From: Dmitry Safonov <0x7f454c46@gmail.com> Date: Thu, 25 Jun 2026 18:21:41 +0000 (+0100) Subject: tcp: Decrement tcp_md5_needed static branch X-Git-Tag: v7.2-rc2~22^2~24^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6f6e860e370c9e4e919b92118a25e9e1f82e9180;p=thirdparty%2Fkernel%2Fstable.git tcp: Decrement tcp_md5_needed static branch In case of early freeing an unwanted TCP-MD5 key on TCP-AO connect(), md5sig_info is freed right away (and set to NULL). Later, at the moment of socket destruction, the static branch counter is not getting decremented. Add a missing decrement for TCP-MD5 static branch. Reported-by: Qihang Fixes: 0aadc73995d0 ("net/tcp: Prevent TCP-MD5 with TCP-AO being set") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Safonov <0x7f454c46@gmail.com> Link: https://patch.msgid.link/20260625-tcp-md5-connect-v3-3-1fd313d6c1e0@gmail.com Signed-off-by: Jakub Kicinski --- diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index bc03809ca3af..d7c1444b5e30 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -4334,8 +4334,8 @@ int tcp_connect(struct sock *sk) tcp_clear_md5_list(sk); md5sig = rcu_replace_pointer(tp->md5sig_info, NULL, lockdep_sock_is_held(sk)); - if (md5sig) - kfree_rcu(md5sig, rcu); + kfree_rcu(md5sig, rcu); + static_branch_slow_dec_deferred(&tcp_md5_needed); } } #endif