Re: [PATCH net-next v6 09/19] net: psp: update the TCP MSS to reflect PSP packet overhead

On 8/14/25 9:58 AM, Paolo Abeni wrote:

On 8/12/25 2:29 AM, Daniel Zahka wrote:

quoted

@@ -236,6 +237,10 @@ int psp_sock_assoc_set_tx(struct sock *sk, struct psp_dev *psd,
  	tcp_write_collapse_fence(sk);
  	pas->upgrade_seq = tcp_sk(sk)->rcv_nxt;
  
+	icsk = inet_csk(sk);
+	icsk->icsk_ext_hdr_len += psp_sk_overhead(sk);

I'm likely lost, but AFAICS the user-space can successfully call
multiple times psp_sock_assoc_set_tx() on the same socket, increasing
icsk->icsk_ext_hdr_len in an unbounded way.

If it were possible to execute the code you have highlighted more than 
once per socket, that would be a bug. This should not be possible 
because of the preceding checks in the function i.e.

     if (pas->tx.spi) {
         NL_SET_ERR_MSG(extack, "Tx key already set");
         err = -EBUSY;
         goto exit_unlock;
     }