Re: [PATCH net-next v7 2/5] tls: Fix dangling skb pointer in tls_sw_read_sock()

2026-03-28, 11:17:09 -0400, Chuck Lever wrote:
> From: Chuck Lever <[email protected]>
> 
> Per ISO/IEC 9899:2011 section 6.2.4p2, a pointer value becomes
> indeterminate when the object it points to reaches the end of its
> lifetime; Annex J.2 classifies the use of such a value as undefined
> behavior. In tls_sw_read_sock(), consume_skb(skb) in the
> fully-consumed path frees the skb, but the "do { } while (skb)"
> loop condition then evaluates that freed pointer. Although the
> value is never dereferenced -- the loop either continues and
> overwrites skb, or exits -- any future change that adds a
> dereference between consume_skb() and the loop condition would
> produce a silent use-after-free.
> 
> Fixes: 662fbcec32f4 ("net/tls: implement ->read_sock()")
> Reviewed-by: Hannes Reinecke <[email protected]>
> Reviewed-by: Alistair Francis <[email protected]>
> Signed-off-by: Chuck Lever <[email protected]>
> ---
>  net/tls/tls_sw.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

Reviewed-by: Sabrina Dubroca <[email protected]>

-- 
Sabrina