iK04heaL2u4VUEC/eJJJZYUa9swlAKMb4WhwiXa8kYHoGZGUDDhpLQHCoXUw5IbFVd 2zcrEjTlX0BPgdxrxzkOGxP9rl8C69SU+QtcHyB65pEIkE28dcujHx/qOu4QYfknt2 O/odaAljeAIJA== Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-408d32b89e8so4923671cf.1 for ; Fri, 28 Jul 2023 12:53:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1690574000; x=1691178800; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ChKBPoSYwWCyRya4+DwiWs0fMC6v821lh97m/AyDSzk=; b=Z3MkNIqiGBRWl0BSNbRGlMyoi601WBplFWPzcDJHII1742lOXFbTGp7RxBZjyqLONr ArZhvZPmDc7pR67RMXhk7CPBILVRIkXvVVNjOHFOtEqfrotOli1Jm0vMIxywN2c6wxyQ FQdVbnziKDc5npXpWOiITdUCGMSuFUyn3LZBFGolrFB4w5SB/z6HeyBEXUTyH8qkQQyW iq6vgWPGUaZDD3kNzPW3qOQe7lTbnX69x1FCClNzSJoJK0wJ9931iWPNS0XB25TnTKzO BUWVcudEG5C41L+YyuDfnwuTpUsKA9kr8ddqwjC0fkX5OKz0vN2QF7xE8IJl4rE0If5c 3w2Q== X-Gm-Message-State: ABy/qLY6iUdMP42jt8q8RF+CkHnC/l5Ko99nhHA3wlr7OKjRM9NEKwf8 G7CxVs3hqlkCI9E6vgwAjXmQk4/7T+aljq/LFOxluymlZ0aZVWa7Uzy/QMpTZV+0pjyRlWtxcoy W3PoWr3qjX/knsXq5xV5kDAe6Mxd0Yml41uuMDoRvfH/piXbwLYLV X-Received: by 2002:a05:622a:1444:b0:3f9:c207:3123 with SMTP id v4-20020a05622a144400b003f9c2073123mr4366016qtx.45.1690574000569; Fri, 28 Jul 2023 12:53:20 -0700 (PDT) X-Google-Smtp-Source: APBJJlHchga+yxndn1udsSuLMUd92YzT0Tz86i74+rsntD2IUgdMlgSfWQ7ACQpKS+zh7LTSG8UxIw== X-Received: by 2002:a05:622a:1444:b0:3f9:c207:3123 with SMTP id v4-20020a05622a144400b003f9c2073123mr4366003qtx.45.1690574000263; Fri, 28 Jul 2023 12:53:20 -0700 (PDT) Received: from cache-ubuntu.hsd1.nj.comcast.net ([2601:86:200:98b0:da04:6059:8f11:999b]) by smtp.gmail.com with ESMTPSA id g5-20020ac85805000000b0040324785e4csm1380854qtg.13.2023.07.28.12.53.19 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Jul 2023 12:53:19 -0700 (PDT) From: Yuxuan Luo To: kernel-team@lists.ubuntu.com Subject: [SRU][Jammy-OEM-5.17][PATCH 1/1] net/tls: tls_is_tx_ready() checked list_entry Date: Fri, 28 Jul 2023 15:53:12 -0400 Message-Id: <20230728195313.92261-2-yuxuan.luo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230728195313.92261-1-yuxuan.luo@canonical.com> References: <20230728195313.92261-1-yuxuan.luo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Pietro Borrello tls_is_tx_ready() checks that list_first_entry() does not return NULL. This condition can never happen. For empty lists, list_first_entry() returns the list_entry() of the head, which is a type confusion. Use list_first_entry_or_null() which returns NULL in case of empty lists. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230128-list-entry-null-check-tls-v1-1-525bbfe6f0d0@diag.uniroma1.it Signed-off-by: Jakub Kicinski (backported from commit ffe2a22562444720b05bdfeb999c03e810d84cbb) [yuxuan.luo: instead of backporting the previous commit 587903142308, modify the `is_tx_ready()` in include/net/tls.h directly. ] CVE-2023-1075 Signed-off-by: Yuxuan Luo --- include/net/tls.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/net/tls.h b/include/net/tls.h index 7f220e03ebb2d..e6836a5dfb6e2 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -427,7 +427,7 @@ static inline bool is_tx_ready(struct tls_sw_context_tx *ctx) { struct tls_rec *rec; - rec = list_first_entry(&ctx->tx_list, struct tls_rec, list); + rec = list_first_entry_or_null(&ctx->tx_list, struct tls_rec, list); if (!rec) return false;