Re: [PATCH] tls: reject attaching TLS to sockets already in sockmap

[Jakub Kicinski <kuba@kernel.org>]

On Sat, 21 Mar 2026 17:47:07 +0800 xw x wrote:
> I apologize. I fixed it this way because during my exploitation, I
> discovered that sk_psock_init checks for the existence of ULP in sk,
> which led me to believe that disabling sk with TLS from being added to
> sockmap was expected behavior, and I thought this fix might have the
> least impact.
> 
> In fact, the other patch which I believe is a more fundamental
> solution, is similar to CVE-2025-37756. In
> `tls_strp_load_anchor_with_queue`,
> `skb_shinfo(strp->anchor)->frag_list = first` acquires a reference to
> an skb but doesn't own it. This causes a  dangling pointer when other
> kernel components not specifically adapted to TLS (tcp_disconnect in
> CVE-2025-37756 and bpt in that vuln) release TLS skbs.
> 
> I will try to add my test program to
> tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c so that you can
> test it and understand the root cause.

FWIW you can open a pull request against this repo, and it will run all
the sockmap+TLS tests for you: https://github.com/kernel-patches/bpf

reminder: please don't top post on the list