linux/net/psp
Jakub Kicinski 7a0f94361f net: psp: don't assume reply skbs will have a socket
Rx path may be passing around unreferenced sockets, which means
that skb_set_owner_edemux() may not set skb->sk and PSP will crash:

  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:psp_reply_set_decrypted (./include/net/psp/functions.h:132 net/psp/psp_sock.c:287)
    tcp_v6_send_response.constprop.0 (net/ipv6/tcp_ipv6.c:979)
    tcp_v6_send_reset (net/ipv6/tcp_ipv6.c:1140 (discriminator 1))
    tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1683)
    tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1912)

Fixes: 659a2899a5 ("tcp: add datapath logic for PSP with inline key exchange")
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251001022426.2592750-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-03 10:23:50 -07:00
..
Kconfig psp: Expand PSP acronym in INET_PSP help description 2025-09-26 13:59:58 -07:00
Makefile net: psp: add socket security association code 2025-09-18 12:32:06 +02:00
psp-nl-gen.c net: psp: add socket security association code 2025-09-18 12:32:06 +02:00
psp-nl-gen.h net: psp: add socket security association code 2025-09-18 12:32:06 +02:00
psp.h psp: rename our psp_dev_destroy() 2025-09-18 07:04:25 -07:00
psp_main.c psp: clarify checksum behavior of psp_dev_rcv() 2025-09-19 17:02:57 -07:00
psp_nl.c psp: track generations of device key 2025-09-18 12:32:06 +02:00
psp_sock.c net: psp: don't assume reply skbs will have a socket 2025-10-03 10:23:50 -07:00