diff options
| author | Sabrina Dubroca <sd@queasysnail.net> | 2026-07-16 22:54:59 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-02 14:26:43 +0200 |
| commit | 29121c5e6591da527e8e36ddac7120dc527f574d (patch) | |
| tree | d4f1816eedb4ed6c598fc5380b570f69fc31a220 | |
| parent | c494c5562ca69b61a82f566e3b87a445d2c28929 (diff) | |
| download | linux-stable-29121c5e6591da527e8e36ddac7120dc527f574d.tar.gz linux-stable-29121c5e6591da527e8e36ddac7120dc527f574d.zip | |
xfrm: espintcp: fix UAF during close
commit deb232e884877bf10b4ce2580909eedec986c284 upstream.
ZDI reported and analyzed a race condition during close for espintcp
sockets:
espintcp_close() frees emsg->skb via kfree_skb() without holding
any socket lock. Concurrently, the xfrm_trans_reinject work queue
invokes esp_output_tcp_finish() -> espintcp_push_skb() ->
espintcp_push_msgs() -> skb_send_sock_locked(), which reads the
same skb as a data source.
Fix this by adding a synchronize_rcu() call after resetting sk_prot,
since esp_output_tcp_finish() runs under RCU and won't use a socket
with sk_prot == &tcp_prot. Simply taking the socket lock in
espintcp_close() could lead to leaks, if esp_output_tcp_finish()
re-adds an skb in the slot we just freed. After this, the existing
barrier() is no longer needed.
Cc: stable@vger.kernel.org
Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Reported-by: zdi-disclosures@trendmicro.com
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/xfrm/espintcp.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c index 6fb89a83d363..eca1b4838a10 100644 --- a/net/xfrm/espintcp.c +++ b/net/xfrm/espintcp.c @@ -506,7 +506,8 @@ static void espintcp_close(struct sock *sk, long timeout) strp_stop(&ctx->strp); sk->sk_prot = &tcp_prot; - barrier(); + + synchronize_rcu(); cancel_work_sync(&ctx->work); strp_done(&ctx->strp); |