[PATCH] net/tcp: check rnext_key for NULL in tcp_ao_prepare_reset()

[PATCH] net/tcp: check rnext_key for NULL in tcp_ao_prepare_reset()

[Hui Peng]

In `tcp_ao_prepare_reset()`, when an active reset is sent on a TCP-AO
socket (when `skb` is NULL, such as `tcp_send_active_reset()` during
`tcp_disconnect()`), `rnext_key` is read via
`READ_ONCE(ao_info->rnext_key)` and immediately dereferenced at
`rnext_key->rcvid` without checking whether `rnext_key` is NULL.

When a TCP-AO socket uses `TCP_FASTOPEN_CONNECT` (or disconnects before
a peer `rnext_key` is selected), `ao_info->rnext_key` can be NULL while
`ao_info->current_key` is set, causing a kernel NULL pointer dereference
in `tcp_ao_prepare_reset()`.

Return `-ENOENT` if `rnext_key` is NULL in `tcp_ao_prepare_reset()`.

Fixes: 06b22ef29591 ("net/tcp: Wire TCP-AO to request sockets")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/ipv4/tcp_ao.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c
index bb7bbc20ba3f..18aca0dd5252 100644
--- a/net/ipv4/tcp_ao.c
+++ b/net/ipv4/tcp_ao.c
@@ -857,6 +857,8 @@ int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb,
 			return -ENOENT;
 		*traffic_key = snd_other_key(*key);
 		rnext_key = READ_ONCE(ao_info->rnext_key);
+		if (!rnext_key)
+			return -ENOENT;
 		*keyid = rnext_key->rcvid;
 		*sne = tcp_ao_compute_sne(READ_ONCE(ao_info->snd_sne),
 					  snd_basis, seq);
-- 
2.55.0.1082.g2b9226bbc0-goog