Re: [PATCH net v2] net/tcp-ao: don't dereference NULL current_key/rnext_key

On Wed, 9 Sept 2026 at 05:44, Kuniyuki Iwashima [off-list ref] wrote:

On Tue, Sep 8, 2026 at 9:31 PM Dmitry Safonov [off-list ref] wrote:

quoted

Hi Xiang,

Thanks for your report and the proposed fix.
I remember I wanted to write tests for re-connect() on the same
socket, but never found time for this, as it's not really used in BGP,
as far as I'm aware.

[..]

quoted

quoted

--- a/net/ipv4/tcp_ao.c
+++ b/net/ipv4/tcp_ao.c

@@ -857,6 +857,8 @@ int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb,
                        return -ENOENT;
                *traffic_key = snd_other_key(*key);
                rnext_key = READ_ONCE(ao_info->rnext_key);
+               if (!rnext_key)
+                       return -ENOENT;

I think this is quite a big hammer to fix the re-connect() issue.
In theory, we could even restrict connect()/listen() after TCP_CLOSE,

As there were too many rehash issues, we disallowed it.

8cc3aef0cb19 tcp: Do not allow buggy transitions between ehash and lhash2.

Thanks, that makes sense! Two tricky-to-handle corner cases that no
one uses less to have in mind :-)

quoted

but I think I have an idea how to address it "properly".

I have a draft of a patch; I'll test it today and send it for review.

quoted

                *keyid = rnext_key->rcvid;
                *sne = tcp_ao_compute_sne(READ_ONCE(ao_info->snd_sne),
                                          snd_basis, seq);

Thanks,
             Dmitry