On Mon, Jan 12, 2026 at 12:05:50PM +0100, Greg KH wrote:
On Mon, Jan 12, 2026 at 06:45:54AM +0000, Keerthana K wrote:
From: Kuniyuki Iwashima kuniyu@google.com
[ Upstream commit c65f27b9c3be2269918e1cbad6d8884741f835c5 ]
get_netdev_for_sock() is called during setsockopt(), so not under RCU.
Using sk_dst_get(sk)->dev could trigger UAF.
Let's use __sk_dst_get() and dst_dev_rcu().
Note that the only ->ndo_sk_get_lower_dev() user is bond_sk_get_lower_dev(), which uses RCU.
Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") Signed-off-by: Kuniyuki Iwashima kuniyu@google.com Reviewed-by: Eric Dumazet edumazet@google.com Reviewed-by: Sabrina Dubroca sd@queasysnail.net Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org [ Keerthana: Backport to v6.6.y ] Signed-off-by: Keerthana K keerthana.kalyanasundaram@broadcom.com
net/tls/tls_device.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
This is not in 6.12.y, so we can't take it for 6.6.y yet. Can you please send a 6.12.y version and then a new 6.6.y version?
OH nevermind, you sent this already, my fault, sorry.
greg k-h