Re: [PATCH net] tls: restore sk_prot before calling original destructor
From: Geliang Tang <geliang@kernel.org>
Date: 2026-06-08 03:24:36
Also in:
mptcp
On Fri, 2026-06-05 at 20:57 +0800, Geliang Tang wrote:
From: Geliang Tang <redacted>
When a TLS socket is offloaded to a TOE device, tls_toe_bypass()
replaces
sk->sk_prot with a TLS-specific protocol table. On socket
destruction,
tls_toe_sk_destruct() calls the original sk_destruct callback
(ctx->sk_destruct), which may rely on the original sk_prot (e.g., for
memory accounting or close handling). Without restoring sk->sk_prot
before calling ctx->sk_destruct, the destructor may access stale or
incorrect protocol functions, leading to use-after-free or kernel
panic.
Add WRITE_ONCE(sk->sk_prot, ctx->sk_proto) before invoking
ctx->sk_destruct to restore the original protocol pointer. This
mirrors
the restoration already done in tls_sk_proto_close() for the software
and device offload paths.
Fixes: 76f7164d02d4 ("net/tls: free ctx in sock destruct")
Sorry, this "Fixes" tag is not accurate. sk_proto was only added to
struct tls_context in commit 32857cf57f92, so it would be better to
update the "Fixes" tag as follows:
Fixes: 32857cf57f92 ("net/tls: fix transition through disconnect with
close")
If needed, I can send a v2.
Thanks,
-Geliang
quoted hunk ↗ jump to hunk
Co-developed-by: Gang Yan <redacted> Signed-off-by: Gang Yan <redacted> Signed-off-by: Geliang Tang <redacted> --- Hi, This bug was identified by Sashiko during my development of "MPTCP KTLS support" [1]. I am sending this fix separately for now. Thanks, -Geliang [1] https://patchwork.kernel.org/project/mptcp/cover/cover.1780621326.git.tanggeliang@kylinos.cn/ --- net/tls/tls_toe.c | 2 ++ 1 file changed, 2 insertions(+)diff --git a/net/tls/tls_toe.c b/net/tls/tls_toe.c index 825669e1ab47..c9c1a0952f4b 100644 --- a/net/tls/tls_toe.c +++ b/net/tls/tls_toe.c@@ -48,6 +48,8 @@ static void tls_toe_sk_destruct(struct sock *sk)struct inet_connection_sock *icsk = inet_csk(sk); struct tls_context *ctx = tls_get_ctx(sk); + WRITE_ONCE(sk->sk_prot, ctx->sk_proto); + ctx->sk_destruct(sk); /* Free ctx */ rcu_assign_pointer(icsk->icsk_ulp_data, NULL);