Re: [PATCH net v3] strparser: make sure __strp_recv isn't running before tearing down the parser

[Hyunwoo Kim <imv4bel@gmail.com>]

On Mon, Oct 05, 2026 at 03:50:02PM +0200, Sabrina Dubroca wrote:
> The comment above strp_done() claims that if strp is stopped,
> strp_recv will no longer be called. That's only true if the caller has
> a mechanism (eg locking) to guarantee that strp_recv() calls that
> started before strp_stop() have completed by the time we call
> strp_done().
> 
> This adds a dummy lock_sock/release_sock pair to guarantee that any
> in-flight strp_recv() (which runs under either bh_lock_sock or
> lock_sock, depending if it's called from ->sk_data_ready or strp_work)
> has completed.
> 
> Only espintcp can be affected by this race condition, but this patch
> makes sure no future user of strp can have the bug.
> 
> This could crash on strp->sk ("general mode" of strp), but this mode
> has been here for 9 years and has never been used. It'll be gone soon,
> no point worrying about it.
> 
> Switch the stopped/paused/etc bits to u8's to avoid races between
> strp_stop() and strp_pause/unpause().
> 
> A reproducer has been published and turns the possible UAF into an
> exploit [1].

:(

> 
> Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
> Link: https://lore.kernel.org/all/aZLn2Faeg1FB7XOf@v4bel/
> Link: https://lore.kernel.org/all/aZgpkyTDU3aXe_V0@v4bel/
> Link: https://github.com/m0x41nos/RustyTux [1]
> Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>

Reviewed-by: Hyunwoo Kim <imv4bel@gmail.com>