netdev - Re: [Patch bpf-next v6 4/4] tcp_bpf: improve ingress redirection performance with message corking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <6c6092a23ab1e465df632ab4d5757c60a8bf0be121eec277ced123726fef893d@mail.kernel.org>
Date: Thu, 15 Jan 2026 19:49:51 +0000 (UTC)
From: bot+bpf-ci@...nel.org
To: xiyou.wangcong@...il.com,netdev@...r.kernel.org
Cc: hemanthmalla@...il.com,john.fastabend@...il.com,jakub@...udflare.com,zijianzhang@...edance.com,bpf@...r.kernel.org,amery.hung@...edance.com,cong.wang@...edance.com,ast@...nel.org,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,eddyz87@...il.com,yonghong.song@...ux.dev,clm@...a.com,ihor.solodrai@...ux.dev
Subject: Re: [Patch bpf-next v6 4/4] tcp_bpf: improve ingress redirection performance with message corking

> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
> index 45ff311ccf49..b9954cd2b8cc 100644
> --- a/net/core/skmsg.c
> +++ b/net/core/skmsg.c

[ ... ]

> +static void __sk_psock_purge_backlog_msg(struct sk_psock *psock)
> +{
> +	struct sk_msg *msg, *tmp;
> +	LIST_HEAD(tmp_list);
> +
> +	spin_lock(&psock->backlog_msg_lock);
> +	list_splice_init(&psock->backlog_msg, &tmp_list);
> +	spin_unlock(&psock->backlog_msg_lock);
> +
> +	list_for_each_entry_safe(msg, tmp, &tmp_list, list) {
> +		struct sock *sk_from = msg->sk;
> +		bool slow;
> +
> +		list_del(&msg->list);
> +		slow = lock_sock_fast(sk_from);
> +		sk_wmem_queued_add(sk_from, -msg->sg.size);
> +		sock_put(sk_from);
> +		sk_msg_free(sk_from, msg);
> +		unlock_sock_fast(sk_from, slow);
                         ^^^^

Can this trigger a use-after-free? The sock_put(sk_from) call appears
before sk_msg_free() and unlock_sock_fast(). If sock_put() drops the
last reference to sk_from, the socket will be freed while the lock is
still held, and the subsequent sk_msg_free() and unlock_sock_fast()
calls would access freed memory.

The reference taken by sock_hold() in tcp_bpf_ingress_backlog() when
queueing messages (tmp->sk = sk; sock_hold(tmp->sk)) could be the last
reference if the sender socket has closed before the receiver's psock
is destroyed.

Would moving sock_put(sk_from) to after unlock_sock_fast() fix this?

> +		kfree_sk_msg(msg);
> +	}
> +}


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21044016298