[SRU][J][PATCH v2 1/1] tls: Fix race condition in tls_sw_cancel_work_tx()

[Cengiz Can]

From: Hyunwoo Kim <imv4bel at gmail.com>

This issue was discovered during a code audit.

After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.

The following is a simple race scenario:

          cpu0                         cpu1

tls_sk_proto_close()
  tls_sw_cancel_work_tx()
                                 tls_write_space()
                                   tls_sw_write_space()
                                     if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
    set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
    cancel_delayed_work_sync(&ctx->tx_work.work);
                                     schedule_delayed_work(&tx_ctx->tx_work.work, 0);

To prevent this race condition, cancel_delayed_work_sync() is
replaced with disable_delayed_work_sync().

Fixes: f87e62d45e51 ("net/tls: remove close callback sock unlock/lock around TX work flush")
Signed-off-by: Hyunwoo Kim <imv4bel at gmail.com>
Reviewed-by: Simon Horman <horms at kernel.org>
Reviewed-by: Sabrina Dubroca <sd at queasysnail.net>
Link: https://patch.msgid.link/aZgsFO6nfylfvLE7@v4bel
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
(backported from commit 7bb09315f93dce6acc54bf59e5a95ba7365c2be4)
[bot_kybele: adapted to compile on jammy; review and refine this note]
CVE-2026-23240
Assisted-by: kybele:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
 net/tls/tls_sw.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index b441d8606b7c..2ff0afc477dd 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -2271,6 +2271,14 @@ void tls_sw_cancel_work_tx(struct tls_context *tls_ctx)
 
 	set_bit(BIT_TX_CLOSING, &ctx->tx_bitmask);
 	set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
+	/* disable_delayed_work_sync() is not available on this kernel.
+	 * BIT_TX_CLOSING is set above before the sync cancel, and the
+	 * requeue path (tls_sw_write_space()) now bails out when it is
+	 * set, so the work cannot be re-armed after this point. This
+	 * emulates the "disable then cancel" semantics of the upstream
+	 * fix and prevents tx_work_handler() from running against a freed
+	 * TLS context.
+	 */
 	cancel_delayed_work_sync(&ctx->tx_work.work);
 }
 
@@ -2401,6 +2409,13 @@ void tls_sw_write_space(struct sock *sk, struct tls_context *ctx)
 {
 	struct tls_sw_context_tx *tx_ctx = tls_sw_ctx_tx(ctx);
 
+	/* Do not re-arm the tx work once teardown has begun, otherwise the
+	 * work could be scheduled after tls_sw_cancel_work_tx() has flushed
+	 * it, racing with the freeing of the TLS context.
+	 */
+	if (test_bit(BIT_TX_CLOSING, &tx_ctx->tx_bitmask))
+		return;
+
 	/* Schedule the transmission if tx list is ready */
 	if (is_tx_ready(tx_ctx) &&
 	    !test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
-- 
2.43.0