Re: [PATCH net v3] selftests: bpf: add test for KTLS+sockmap reverse-order UAF

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 5/11/26 8:41 PM, Xingwang Xiang wrote:
> Add a selftest that reproduces the use-after-free triggered when a TCP
> socket is inserted into a sockmap *before* TLS RX is configured on it
> (the reverse of the order that is already blocked by the kernel).
>
> Vulnerable sequence:
>
>    1. bpf_map_update_elem(sockmap, server_fd)
>       -> sk->sk_data_ready = sk_psock_verdict_data_ready
>
>    2. setsockopt(server_fd, SOL_TLS, TLS_RX, ...)
>       -> tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as
>          rx_ctx->saved_data_ready, then sets
>          sk->sk_data_ready = tls_data_ready
>
> When data arrives:
>    tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready ->
>    saved_data_ready() [= sk_psock_verdict_data_ready] ->
>    tcp_read_skb() drains sk_receive_queue via __skb_unlink() without
>    calling tcp_eat_skb(), so copied_seq is never advanced.
>
>    tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls
>    tcp_recv_skb() on an empty queue, hits WARN_ON_ONCE(!first), and
>    returns with frag_list still pointing at the now psock-owned (or
>    already freed) skb.  tls_decrypt_sg() subsequently walks that stale
>    frag_list: a use-after-free.


Hi Xingwang,

Thanks for your selftest.


I think sockmap + TLS_RX has no useful semantics(fix me if i'm wrong).
sk_skb sees ciphertext and the TLS keys are pinned to this socket, so
redirect is meaningless. And both sides racing on sk_receive_queue is
what produces the UAF.

The fix should be to reject TLS_RX when the socket is already in a sockmap.

Note TLS_TX + sockmap remains useful and unaffected.


---
Please don't send this as a standalone selftest [1]. Without the kernel 
fix, this
patch just lands a reproducer for an exploitable UAF in the tree.
Please send fix + selftest together as a 2-patch series with a proper
cover letter. Also, LLM will give you more details.

[1]: https://docs.kernel.org/process/submitting-patches.html


Thanks.