Re: [PATCH ipsec] xfrm: espintcp: fix UAF during close

2026-07-03, 09:36:42 -0700, Breno Leitao wrote:

Hello Sabrina,

On Fri, Jul 03, 2026 at 04:21:12PM +0200, Sabrina Dubroca wrote:

quoted

diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
index 374e1b964438..f09b5dd85db8 100644
--- a/net/xfrm/espintcp.c
+++ b/net/xfrm/espintcp.c

@@ -517,6 +517,8 @@ static void espintcp_close(struct sock *sk, long timeout)
 	sk->sk_prot = &tcp_prot;
 	barrier();
 
+	synchronize_rcu();

I've got the impression netdev usually prefers synchronize_net() instead
of synchornize_rcu(). Is there any reason for synchronize_net() not
being used here?

I don't think it makes sense here. We're not holding RTNL (those are
just basic userspace TCP sockets), and we're not on the netns exit
path.

Also, given you have a explicit synchronize_rcu() here, should the
barrier() above be dropped?

Ok, I can clean that up in v2.

-- 
Sabrina