Re: [PATCH net v2] tls: fix RX desync on overlapping skbs

[Maximilian Immanuel Brandtner <maxbr@linux.ibm.com>]

I just saw that for the v2 of this patch sashiko reported a supposed
potential null dereference which I believe to be an erroneous finding.

Sashiko claims that in tls_strp_check_queue_ok() after first =
skb_shinfo(strp->anchor)->frag_list; first may be NULL which would
result in a null dereference on seq = TCP_SKB_CB(first)->seq;

tls_strp_check_queue_ok(strp, TLS_HEADER_SIZE) is only called if inq >=
TLS_HEADER_SIZE. tcp_inq() counts real payload bytes so [copied_seq,
rcv_nxt) holds at least TLS_HEADER_SIZE bytes which live in sk-
>sk_receive_queue. tcp_recv_skb(sk, copied_seq) returns the skb
covering copied_seq. tls_strp_load_anchor_with_queue() stores it in
anchor->frag_list.

Therefore, skb_shinfo(strp->anchor)->frag_list != NULL for the check
introduced by this patch.

Kind regards,
Max Brandtner