Re: [PATCH ipsec v2] xfrm: espintcp: reorder operations within espintcp_init_sk

[Steffen Klassert <steffen.klassert@secunet.com>]

On Thu, Oct 08, 2026 at 02:38:32PM +0200, Sabrina Dubroca wrote:
> When enabled on a socket, espintcp sets the socket callbacks to its
> own before it has finished setting up its context and published it as
> icsk_ulp_data. Any one of those callbacks that gets called before will
> dereference a NULL icsk_ulp_data.
> 
> Fix this by reording the operations, and add memory barriers to ensure
> callers will have a struct espintcp_ctx available. Add a few
> WRITE_ONCE/READ_ONCE too while we're there.
> 
> Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
> Cc: stable@vger.kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Reported-by: Peihan Liu <ronbogo@outlook.com>
> Reported-by: Yilin Zhu <zylzyl2333@gmail.com>
> Reported-by: Ren Wei <n05ec@lzu.edu.cn>
> Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
> Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
> Link: https://lore.kernel.org/all/c30b645074a1b379e0f7fe297f917c66137d9964.1778464688.git.zylzyl2333@gmail.com/
> Link: https://lore.kernel.org/all/20260819155349.3555804-1-jjy600901@snu.ac.kr
> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>

Applied, thanks a lot Sabrina!