Re: [PATCH net-next v2 1/2] tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct()

[Dmitry Safonov]

Hi Eric,

On Thu, Aug 28, 2025 at 8:43 PM Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
>
> On Thu, Aug 28, 2025 at 1:15 AM Dmitry Safonov via B4 Relay
> <devnull+dima.arista.com@xxxxxxxxxx> wrote:
...
> > +void tcp_md5_destruct_sock(struct sock *sk)
> > +{
> > +       struct tcp_sock *tp = tcp_sk(sk);
> > +
> > +       if (tp->md5sig_info) {
> > +               struct tcp_md5sig_info *md5sig;
> > +
> > +               md5sig = rcu_dereference_protected(tp->md5sig_info, 1);
> > +               tcp_clear_md5_list(sk);
> > +               call_rcu(&md5sig->rcu, tcp_md5sig_info_free_rcu);
> > +               rcu_assign_pointer(tp->md5sig_info, NULL);
>
> I would move this line before call_rcu(&md5sig->rcu, tcp_md5sig_info_free_rcu),
> otherwise the free could happen before the clear, and an UAF could occur.

Good catch! I'll reorder these in v3 just in case the next patch 2/2
would have to be reverted for any reason.

> It is not absolutely clear if this function runs under rcu_read_lock(),
> and even if it is currently safe, this could change in the future.
>
> Other than that :
>
> Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>

Thanks,
            Dmitry