[PATCH net v4 1/2] net/tls: reject TLS_RX setsockopt on psock-owned sockets

[Xingwang Xiang <v3rdant.xiang@gmail.com>]

When a TCP socket is inserted into a sockmap before TLS RX is
configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready
as rx_ctx->saved_data_ready.  On data arrival tls_rx_msg_ready()
calls saved_data_ready(), which is sk_psock_verdict_data_ready().
That calls tcp_read_skb(), draining sk_receive_queue via
__skb_unlink() without advancing copied_seq, because SK_PASS through
sk_psock_verdict_recv() does not call tcp_eat_skb().

tls_strp_msg_load() then sees tcp_inq() >= full_len (stale), calls
tcp_recv_skb() on an empty queue, triggers WARN_ON_ONCE(!first), and
returns with rx_ctx->strp.anchor.frag_list still pointing at a
psock-owned (potentially freed) skb.  tls_decrypt_sg() subsequently
walks that frag_list, yielding a use-after-free.

The existing guard only covers the reverse order: a sockmap update
already fails with EBUSY when the socket has TLS ULP set
(tcp_bpf_check_ulp).  Add the symmetric check: if a psock is already
attached to the socket, reject setsockopt(TLS_RX) with EBUSY before
any strparser state is modified.

Signed-off-by: Xingwang Xiang <v3rdant.xiang@gmail.com>
---
 net/tls/tls_main.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index fd39acf41..46cdd38ae 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -648,6 +648,15 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval,
 	if (sockptr_is_null(optval) || (optlen < sizeof(*crypto_info)))
 		return -EINVAL;
 
+	if (!tx) {
+		struct sk_psock *psock = sk_psock_get(sk);
+
+		if (psock) {
+			sk_psock_put(sk, psock);
+			return -EBUSY;
+		}
+	}
+
 	if (tx) {
 		crypto_ctx = &ctx->crypto_send;
 		alt_crypto_info = &ctx->crypto_recv.info;
-- 
2.54.0