Thread (14 messages) flat view 14 messages, 3 authors, 2026-02-16
STALE200d

[PATCH v1 bpf/net 0/6] sockmap: Fix UAF and broken memory accounting for UDP.

From: Kuniyuki Iwashima <kuniyu@google.com>
Date: 2026-02-15 20:43:56
Also in: bpf

syzbot reported 3 issues in SOCKMAP for UDP.

Patch 1 - 2 fix lockless accesses to sk->sk_data_ready()
and sk->sk_write_space().

Patch 3 fixes UAF in sk_msg_recvmsg().

Patch 4 - 5 consolidate sk_psock_skb_ingress_self() into
sk_psock_skb_ingress() as prep for patch 6.

Patch 6 fixes broken memory accounting.


Kuniyuki Iwashima (6):
  sockmap: Annotate sk->sk_data_ready() for UDP.
  sockmap: Annotate sk->sk_write_space() for UDP.
  sockmap: Fix use-after-free in udp_bpf_recvmsg().
  sockmap: Pass gfp_t flag to sk_psock_skb_ingress().
  sockmap: Consolidate sk_psock_skb_ingress_self().
  sockmap: Fix broken memory accounting for UDP.

 include/net/udp.h  |  2 ++
 net/core/skmsg.c   | 90 ++++++++++++++++++----------------------------
 net/core/sock.c    |  2 +-
 net/ipv4/udp.c     | 11 +++++-
 net/ipv4/udp_bpf.c |  9 +++++
 5 files changed, 57 insertions(+), 57 deletions(-)

-- 
2.53.0.310.g728cabbaf7-goog
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help