Sashiko's review of commit da630d1da2b1 ("netdevsim: psp: drop tx key
ops") [1] showed that there is a hazard between PSP and offloaded TLS,
where both can clobber what the other set in the sk_validate_xmit_skb
callback.It was discussed further on the mailing list [2], and it was pointed out that there are conflicts with PSP and TLS ULP both using the skb->decrypted bit. The simplest fix is to make psp and tls mutually exclusive. This series goes a bit further and makes psp exclusive with all TCP ULPs. The PSP implementation that we have is not designed to be used with any TCP ULP, so don't allow a socket to have state for both. I will send a subsequent series to net-next which will remove the ability to perform the rx-assoc and tx-assoc psp netlink calls on sockets that are not in the TCP_ESTABLISHED state. This will close the remaining quirk that a sk_clone() on a listen socket with psp tx-assoc state will leave a stale sk->sk_validate_xmit_skb call back on a new, non-psp socket. I do not believe that change needs to be regarded as a fix, because it only stands to add unecessary validation code in the tx path. [1]: https://sashiko.dev/#/patchset/20260903-psp-prep-v1-0-d47e9c4c375d%40gmail.com [2]: https://lore.kernel.org/netdev/[email protected]/ Signed-off-by: Daniel Zahka <[email protected]> --- Changes in v2: - remove check on sk->sk_validate_xmit_skb in both tls and psp setup paths - Link to v1: https://lore.kernel.org/r/[email protected] --- Daniel Zahka (2): net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() selftests: drv-net: psp: test PSP and TCP ULP mutual exclusion include/net/sock.h | 2 ++ net/core/sock.c | 7 +++++ net/ipv4/tcp_ulp.c | 4 +++ net/psp/psp_sock.c | 4 +++ tools/testing/selftests/drivers/net/config | 1 + tools/testing/selftests/drivers/net/psp.py | 46 ++++++++++++++++++++++++++++++ 6 files changed, 64 insertions(+) --- base-commit: 83a945a529d6e002dd7339c532288a931f463dba change-id: 20260909-psp-ktls-fix-47aa27d955f2 Best regards, -- Daniel Zahka <[email protected]>
