Re: [PATCH net] net: psp: do not inherit the Rx association on clone

[Paolo Abeni]

On 9/1/26 2:28 PM, Daniel Zahka wrote:
> On Tue Sep 1, 2026 at 6:01 AM EDT, Paolo Abeni wrote:
>> On 8/29/26 6:56 PM, Norbert Szetei wrote:
>>> sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into
>>> every socket accepted from a listener without taking a reference, while
>>> inet_sock_destruct() puts for every inet socket. psp_twsk_init() does
>>> refcount_inc() for the timewait socket, so a child closing through
>>> TIME_WAIT cancels its own put and leaves the association with one
>>> reference and N timewait sockets holding the same pointer. Closing the
>>> listener frees it, and the timewait timers then put freed memory.
>>>
>>> Rejecting the association on a listening socket is not sufficient: a socket
>>> can acquire one while established and then be turned back into a listener,
>>> because tcp_disconnect() leaves sk->psp_assoc in place.
>>
>> So rejecting the association on listener, and clearing on disconnect
>> would be enough, right?
> 
> I think that would solve this problem with sk_clone(), but clearing out
> the psp_assoc from the sk anywhere other than the socket destructor
> makes me nervous because of the risk of leaking cleartext to the
> network, or admitting cleartext the receive queue.
> 
> Specifically about tcp_disconnect(), the write queue purge won't save us
> from skbs already queued to the device. 

Ah, right, I did not take in account this path. Makes sense.

/P