Skip to content

Commit 6db959c

Browse files
qsndavem330
authored andcommitted
tls: reset crypto_info when do_tls_setsockopt_tx fails
The current code copies directly from userspace to ctx->crypto_send, but doesn't always reinitialize it to 0 on failure. This causes any subsequent attempt to use this setsockopt to fail because of the TLS_CRYPTO_INFO_READY check, eventhough crypto_info is not actually ready. This should result in a correctly set up socket after the 3rd call, but currently it does not: size_t s = sizeof(struct tls12_crypto_info_aes_gcm_128); struct tls12_crypto_info_aes_gcm_128 crypto_good = { .info.version = TLS_1_2_VERSION, .info.cipher_type = TLS_CIPHER_AES_GCM_128, }; struct tls12_crypto_info_aes_gcm_128 crypto_bad_type = crypto_good; crypto_bad_type.info.cipher_type = 42; setsockopt(sock, SOL_TLS, TLS_TX, &crypto_bad_type, s); setsockopt(sock, SOL_TLS, TLS_TX, &crypto_good, s - 1); setsockopt(sock, SOL_TLS, TLS_TX, &crypto_good, s); Fixes: 3c4d755 ("tls: kernel TLS support") Signed-off-by: Sabrina Dubroca <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 877d17c commit 6db959c

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

net/tls/tls_main.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -388,7 +388,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
388388
case TLS_CIPHER_AES_GCM_128: {
389389
if (optlen != sizeof(struct tls12_crypto_info_aes_gcm_128)) {
390390
rc = -EINVAL;
391-
goto out;
391+
goto err_crypto_info;
392392
}
393393
rc = copy_from_user(crypto_info + 1, optval + sizeof(*crypto_info),
394394
optlen - sizeof(*crypto_info));
@@ -400,7 +400,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
400400
}
401401
default:
402402
rc = -EINVAL;
403-
goto out;
403+
goto err_crypto_info;
404404
}
405405

406406
/* currently SW is default, we will have ethtool in future */

0 commit comments

Comments
 (0)