[PATCH v1 net-next 1/2] psp: Check pas->tx.spi in psp_sk_overhead().

[Kuniyuki Iwashima <kuniyu@google.com>]

The next patch moves psp_sk_overhead(sk) from icsk->icsk_ext_hdr_len
to __tcp_mtu_to_mss() and tcp_mss_to_mtu(), which can be called
between psp_sock_assoc_set_rx() and psp_sock_set_tx_key() while Tx
packets are still sent in cleartext.

Currently, psp_sk_overhead() only checks if sk->psp_assoc is set,
and even without the next patch, if ipv6_update_options() is called
between psp_sock_assoc_set_rx() and psp_sock_set_tx_key(),
psp_sk_overhead(sk) is added to icsk->icsk_ext_hdr_len twice.

Let's check pas->tx.spi in psp_sk_overhead().

Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
not worth backporting, no one does that, only theoretical issue.
---
 include/net/psp/functions.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/net/psp/functions.h b/include/net/psp/functions.h
index b23c30898389..410adb6718c1 100644
--- a/include/net/psp/functions.h
+++ b/include/net/psp/functions.h
@@ -145,9 +145,9 @@ static inline struct psp_assoc *psp_skb_get_assoc_rcu(struct sk_buff *skb)
 static inline unsigned int psp_sk_overhead(const struct sock *sk)
 {
 	int psp_encap = sizeof(struct udphdr) + PSP_HDR_SIZE + PSP_TRL_SIZE;
-	bool has_psp = rcu_access_pointer(sk->psp_assoc);
+	struct psp_assoc *pas = psp_sk_assoc(sk);
 
-	return has_psp ? psp_encap : 0;
+	return pas && pas->tx.spi ? psp_encap : 0;
 }
 #else
 static inline void psp_sk_assoc_free(struct sock *sk) { }
-- 
2.56.0.385.gac671c819a-goog