Re: [PATCH ipsec] xfrm: espintcp: fix UAF during close
From: Breno Leitao <leitao@debian.org>
Date: 2026-07-03 16:36:51
Also in:
stable
Hello Sabrina, On Fri, Jul 03, 2026 at 04:21:12PM +0200, Sabrina Dubroca wrote:
quoted hunk ↗ jump to hunk
diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c index 374e1b964438..f09b5dd85db8 100644 --- a/net/xfrm/espintcp.c +++ b/net/xfrm/espintcp.c@@ -517,6 +517,8 @@ static void espintcp_close(struct sock *sk, long timeout) sk->sk_prot = &tcp_prot; barrier(); + synchronize_rcu();
I've got the impression netdev usually prefers synchronize_net() instead of synchornize_rcu(). Is there any reason for synchronize_net() not being used here? Also, given you have a explicit synchronize_rcu() here, should the barrier() above be dropped?