Re: [PATCH net v2] net/tcp-ao: don't dereference NULL current_key/rnext_key

[Dmitry Safonov]

On Wed, 9 Sept 2026 at 05:44, Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> wrote:
>
> On Tue, Sep 8, 2026 at 9:31 PM Dmitry Safonov <0x7f454c46@xxxxxxxxx> wrote:
> >
> > Hi Xiang,
> >
> > Thanks for your report and the proposed fix.
> > I remember I wanted to write tests for re-connect() on the same
> > socket, but never found time for this, as it's not really used in BGP,
> > as far as I'm aware.
> >
[..]
> > > --- a/net/ipv4/tcp_ao.c
> > > +++ b/net/ipv4/tcp_ao.c
> > > @@ -857,6 +857,8 @@ int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb,
> > >                         return -ENOENT;
> > >                 *traffic_key = snd_other_key(*key);
> > >                 rnext_key = READ_ONCE(ao_info->rnext_key);
> > > +               if (!rnext_key)
> > > +                       return -ENOENT;
> >
> > I think this is quite a big hammer to fix the re-connect() issue.
> > In theory, we could even restrict connect()/listen() after TCP_CLOSE,
>
> As there were too many rehash issues, we disallowed it.
>
> 8cc3aef0cb19 tcp: Do not allow buggy transitions between ehash and lhash2.

Thanks, that makes sense! Two tricky-to-handle corner cases that no
one uses less to have in mind :-)

> > but I think I have an idea how to address it "properly".
> >
> > I have a draft of a patch; I'll test it today and send it for review.
> >
> > >                 *keyid = rnext_key->rcvid;
> > >                 *sne = tcp_ao_compute_sne(READ_ONCE(ao_info->snd_sne),
> > >                                           snd_basis, seq);

Thanks,
             Dmitry