Re: [PATCH net v2] tcp: fix AO info use-after-free in tcp_ao_connect_init()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Tue, 25 Aug 2026 15:20:33 +0800 you wrote:
> tcp_v4_connect() adds a SYN-SENT socket to the ehash before calling
> tcp_connect().  If TCP-AO is configured, tcp_connect() first verifies that
> a key matches the peer and the bound device's current L3 master.
> tcp_ao_connect_init() later resolves the L3 master again and removes keys
> which do not match it.
> 
> The socket lock does not stabilize the bound device's VRF membership.
> Detaching the device from its VRF between the initial validation and the
> L3-master calculation in tcp_ao_connect_init() can therefore make the
> validation succeed while initialization observes the default L3 domain and
> removes the only key.  The subsequent AO lookup then fails, so the no-key
> path clears tp->ao_info and frees it directly.
> 
> [...]

Here is the summary with links:
  - [net,v2] tcp: fix AO info use-after-free in tcp_ao_connect_init()
    https://git.kernel.org/netdev/net/c/ea30dc5267e3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html