6.18-stable patches

added patches:
	net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch

diff --git a/queue-6.18/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch b/queue-6.18/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch
new file mode 100644 (file)
index 0000000..d3c0336
--- /dev/null
+++ b/queue-6.18/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch
@@ -0,0 +1,47 @@
+From 5ba9950bc9078e19b69cca1e56d1553b125c6857 Mon Sep 17 00:00:00 2001
+From: HanQuan <eilaimemedsnaimel@gmail.com>
+Date: Tue, 23 Jun 2026 01:52:08 +0000
+Subject: net/tcp-ao: fix use-after-free of key in del_async path
+
+From: HanQuan <eilaimemedsnaimel@gmail.com>
+
+commit 5ba9950bc9078e19b69cca1e56d1553b125c6857 upstream.
+
+In tcp_ao_delete_key(), the del_async path skips the current_key
+and rnext_key validity checks present in the synchronous path,
+assuming these pointers are always NULL on LISTEN sockets.  However,
+if a key was added with set_current=1/set_rnext=1 while the socket
+was in CLOSE state, current_key and rnext_key will be non-NULL
+after listen() transitions the socket to LISTEN.
+
+When such a key is deleted with del_async=1, hlist_del_rcu() and
+call_rcu() free the key without clearing the dangling pointers.
+After the RCU grace period, getsockopt(TCP_AO_INFO) dereferences
+current_key->sndid and rnext_key->rcvid from freed slab memory.
+
+Clear current_key and rnext_key in the del_async path when they
+reference the key being deleted.
+
+Fixes: d6732b95b6fb ("net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs)")
+Signed-off-by: HanQuan <eilaimemedsnaimel@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260623015208.1191687-1-eilaimemedsnaimel@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_ao.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/ipv4/tcp_ao.c
++++ b/net/ipv4/tcp_ao.c
+@@ -1776,6 +1776,10 @@ static int tcp_ao_delete_key(struct sock
+        * them and we can just free all resources in RCU fashion.
+        */
+       if (del_async) {
++              if (ao_info->current_key == key)
++                      WRITE_ONCE(ao_info->current_key, NULL);
++              if (ao_info->rnext_key == key)
++                      WRITE_ONCE(ao_info->rnext_key, NULL);
+               atomic_sub(tcp_ao_sizeof_key(key), &sk->sk_omem_alloc);
+               call_rcu(&key->rcu, tcp_ao_key_free_rcu);
+               return 0;

diff --git a/queue-6.18/series b/queue-6.18/series
index 2c5c0d4d4a389e530b6061f5aca8bffe2b144461..3cc0d625d40ee1bbd33745a14f0328e78eab27f1 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -104,3 +104,4 @@ nfsv4-clear-exception-state-on-successful-mkdir-retry.patch
 nfs-prevent-resource-leak-in-nfs_alloc_server.patch
 ksmbd-fix-out-of-bounds-read-in-smb_check_perm_dacl.patch
 serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch
+net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch