Re: [BUG] net/tls: UAF and BUG_ON via tcp_recvmsg/tcp_zerocopy_receive

[Jakub Kicinski <kuba@kernel.org>]

On Tue, 05 Aug 2025 16:30:37 +0000 Savy wrote:
> This UAF read can probably be transformed into a privilege escalation, 
> as the UAF read can be turned into a UAF write if the anchor undergoes the clone path.
> However, the conditions for that is pretty restrictive, 
> and may require features such as TLS hardware offload for us to hit such paths.
> 
> For the getsockopt(TCP_ZEROCOPY_RECEIVE) version of the bug, 
> we suggest the following check to fix the issue, as the SOCK_SUPPORT_ZC bit 
> is already cleared in __tcp_set_ulp() [2]:
> 
> static int tcp_zerocopy_receive(struct sock *sk,
>                 struct tcp_zerocopy_receive *zc,
>                 struct scm_timestamping_internal *tss)
> {
>     // [...]
> 
> +    /* ZC support has been cleared by ULP */
> +    if (!test_bit(SOCK_SUPPORT_ZC, &sk->sk_socket->flags))
> +        return -EOPNOTSUPP;
> 
>     // [...]
> }
> 
> For the tcp_recvmsg() version, we could check if there are any processes
> waiting for data on the socket before installing the ULP.

Thanks for the high quality bug report! I think that we're better off
checking if the copied_seq moved since we looked at the queue.
It should cover all cases at once. I'll share the proposed fix soon.