Jakub Kicinski 7a0f94361f net: psp: don't assume reply skbs will have a socket ... Rx path may be passing around unreferenced sockets, which means that skb_set_owner_edemux() may not set skb->sk and PSP will crash: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:psp_reply_set_decrypted (./include/net/psp/functions.h:132 net/psp/psp_sock.c:287) tcp_v6_send_response.constprop.0 (net/ipv6/tcp_ipv6.c:979) tcp_v6_send_reset (net/ipv6/tcp_ipv6.c:1140 (discriminator 1)) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1683) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1912) Fixes: 659a2899a5 ("tcp: add datapath logic for PSP with inline key exchange") Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20251001022426.2592750-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2025-10-03 10:23:50 -07:00
..
9p	…
bluetooth	Bluetooth: Avoid a couple dozen -Wflex-array-member-not-at-end warnings	2025-09-27 11:37:43 -04:00
caif	…
iucv	…
libeth	xdp, libeth: make the xdp_init_buff() micro-optimization generic	2025-09-08 10:26:25 -07:00
mana	net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.	2025-08-19 14:42:44 +02:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-09-11 17:40:13 -07:00
netns	tcp: accecn: AccECN option send control	2025-09-18 08:47:52 +02:00
nfc	net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms	2025-09-03 17:02:12 -07:00
page_pool	net: add helper to pre-check if PP for an Rx queue will be unreadable	2025-09-04 10:19:17 +02:00
phonet	…
psp	net: psp: don't assume reply skbs will have a socket	2025-10-03 10:23:50 -07:00
sctp	sctp: Convert cookie authentication to use HMAC-SHA256	2025-08-19 19:36:26 -07:00
tc_act	net_sched: act_skbmod: use RCU in tcf_skbmod_dump()	2025-08-28 16:46:23 -07:00
6lowpan.h	…
Space.h	…
act_api.h	net_sched: act: remove tcfa_qstats	2025-09-02 15:52:24 -07:00
addrconf.h	…
af_ieee802154.h	…
af_rxrpc.h	…
af_unix.h	af_unix: Introduce SO_INQ.	2025-07-08 18:05:25 -07:00
af_vsock.h	vsock: fix `vsock_proto` declaration	2025-07-07 16:55:54 -07:00
ah.h	…
aligned_data.h	udp: move udp_memory_allocated into net_aligned_data	2025-07-02 14:22:02 -07:00
amt.h	…
arp.h	…
atmclip.h	…
ax25.h	…
ax88796.h	…
bareudp.h	…
bond_3ad.h	bonding: support aggregator selection based on port priority	2025-09-09 10:56:02 +02:00
bond_alb.h	…
bond_options.h	bonding: add support for per-port LACP actor priority	2025-09-09 10:56:02 +02:00
bonding.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-10-01 10:14:49 +02:00
bpf_sk_storage.h	…
busy_poll.h	…
calipso.h	…
cfg80211-wext.h	…
cfg80211.h	wifi: cfg80211: remove IEEE80211_CHAN_{1,2,4,8,16}MHZ flags	2025-09-22 09:03:14 +02:00
cfg802154.h	…
checksum.h	net: Fix checksum update for ILA adj-transport	2025-05-30 19:53:51 -07:00
cipso_ipv4.h	…
cls_cgroup.h	net/cls_cgroup: Fix task_get_classid() during qdisc run	2025-09-14 11:55:04 -07:00
codel.h	…
codel_impl.h	…
codel_qdisc.h	…
compat.h	…
datalink.h	…
dcbevent.h	…
dcbnl.h	…
devlink.h	devlink: Add a 'num_doorbells' driverinit param	2025-09-17 18:30:51 -07:00
dropreason-core.h	tcp: add datapath logic for PSP with inline key exchange	2025-09-18 12:32:06 +02:00
dropreason.h	…
dsa.h	net: dsa: tag_brcm: add support for legacy FCS tags	2025-06-17 17:52:01 -07:00
dsa_stubs.h	…
dscp.h	…
dsfield.h	…
dst.h	net: dst: introduce dst->dev_rcu	2025-08-29 19:36:31 -07:00
dst_cache.h	…
dst_metadata.h	net: dst_metadata: fix IP_DF bit not extracted from tunnel headers	2025-09-14 14:28:12 -07:00
dst_ops.h	…
eee.h	…
erspan.h	…
esp.h	…
espintcp.h	…
ethoc.h	…
failover.h	…
fib_notifier.h	…
fib_rules.h	…
firewire.h	…
flow.h	ipv4: Convert ->flowi4_tos to dscp_t.	2025-08-26 17:34:31 -07:00
flow_dissector.h	…
flow_offload.h	…
fou.h	…
fq.h	…
fq_impl.h	…
garp.h	…
gen_stats.h	…
genetlink.h	genetlink: fix typo in comment	2025-09-03 15:16:49 -07:00
geneve.h	…
gre.h	…
gro.h	net: gro: remove unnecessary df checks	2025-09-25 12:42:49 +02:00
gro_cells.h	…
gso.h	…
gtp.h	…
gue.h	…
handshake.h	…
hotdata.h	net: add NUMA awareness to skb_attempt_defer_free()	2025-09-30 15:45:53 +02:00
hwbm.h	…
icmp.h	ipv4: icmp: Pass IPv4 control block structure as an argument to __icmp_send()	2025-09-11 12:22:38 +02:00
ieee8021q.h	…
ieee80211_radiotap.h	…
ieee802154_netdev.h	…
if_inet6.h	…
ife.h	…
inet6_connection_sock.h	…
inet6_hashtables.h	tcp: Remove inet6_hash().	2025-09-22 11:38:43 -07:00
inet_common.h	…
inet_connection_sock.h	tcp: Update bind bucket state on port release	2025-09-23 10:12:15 +02:00
inet_dscp.h	ipv4: Convert ->flowi4_tos to dscp_t.	2025-08-26 17:34:31 -07:00
inet_ecn.h	…
inet_frag.h	…
inet_hashtables.h	tcp: Update bind bucket state on port release	2025-09-23 10:12:15 +02:00
inet_sock.h	…
inet_timewait_sock.h	tcp: Update bind bucket state on port release	2025-09-23 10:12:15 +02:00
inetpeer.h	…
ioam6.h	…
ip.h	net: snmp: remove SNMP_MIB_SENTINEL	2025-09-08 18:06:21 -07:00
ip6_checksum.h	…
ip6_fib.h	…
ip6_route.h	ipv6: make ipv6_pinfo.daddr_cache a boolean	2025-09-18 10:17:09 +02:00
ip6_tunnel.h	ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers	2025-07-02 14:32:30 -07:00
ip_fib.h	ipv4: Convert ->flowi4_tos to dscp_t.	2025-08-26 17:34:31 -07:00
ip_tunnels.h	ipv4: Convert ->flowi4_tos to dscp_t.	2025-08-26 17:34:31 -07:00
ip_vs.h	ipvs: Fix estimator kthreads preferred affinity	2025-08-13 08:34:33 +02:00
ipcomp.h	…
ipconfig.h	…
ipv6.h	…
ipv6_frag.h	…
ipv6_stubs.h	…
iw_handler.h	…
kcm.h	net: kcm: Fix race condition in kcm_unattach()	2025-08-13 18:18:33 -07:00
l3mdev.h	…
lag.h	…
lapb.h	…
llc.h	…
llc_c_ac.h	…
llc_c_ev.h	…
llc_c_st.h	…
llc_conn.h	…
llc_if.h	…
llc_pdu.h	…
llc_s_ac.h	…
llc_s_ev.h	…
llc_s_st.h	…
llc_sap.h	…
lwtunnel.h	net: dst: annotate data-races around dst->output	2025-07-02 14:32:30 -07:00
mac80211.h	wifi: mac80211: Export an API to check if NAN is started	2025-09-19 11:26:23 +02:00
mac802154.h	…
macsec.h	…
mctp.h	net: mctp: Allow limiting binds to a peer address	2025-07-15 12:08:39 +02:00
mctpdevice.h	…
mip6.h	…
mld.h	…
mpls.h	…
mpls_iptunnel.h	…
mptcp.h	…
mrp.h	…
ncsi.h	…
ndisc.h	net: replace ND_PRINTK with dynamic debug	2025-07-10 15:27:32 -07:00
neighbour.h	neighbour: Update pneigh_entry in pneigh_create().	2025-07-17 16:25:22 -07:00
neighbour_tables.h	…
net_debug.h	…
net_failover.h	…
net_namespace.h	namespace-6.18-rc1	2025-09-29 11:20:29 -07:00
net_ratelimit.h	…
net_shaper.h	…
net_trackers.h	…
netdev_lock.h	…
netdev_netlink.h	…
netdev_queues.h	net: add helper to pre-check if PP for an Rx queue will be unreadable	2025-09-04 10:19:17 +02:00
netdev_rx_queue.h	…
netevent.h	…
netkit.h	…
netlabel.h	…
netlink.h	netlink: introduce type-checking attribute iteration for nlmsg	2025-07-02 15:39:04 -07:00
netmem.h	netmem, mlx4: access ->pp_ref_count through netmem_desc instead of page	2025-07-23 17:46:54 -07:00
netprio_cgroup.h	…
netrom.h	…
nexthop.h	…
nl802154.h	…
nsh.h	…
pfcp.h	net: pfcp: fix typo in message_priority field name	2025-06-13 18:17:08 -07:00
pie.h	…
ping.h	inet: ping: remove ping_hash()	2025-09-01 13:15:14 -07:00
pkt_cls.h	…
pkt_sched.h	net/sched: sch_qfq: Fix null-deref in agg_dequeue	2025-07-10 11:08:35 +02:00
pptp.h	…
proto_memory.h	net-memcg: Pass struct sock to mem_cgroup_sk_under_memory_pressure().	2025-08-19 19:20:59 -07:00
protocol.h	…
psample.h	…
psnap.h	…
psp.h	psp: base PSP device support	2025-09-18 12:32:06 +02:00
raw.h	net: use NUMA drop counters for softnet_data.dropped	2025-09-14 11:35:17 -07:00
rawv6.h	…
red.h	…
regulatory.h	…
request_sock.h	tcp: reclaim 8 bytes in struct request_sock_queue	2025-09-22 17:55:25 -07:00
rose.h	net: rose: convert 'use' field to refcount_t	2025-08-27 07:43:08 -07:00
route.h	net: use dst_dev_rcu() in sk_setup_caps()	2025-08-29 19:36:32 -07:00
rpl.h	…
rps.h	net: Add rfs_needed() helper	2025-09-03 15:08:20 -07:00
rsi_91x.h	…
rstreason.h	…
rtnetlink.h	…
rtnh.h	…
sch_generic.h	net/sched: Fix backlog accounting in qdisc_dequeue_internal	2025-08-14 17:52:29 -07:00
scm.h	af_unix/scm: fix whitespace errors	2025-07-04 09:32:35 +02:00
secure_seq.h	…
seg6.h	…
seg6_hmac.h	ipv6: sr: Prepare HMAC key ahead of time	2025-08-26 18:11:29 -07:00
seg6_local.h	…
selftests.h	…
slhc_vj.h	…
smc.h	dibs: Move event handling to dibs layer	2025-09-23 11:13:22 +02:00
snmp.h	net: snmp: remove SNMP_MIB_SENTINEL	2025-09-08 18:06:21 -07:00
sock.h	Revert "net: group sk_backlog and sk_receive_queue"	2025-09-29 18:30:32 -07:00
sock_reuseport.h	…
stp.h	…
strparser.h	…
switchdev.h	…
tc_wrapper.h	…
tcp.h	tcp: make tcp_rcvbuf_grow() accessible to mptcp code	2025-09-29 18:23:35 -07:00
tcp_ao.h	tcp: Free TCP-AO/TCP-MD5 info/keys without RCU	2025-09-11 19:05:56 -07:00
tcp_ecn.h	tcp: accecn: AccECN option failure handling	2025-09-18 08:47:52 +02:00
tcp_states.h	…
tcx.h	bpf: Remove location field in tcx_link	2025-07-11 11:00:57 -07:00
timewait_sock.h	tcp: Remove timewait_sock_ops.twsk_destructor().	2025-08-25 17:53:35 -07:00
tipc.h	…
tls.h	…
tls_prot.h	…
tls_toe.h	…
transp_v6.h	…
tso.h	…
tun_proto.h	…
udp.h	udp: remove busylock and add per NUMA queues	2025-09-23 16:38:39 -07:00
udp_tunnel.h	udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv()	2025-06-24 16:31:36 -07:00
udplite.h	…
vsock_addr.h	…
vxlan.h	vxlan: Support MC routing in the underlay	2025-06-17 18:18:46 -07:00
wext.h	…
x25.h	net/x25: Remove unused x25_terminate_link()	2025-07-14 17:19:13 -07:00
x25device.h	…
xdp.h	bpf-next-for-netdev	2025-09-24 10:22:37 -07:00
xdp_priv.h	…
xdp_sock.h	net: xsk: introduce XDP_MAX_TX_SKB_BUDGET setsockopt	2025-07-10 14:48:29 +02:00
xdp_sock_drv.h	bpf: Allow bpf_xdp_shrink_data to shrink a frag from head and tail	2025-09-23 13:35:12 -07:00
xfrm.h	Revert "xfrm: destroy xfrm_state synchronously on net exit path"	2025-07-08 13:28:29 +02:00
xsk_buff_pool.h	…