Re: [PATCH ipsec] xfrm: espintcp: fix UAF during close

[Sabrina Dubroca <sd@queasysnail.net>]

2026-07-03, 09:36:42 -0700, Breno Leitao wrote:
> Hello Sabrina,
> 
> On Fri, Jul 03, 2026 at 04:21:12PM +0200, Sabrina Dubroca wrote:
> > diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
> > index 374e1b964438..f09b5dd85db8 100644
> > --- a/net/xfrm/espintcp.c
> > +++ b/net/xfrm/espintcp.c
> > @@ -517,6 +517,8 @@ static void espintcp_close(struct sock *sk, long timeout)
> >  	sk->sk_prot = &tcp_prot;
> >  	barrier();
> >  
> > +	synchronize_rcu();
> 
> I've got the impression netdev usually prefers synchronize_net() instead
> of synchornize_rcu(). Is there any reason for synchronize_net() not
> being used here?

I don't think it makes sense here. We're not holding RTNL (those are
just basic userspace TCP sockets), and we're not on the netns exit
path.

> Also, given you have a explicit synchronize_rcu() here, should the
> barrier() above be dropped?

Ok, I can clean that up in v2.

-- 
Sabrina