From: Greg Kroah-Hartman Date: Thu, 2 Jul 2026 14:43:25 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v5.10.260~17 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0c7797be530aafd77392ac811bb6f657a75d9ff6;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch --- diff --git a/queue-6.18/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch b/queue-6.18/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch new file mode 100644 index 0000000000..d3c0336854 --- /dev/null +++ b/queue-6.18/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch @@ -0,0 +1,47 @@ +From 5ba9950bc9078e19b69cca1e56d1553b125c6857 Mon Sep 17 00:00:00 2001 +From: HanQuan +Date: Tue, 23 Jun 2026 01:52:08 +0000 +Subject: net/tcp-ao: fix use-after-free of key in del_async path + +From: HanQuan + +commit 5ba9950bc9078e19b69cca1e56d1553b125c6857 upstream. + +In tcp_ao_delete_key(), the del_async path skips the current_key +and rnext_key validity checks present in the synchronous path, +assuming these pointers are always NULL on LISTEN sockets. However, +if a key was added with set_current=1/set_rnext=1 while the socket +was in CLOSE state, current_key and rnext_key will be non-NULL +after listen() transitions the socket to LISTEN. + +When such a key is deleted with del_async=1, hlist_del_rcu() and +call_rcu() free the key without clearing the dangling pointers. +After the RCU grace period, getsockopt(TCP_AO_INFO) dereferences +current_key->sndid and rnext_key->rcvid from freed slab memory. + +Clear current_key and rnext_key in the del_async path when they +reference the key being deleted. + +Fixes: d6732b95b6fb ("net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs)") +Signed-off-by: HanQuan +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20260623015208.1191687-1-eilaimemedsnaimel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_ao.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/ipv4/tcp_ao.c ++++ b/net/ipv4/tcp_ao.c +@@ -1776,6 +1776,10 @@ static int tcp_ao_delete_key(struct sock + * them and we can just free all resources in RCU fashion. + */ + if (del_async) { ++ if (ao_info->current_key == key) ++ WRITE_ONCE(ao_info->current_key, NULL); ++ if (ao_info->rnext_key == key) ++ WRITE_ONCE(ao_info->rnext_key, NULL); + atomic_sub(tcp_ao_sizeof_key(key), &sk->sk_omem_alloc); + call_rcu(&key->rcu, tcp_ao_key_free_rcu); + return 0; diff --git a/queue-6.18/series b/queue-6.18/series index 2c5c0d4d4a..3cc0d625d4 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -104,3 +104,4 @@ nfsv4-clear-exception-state-on-successful-mkdir-retry.patch nfs-prevent-resource-leak-in-nfs_alloc_server.patch ksmbd-fix-out-of-bounds-read-in-smb_check_perm_dacl.patch serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch +net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch