From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ABA413FD14D; Tue, 26 May 2026 14:21:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779805308; cv=none; b=ZTtHkPcfOZTnC1v+qoVs338kAmAcxj/Sm9WV9pARbDLDtxo0F7JdAN+yEA3//X44fa7GsU4rtibRfKoMoUUjPPoJE6bmJDZS7fX0O4IdOnAYBSyjzoYtEzNrbPte5J/u0frMFIOw449lXJ3BpEWBkq+WBOOAc0aau7SXBMGci28= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779805308; c=relaxed/simple; bh=blYY6F4XVzT0cZ+JdFv5hdFF3f+fjhHUrEn6M6hahHg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=cSmQbX8je7kI7UoB2Y4sLA0Xd08JoZPjPJFaGuprIj5LN5k9Ej6JsyY6fHPsDCMjhRXYYXVN8qeetQe9yJVBi++gnCgbprXFQ6t+OrapiSkMzoxxUr9nqVLMEoXhnaTxSwohpJKFUp6Dp0xz5bR18iKPquHQ7QLiZ8Iao1fuFF0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=AZPnecl/; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="AZPnecl/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7828F1F00A3A; Tue, 26 May 2026 14:21:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779805307; bh=mvvrnidiJlzIyUspiiL1z3imu0wGJ2WcJkqP6BQe5mw=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=AZPnecl/UVj/UVFvDTqIdWIA3MMoe4597Ml+vjPRd3ucp70iJx04q5zvUA3cjIWbM Yku8Y35gDvATNaZpkk/hTebpmq6PiR+CaZdzjuHDRpoNIQeuA5NKLnOoWbbnzWpDOc 3FAn5tCGw6K4eUTAEtkQt2qRxEw+9lzldntktLjpje03mkuuKey/gih/bA3KTQ6tro Ix8bzp4WUxv9k4+iJCETSdiP7JMLh92tzXXWVkdzpTWBqJrUZMVj497cB41S69r9PU UW8zDdLoyTSDtx3CGldXnKe0Gx7GIerk5/tv2EOpvvb/kT9mSfWjzAELRtJdsBohzx hNAunQOTmRQ6Q== From: Chuck Lever Date: Tue, 26 May 2026 10:21:31 -0400 Subject: [PATCH net-next v11 1/6] tls: Avoid evaluating freed skb in tls_sw_read_sock() loop Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260526-tls-read-sock-v11-1-244fe1dc4abd@oracle.com> References: <20260526-tls-read-sock-v11-0-244fe1dc4abd@oracle.com> In-Reply-To: <20260526-tls-read-sock-v11-0-244fe1dc4abd@oracle.com> To: John Fastabend , Jakub Kicinski , Sabrina Dubroca Cc: Eric Dumazet , Simon Horman , Paolo Abeni , netdev@vger.kernel.org, kernel-tls-handshake@lists.linux.dev, Chuck Lever , Sagi Grimberg X-Mailer: b4 0.16-dev-da966 X-Developer-Signature: v=1; a=openpgp-sha256; l=1616; i=chuck.lever@oracle.com; h=from:subject:message-id; bh=/rO6uLNSYVMg6gXKxqsd2H/iD25IE03u0ySmlcbbWRk=; b=owEBbQKS/ZANAwAKATNqszNvZn+XAcsmYgBqFax4HUhZfjxOtgn2Hof/d44EllZ75meGGpGiW YEyFfZYpJ2JAjMEAAEKAB0WIQQosuWwEobfJDzyPv4zarMzb2Z/lwUCahWseAAKCRAzarMzb2Z/ l9P0EAC5CE9ymnHAhWwr+vQJePZoV7diwckoETJFOHO223OTMGcz78BqMk6STPK7n9cNHt2T8D/ s5LhL4NloZi6R9If2xCR5D8Rouh9vQI3sSRfGFrsrlXgynZHwlcZoFXFsOFyLPixkvEjnJRPmwT EtqDjBoocBtyOpoOJNJLJgc6Wg51uPGqFr50zP32ZenNV4BORBHivMre/jtQrw3pPnn7jgft9OF 9JQ0n8VGdyauV8Py5emYfJQveYyutPMTAEc5VTqRzF7Iw1CsEOjxYaZyWkoYovl9NQwUt+wlf4d 3OP1P5t+re8uV0xkBfL7M+9PRGsfsug2dxlZeVB6y83ugUBsxlPqf+ktWwI6szNkYbcEikO7TIw EzAnKvJMPimuSY/YGAm3QyYeJVzgSQL6+vFg9jnGbVSHZM/ZiP/QSOpcURIL3DIZ/6VjABXOLXa ym2/RMil8HatGvmm++IKMYMOH6XJRdYTYLAu+LeGs95oSTtzOyTx6yhGpK5NAdBprddJJAyX9Z6 q26uGOFSb0t6qqDWQYr5JsihRRh7qAG4Lty2TrqA0TIy5lmR5m1fje3QcTQpEjWGKERf7dFHAZe LswJU2LgRd6yw3OlQx12J9sTepVsutC3zNA8v1n0eZnSM5wcXNi/tpS4VZUVQ4ptW1Oktc8GvO5 XbWbKuyyVdH4Ctw== X-Developer-Key: i=chuck.lever@oracle.com; a=openpgp; fpr=28B2E5B01286DF243CF23EFE336AB3336F667F97 From: Chuck Lever tls_sw_read_sock() ends its receive loop with while (skb), but the else branch in the body calls consume_skb(skb) before the predicate is re-evaluated. A pointer becomes indeterminate when the object it points to reaches end-of-lifetime (C2011 6.2.4p2), and using an indeterminate value is undefined behavior (Annex J.2). The pointer is not dereferenced today -- the predicate either exits the loop or skb is overwritten at the top of the next iteration -- but any future change that adds a dereference between consume_skb() and the predicate would silently introduce a use-after-free. Replace the do/while form with an explicit for(;;) loop so termination happens through a break statement rather than predicate evaluation of a freed pointer. Cc: Sagi Grimberg Signed-off-by: Chuck Lever --- net/tls/tls_sw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 964ebc268ee4..8e4e57721335 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -2383,7 +2383,7 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t *desc, goto read_sock_end; decrypted = 0; - do { + for (;;) { if (!skb_queue_empty(&ctx->rx_list)) { skb = __skb_dequeue(&ctx->rx_list); rxm = strp_msg(skb); @@ -2435,9 +2435,9 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t *desc, } else { consume_skb(skb); if (!desc->count) - skb = NULL; + break; } - } while (skb); + } read_sock_end: tls_rx_reader_release(sk, ctx); -- 2.54.0