From: Greg Kroah-Hartman Date: Thu, 2 Jul 2026 14:43:17 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v5.10.260~18 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9aca16cc9c304b52b5e15eb6faa64565e326e63f;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch --- diff --git a/queue-6.12/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch b/queue-6.12/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch new file mode 100644 index 0000000000..607d20e03c --- /dev/null +++ b/queue-6.12/net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch @@ -0,0 +1,47 @@ +From 5ba9950bc9078e19b69cca1e56d1553b125c6857 Mon Sep 17 00:00:00 2001 +From: HanQuan +Date: Tue, 23 Jun 2026 01:52:08 +0000 +Subject: net/tcp-ao: fix use-after-free of key in del_async path + +From: HanQuan + +commit 5ba9950bc9078e19b69cca1e56d1553b125c6857 upstream. + +In tcp_ao_delete_key(), the del_async path skips the current_key +and rnext_key validity checks present in the synchronous path, +assuming these pointers are always NULL on LISTEN sockets. However, +if a key was added with set_current=1/set_rnext=1 while the socket +was in CLOSE state, current_key and rnext_key will be non-NULL +after listen() transitions the socket to LISTEN. + +When such a key is deleted with del_async=1, hlist_del_rcu() and +call_rcu() free the key without clearing the dangling pointers. +After the RCU grace period, getsockopt(TCP_AO_INFO) dereferences +current_key->sndid and rnext_key->rcvid from freed slab memory. + +Clear current_key and rnext_key in the del_async path when they +reference the key being deleted. + +Fixes: d6732b95b6fb ("net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs)") +Signed-off-by: HanQuan +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20260623015208.1191687-1-eilaimemedsnaimel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_ao.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/ipv4/tcp_ao.c ++++ b/net/ipv4/tcp_ao.c +@@ -1777,6 +1777,10 @@ static int tcp_ao_delete_key(struct sock + * them and we can just free all resources in RCU fashion. + */ + if (del_async) { ++ if (ao_info->current_key == key) ++ WRITE_ONCE(ao_info->current_key, NULL); ++ if (ao_info->rnext_key == key) ++ WRITE_ONCE(ao_info->rnext_key, NULL); + atomic_sub(tcp_ao_sizeof_key(key), &sk->sk_omem_alloc); + call_rcu(&key->rcu, tcp_ao_key_free_rcu); + return 0; diff --git a/queue-6.12/series b/queue-6.12/series index 1c63f47983..6bd18a8ace 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -197,3 +197,4 @@ documentation-ioctl-number-extend-include-file-column-width.patch crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch crypto-qat-remove-unused-character-device-and-ioctls.patch +net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch