[PATCH net-next] net: psp: don't assume reply skbs will have a socket

[PATCH net-next] net: psp: don't assume reply skbs will have a socket

[Jakub Kicinski]

Rx path may be passing around unreferenced sockets, which means
that skb_set_owner_edemux() may not set skb->sk and PSP will crash:

  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:psp_reply_set_decrypted (./include/net/psp/functions.h:132 net/psp/psp_sock.c:287)
    tcp_v6_send_response.constprop.0 (net/ipv6/tcp_ipv6.c:979)
    tcp_v6_send_reset (net/ipv6/tcp_ipv6.c:1140 (discriminator 1))
    tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1683)
    tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1912)

Fixes: 659a2899a57d ("tcp: add datapath logic for PSP with inline key exchange")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: ncardwell@google.com
CC: kuniyu@google.com
CC: daniel.zahka@gmail.com
CC: willemb@google.com
---
 include/net/psp/functions.h | 4 ++--
 net/ipv4/ip_output.c        | 2 +-
 net/ipv6/tcp_ipv6.c         | 2 +-
 net/psp/psp_sock.c          | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/net/psp/functions.h b/include/net/psp/functions.h
index ef7743664da3..c5c23a54774e 100644
--- a/include/net/psp/functions.h
+++ b/include/net/psp/functions.h
@@ -34,7 +34,7 @@ unsigned int psp_key_size(u32 version);
 void psp_sk_assoc_free(struct sock *sk);
 void psp_twsk_init(struct inet_timewait_sock *tw, const struct sock *sk);
 void psp_twsk_assoc_free(struct inet_timewait_sock *tw);
-void psp_reply_set_decrypted(struct sk_buff *skb);
+void psp_reply_set_decrypted(const struct sock *sk, struct sk_buff *skb);
 
 static inline struct psp_assoc *psp_sk_assoc(const struct sock *sk)
 {
@@ -160,7 +160,7 @@ static inline void
 psp_twsk_init(struct inet_timewait_sock *tw, const struct sock *sk) { }
 static inline void psp_twsk_assoc_free(struct inet_timewait_sock *tw) { }
 static inline void
-psp_reply_set_decrypted(struct sk_buff *skb) { }
+psp_reply_set_decrypted(const struct sock *sk, struct sk_buff *skb) { }
 
 static inline struct psp_assoc *psp_sk_assoc(const struct sock *sk)
 {
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 5ca97ede979c..ff11d3a85a36 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1668,7 +1668,7 @@ void ip_send_unicast_reply(struct sock *sk, const struct sock *orig_sk,
 		nskb->ip_summed = CHECKSUM_NONE;
 		if (orig_sk) {
 			skb_set_owner_edemux(nskb, (struct sock *)orig_sk);
-			psp_reply_set_decrypted(nskb);
+			psp_reply_set_decrypted(orig_sk, nskb);
 		}
 		if (transmit_time)
 			nskb->tstamp_type = SKB_CLOCK_MONOTONIC;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 9622c2776ade..59c4977a811a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -974,7 +974,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
 	if (sk) {
 		/* unconstify the socket only to attach it to buff with care. */
 		skb_set_owner_edemux(buff, (struct sock *)sk);
-		psp_reply_set_decrypted(buff);
+		psp_reply_set_decrypted(sk, buff);
 
 		if (sk->sk_state == TCP_TIME_WAIT)
 			mark = inet_twsk(sk)->tw_mark;
diff --git a/net/psp/psp_sock.c b/net/psp/psp_sock.c
index 5324a7603bed..a931d825d1cc 100644
--- a/net/psp/psp_sock.c
+++ b/net/psp/psp_sock.c
@@ -279,12 +279,12 @@ void psp_twsk_assoc_free(struct inet_timewait_sock *tw)
 	psp_assoc_put(pas);
 }
 
-void psp_reply_set_decrypted(struct sk_buff *skb)
+void psp_reply_set_decrypted(const struct sock *sk, struct sk_buff *skb)
 {
 	struct psp_assoc *pas;
 
 	rcu_read_lock();
-	pas = psp_sk_get_assoc_rcu(skb->sk);
+	pas = psp_sk_get_assoc_rcu(sk);
 	if (pas && pas->tx.spi)
 		skb->decrypted = 1;
 	rcu_read_unlock();
-- 
2.51.0

Re: [PATCH net-next] net: psp: don't assume reply skbs will have a socket

[Kuniyuki Iwashima]

On Tue, Sep 30, 2025 at 7:24 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> Rx path may be passing around unreferenced sockets, which means
> that skb_set_owner_edemux() may not set skb->sk and PSP will crash:
>
>   KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
>   RIP: 0010:psp_reply_set_decrypted (./include/net/psp/functions.h:132 net/psp/psp_sock.c:287)
>     tcp_v6_send_response.constprop.0 (net/ipv6/tcp_ipv6.c:979)
>     tcp_v6_send_reset (net/ipv6/tcp_ipv6.c:1140 (discriminator 1))
>     tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1683)
>     tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1912)
>
> Fixes: 659a2899a57d ("tcp: add datapath logic for PSP with inline key exchange")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Thanks!

Re: [PATCH net-next] net: psp: don't assume reply skbs will have a socket

[Eric Dumazet]

On Wed, Oct 1, 2025 at 11:28 PM Kuniyuki Iwashima <kuniyu@google.com> wrote:
>
> On Tue, Sep 30, 2025 at 7:24 PM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > Rx path may be passing around unreferenced sockets, which means
> > that skb_set_owner_edemux() may not set skb->sk and PSP will crash:
> >
> >   KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> >   RIP: 0010:psp_reply_set_decrypted (./include/net/psp/functions.h:132 net/psp/psp_sock.c:287)
> >     tcp_v6_send_response.constprop.0 (net/ipv6/tcp_ipv6.c:979)
> >     tcp_v6_send_reset (net/ipv6/tcp_ipv6.c:1140 (discriminator 1))
> >     tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1683)
> >     tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1912)
> >
> > Fixes: 659a2899a57d ("tcp: add datapath logic for PSP with inline key exchange")
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>
> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Reviewed-by: Eric Dumazet <edumazet@google.com>

Re: [PATCH net-next] net: psp: don't assume reply skbs will have a socket

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 30 Sep 2025 19:24:26 -0700 you wrote:
> Rx path may be passing around unreferenced sockets, which means
> that skb_set_owner_edemux() may not set skb->sk and PSP will crash:
> 
>   KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
>   RIP: 0010:psp_reply_set_decrypted (./include/net/psp/functions.h:132 net/psp/psp_sock.c:287)
>     tcp_v6_send_response.constprop.0 (net/ipv6/tcp_ipv6.c:979)
>     tcp_v6_send_reset (net/ipv6/tcp_ipv6.c:1140 (discriminator 1))
>     tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1683)
>     tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1912)
> 
> [...]

Here is the summary with links:
  - [net-next] net: psp: don't assume reply skbs will have a socket
    https://git.kernel.org/netdev/net/c/7a0f94361ffd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html