[PATCH net v4 0/2] net/tls: fix UAF when TLS_RX is set on sockmap socket

[Xingwang Xiang <v3rdant.xiang@gmail.com>]

This series fixes a use-after-free triggered by configuring TLS RX on a
socket that is already inserted into a sockmap (the reverse of the order
that is already guarded against by tcp_bpf_check_ulp).

Patch 1 adds the symmetric check to do_tls_setsockopt_conf: if a psock
is already attached when TLS_RX is requested, return -EBUSY before any
strparser state is touched.

Patch 2 adds a regression test to the KTLS selftest suite that drives
the vulnerable setup and verifies the kernel either rejects the
combination or handles it correctly end-to-end.

Xingwang Xiang (2):
  net/tls: reject TLS_RX setsockopt on psock-owned sockets
  selftests: bpf: add test for KTLS+sockmap reverse-order UAF

 net/tls/tls_main.c                            |   9 ++
 .../selftests/bpf/prog_tests/sockmap_ktls.c   | 109 ++++++++++++++++++
 .../selftests/bpf/progs/test_sockmap_ktls.c   |  21 ++++
 3 files changed, 139 insertions(+)

-- 
2.54.0