Re: [PATCH net-next v7 2/5] tls: Fix dangling skb pointer in tls_sw_read_sock()

[Sabrina Dubroca <sd@queasysnail.net>]

2026-03-28, 11:17:09 -0400, Chuck Lever wrote:
> From: Chuck Lever <chuck.lever@oracle.com>
> 
> Per ISO/IEC 9899:2011 section 6.2.4p2, a pointer value becomes
> indeterminate when the object it points to reaches the end of its
> lifetime; Annex J.2 classifies the use of such a value as undefined
> behavior. In tls_sw_read_sock(), consume_skb(skb) in the
> fully-consumed path frees the skb, but the "do { } while (skb)"
> loop condition then evaluates that freed pointer. Although the
> value is never dereferenced -- the loop either continues and
> overwrites skb, or exits -- any future change that adds a
> dereference between consume_skb() and the loop condition would
> produce a silent use-after-free.
> 
> Fixes: 662fbcec32f4 ("net/tls: implement ->read_sock()")
> Reviewed-by: Hannes Reinecke <hare@suse.de>
> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> ---
>  net/tls/tls_sw.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

-- 
Sabrina