6.12-stable patches

added patches:
	net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch

diff --git a/queue-6.12/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch b/queue-6.12/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch
new file mode 100644 (file)
index 0000000..607d20e
--- /dev/null
+++ b/queue-6.12/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch
@@ -0,0 +1,47 @@
+From 5ba9950bc9078e19b69cca1e56d1553b125c6857 Mon Sep 17 00:00:00 2001
+From: HanQuan <eilaimemedsnaimel@gmail.com>
+Date: Tue, 23 Jun 2026 01:52:08 +0000
+Subject: net/tcp-ao: fix use-after-free of key in del_async path
+
+From: HanQuan <eilaimemedsnaimel@gmail.com>
+
+commit 5ba9950bc9078e19b69cca1e56d1553b125c6857 upstream.
+
+In tcp_ao_delete_key(), the del_async path skips the current_key
+and rnext_key validity checks present in the synchronous path,
+assuming these pointers are always NULL on LISTEN sockets.  However,
+if a key was added with set_current=1/set_rnext=1 while the socket
+was in CLOSE state, current_key and rnext_key will be non-NULL
+after listen() transitions the socket to LISTEN.
+
+When such a key is deleted with del_async=1, hlist_del_rcu() and
+call_rcu() free the key without clearing the dangling pointers.
+After the RCU grace period, getsockopt(TCP_AO_INFO) dereferences
+current_key->sndid and rnext_key->rcvid from freed slab memory.
+
+Clear current_key and rnext_key in the del_async path when they
+reference the key being deleted.
+
+Fixes: d6732b95b6fb ("net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs)")
+Signed-off-by: HanQuan <eilaimemedsnaimel@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260623015208.1191687-1-eilaimemedsnaimel@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_ao.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/ipv4/tcp_ao.c
++++ b/net/ipv4/tcp_ao.c
+@@ -1777,6 +1777,10 @@ static int tcp_ao_delete_key(struct sock
+        * them and we can just free all resources in RCU fashion.
+        */
+       if (del_async) {
++              if (ao_info->current_key == key)
++                      WRITE_ONCE(ao_info->current_key, NULL);
++              if (ao_info->rnext_key == key)
++                      WRITE_ONCE(ao_info->rnext_key, NULL);
+               atomic_sub(tcp_ao_sizeof_key(key), &sk->sk_omem_alloc);
+               call_rcu(&key->rcu, tcp_ao_key_free_rcu);
+               return 0;

diff --git a/queue-6.12/series b/queue-6.12/series
index 1c63f47983f22b8f2e5903552a2b8e0953fbae2a..6bd18a8ace6a2141cd9d80956689b587fc824e88 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -197,3 +197,4 @@ documentation-ioctl-number-extend-include-file-column-width.patch
 crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch
 crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch
 crypto-qat-remove-unused-character-device-and-ioctls.patch
+net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch