Subject: CVE-2024-26583: tls: fix race between async notify and socket close

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tls: fix race between async notify and socket close

The submitting thread (one which called recvmsg/sendmsg)
may exit as soon as the async crypto handler calls complete()
so any code past that point risks touching already freed data.

Try to avoid the locking and extra flags altogether.
Have the main thread hold an extra reference, this way
we can depend solely on the atomic ref counter for
synchronization.

Don't futz with reiniting the completion, either, we are now
tightly controlling when completion fires.

The Linux kernel CVE team has assigned CVE-2024-26583 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 5.15.160 with commit f17d21ea7391
	Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 6.1.79 with commit 7a3ca06d04d5
	Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 6.6.18 with commit 86dc27ee36f5
	Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 6.7.6 with commit 6209319b2efd
	Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 6.8 with commit aec7961916f3
	Issue introduced in 5.4.44 with commit cf4cc95a15f5
	Issue introduced in 5.4.71 with commit 8dc5025c6a44
	Issue introduced in 5.6.16 with commit 9b81d43da15e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26583
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	include/net/tls.h
	net/tls/tls_sw.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7
	https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01
	https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a
	https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33
	https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d