From cd5df1c2f7d04c887e45238de0395bac381d4e02 Mon Sep 17 00:00:00 2001 From: Pietro Borrello Date: Wed, 8 Mar 2023 11:59:04 +0800 Subject: [PATCH] net/tls: tls_is_tx_ready() checked list_entry mainline inclusion from mainline-v6.2-rc7 commit ffe2a22562444720b05bdfeb999c03e810d84cbb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7U2 CVE: CVE-2023-1075 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffe2a22562444720b05bdfeb999c03e810d84cbb -------------------------------- tls_is_tx_ready() checks that list_first_entry() does not return NULL. This condition can never happen. For empty lists, list_first_entry() returns the list_entry() of the head, which is a type confusion. Use list_first_entry_or_null() which returns NULL in case of empty lists. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230128-list-entry-null-check-tls-v1-1-525bbfe6f0d0@diag.uniroma1.it Signed-off-by: Jakub Kicinski Conflicts: net/tls/tls_sw.c Signed-off-by: Ziyang Xuan Reviewed-by: Yue Haibing Reviewed-by: Wang Weiyang Signed-off-by: Jialin Zhang --- include/net/tls.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/net/tls.h b/include/net/tls.h index 27737c7953f3..c837ef871564 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -442,7 +442,7 @@ static inline bool is_tx_ready(struct tls_sw_context_tx *ctx) { struct tls_rec *rec; - rec = list_first_entry(&ctx->tx_list, struct tls_rec, list); + rec = list_first_entry_or_null(&ctx->tx_list, struct tls_rec, list); if (!rec) return false; -- GitLab