net: psp: don't assume reply skbs will have a socket

Rx path may be passing around unreferenced sockets, which means
that skb_set_owner_edemux() may not set skb->sk and PSP will crash:

  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:psp_reply_set_decrypted (./include/net/psp/functions.h:132 net/psp/psp_sock.c:287)
    tcp_v6_send_response.constprop.0 (net/ipv6/tcp_ipv6.c:979)
    tcp_v6_send_reset (net/ipv6/tcp_ipv6.c:1140 (discriminator 1))
    tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1683)
    tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1912)

Fixes: 659a2899a57d ("tcp: add datapath logic for PSP with inline key exchange")
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251001022426.2592750-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/net/psp/functions.h b/include/net/psp/functions.h
index ef7743664da390fa3d9bc856fb1822e649aa498b..c5c23a54774e6dbbc999e78d53611a3af74f8755 100644 (file)
--- a/include/net/psp/functions.h
+++ b/include/net/psp/functions.h
@@ -34,7 +34,7 @@ unsigned int psp_key_size(u32 version);
 void psp_sk_assoc_free(struct sock *sk);
 void psp_twsk_init(struct inet_timewait_sock *tw, const struct sock *sk);
 void psp_twsk_assoc_free(struct inet_timewait_sock *tw);
-void psp_reply_set_decrypted(struct sk_buff *skb);
+void psp_reply_set_decrypted(const struct sock *sk, struct sk_buff *skb);
 
 static inline struct psp_assoc *psp_sk_assoc(const struct sock *sk)
 {
@@ -160,7 +160,7 @@ static inline void
 psp_twsk_init(struct inet_timewait_sock *tw, const struct sock *sk) { }
 static inline void psp_twsk_assoc_free(struct inet_timewait_sock *tw) { }
 static inline void
-psp_reply_set_decrypted(struct sk_buff *skb) { }
+psp_reply_set_decrypted(const struct sock *sk, struct sk_buff *skb) { }
 
 static inline struct psp_assoc *psp_sk_assoc(const struct sock *sk)
 {

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 5ca97ede979cdb110f0ccffcfd5b1cf927c70465..ff11d3a85a3628fbde72d1657b6b6124981ac614 100644 (file)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1668,7 +1668,7 @@ void ip_send_unicast_reply(struct sock *sk, const struct sock *orig_sk,
                nskb->ip_summed = CHECKSUM_NONE;
                if (orig_sk) {
                        skb_set_owner_edemux(nskb, (struct sock *)orig_sk);
-                       psp_reply_set_decrypted(nskb);
+                       psp_reply_set_decrypted(orig_sk, nskb);
                }
                if (transmit_time)
                        nskb->tstamp_type = SKB_CLOCK_MONOTONIC;

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 9622c2776ade70e665a5bf730d2c9f762a4857c1..59c4977a811a0d54bde8fb67a227d791d8ad0a0b 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -974,7 +974,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
        if (sk) {
                /* unconstify the socket only to attach it to buff with care. */
                skb_set_owner_edemux(buff, (struct sock *)sk);
-               psp_reply_set_decrypted(buff);
+               psp_reply_set_decrypted(sk, buff);
 
                if (sk->sk_state == TCP_TIME_WAIT)
                        mark = inet_twsk(sk)->tw_mark;

diff --git a/net/psp/psp_sock.c b/net/psp/psp_sock.c
index 5324a7603bed64d3f1f71b66dd44f622048519a6..a931d825d1cc4ad50f9ba3af3e4effee6cee1a3a 100644 (file)
--- a/net/psp/psp_sock.c
+++ b/net/psp/psp_sock.c
@@ -279,12 +279,12 @@ void psp_twsk_assoc_free(struct inet_timewait_sock *tw)
        psp_assoc_put(pas);
 }
 
-void psp_reply_set_decrypted(struct sk_buff *skb)
+void psp_reply_set_decrypted(const struct sock *sk, struct sk_buff *skb)
 {
        struct psp_assoc *pas;
 
        rcu_read_lock();
-       pas = psp_sk_get_assoc_rcu(skb->sk);
+       pas = psp_sk_get_assoc_rcu(sk);
        if (pas && pas->tx.spi)
                skb->decrypted = 1;
        rcu_read_unlock();