Re: [PATCH v1 net-next 1/2] psp: Check pas->tx.spi in psp_sk_overhead().

["Daniel Zahka" <daniel.zahka@gmail.com>]

On Mon Nov 2, 2026 at 7:06 PM EST, Kuniyuki Iwashima wrote:
> The next patch moves psp_sk_overhead(sk) from icsk->icsk_ext_hdr_len
> to __tcp_mtu_to_mss() and tcp_mss_to_mtu(), which can be called
> between psp_sock_assoc_set_rx() and psp_sock_set_tx_key() while Tx
> packets are still sent in cleartext.
>
> Currently, psp_sk_overhead() only checks if sk->psp_assoc is set,
> and even without the next patch, if ipv6_update_options() is called
> between psp_sock_assoc_set_rx() and psp_sock_set_tx_key(),
> psp_sk_overhead(sk) is added to icsk->icsk_ext_hdr_len twice.
>
> Let's check pas->tx.spi in psp_sk_overhead().
>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> ---
> not worth backporting, no one does that, only theoretical issue.
> ---
>  include/net/psp/functions.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/include/net/psp/functions.h b/include/net/psp/functions.h
> index b23c30898389..410adb6718c1 100644
> --- a/include/net/psp/functions.h
> +++ b/include/net/psp/functions.h
> @@ -145,9 +145,9 @@ static inline struct psp_assoc *psp_skb_get_assoc_rcu(struct sk_buff *skb)
>  static inline unsigned int psp_sk_overhead(const struct sock *sk)
>  {
>  	int psp_encap = sizeof(struct udphdr) + PSP_HDR_SIZE + PSP_TRL_SIZE;
> -	bool has_psp = rcu_access_pointer(sk->psp_assoc);
> +	struct psp_assoc *pas = psp_sk_assoc(sk);
>  
> -	return has_psp ? psp_encap : 0;
> +	return pas && pas->tx.spi ? psp_encap : 0;
>  }
>  #else
>  static inline void psp_sk_assoc_free(struct sock *sk) { }

Reviewed-by: Daniel Zahka <daniel.zahka@gmail.com>