The next patch moves psp_sk_overhead(sk) from icsk->icsk_ext_hdr_len to __tcp_mtu_to_mss() and tcp_mss_to_mtu(), which can be called between psp_sock_assoc_set_rx() and psp_sock_set_tx_key() while Tx packets are still sent in cleartext. Currently, psp_sk_overhead() only checks if sk->psp_assoc is set, and even without the next patch, if ipv6_update_options() is called between psp_sock_assoc_set_rx() and psp_sock_set_tx_key(), psp_sk_overhead(sk) is added to icsk->icsk_ext_hdr_len twice. Let's check pas->tx.spi in psp_sk_overhead(). Signed-off-by: Kuniyuki Iwashima --- not worth backporting, no one does that, only theoretical issue. --- include/net/psp/functions.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/net/psp/functions.h b/include/net/psp/functions.h index b23c30898389..410adb6718c1 100644 --- a/include/net/psp/functions.h +++ b/include/net/psp/functions.h @@ -145,9 +145,9 @@ static inline struct psp_assoc *psp_skb_get_assoc_rcu(struct sk_buff *skb) static inline unsigned int psp_sk_overhead(const struct sock *sk) { int psp_encap = sizeof(struct udphdr) + PSP_HDR_SIZE + PSP_TRL_SIZE; - bool has_psp = rcu_access_pointer(sk->psp_assoc); + struct psp_assoc *pas = psp_sk_assoc(sk); - return has_psp ? psp_encap : 0; + return pas && pas->tx.spi ? psp_encap : 0; } #else static inline void psp_sk_assoc_free(struct sock *sk) { } -- 2.56.0.385.gac671c819a-goog