[PATCH net 0/2] tcp: fix congestion control UAFs in do_tcp_getsockopt()

do_tcp_getsockopt() has two lockless reads of icsk_ca_ops. Since BPF
struct_ops congestion control made icsk_ca_ops point to dynamically
allocated memory, a concurrent setsockopt(TCP_CONGESTION) can replace
the pointer and free the old object while either reader is using it.

Patch 1 fixes the TCP_CONGESTION path by copying ca_ops->name to a
stack buffer while holding rcu_read_lock().

Patch 2 fixes the TCP_CC_INFO path by keeping the ca_ops->get_info
lookup and call inside an RCU read-side critical section.

Eric Dumazet's related TCP data-race annotation work [1] adds
READ_ONCE()/WRITE_ONCE() annotations for lockless TCP socket field
accesses. icsk_ca_ops would similarly benefit from such annotations,
but that is an independent data-race concern. This series focuses
solely on the use-after-free fixes via rcu_read_lock().

[1]
https://lore.kernel.org/all/20260416200319.3608680-1-edumazet@google.com/ (local)

Cen Zhang (Microsoft) (2):
  tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
  tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

 net/ipv4/tcp.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)


base-commit: 746fc0787f616da418ffc04a110296fe95d53491
-- 
2.55.0