From: Kuniyuki Iwashima <kuniyu@google.com>
To: John Fastabend <john.fastabend@gmail.com>,
Jakub Sitnicki <jakub@cloudflare.com>
Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
Cong Wang <cong.wang@bytedance.com>,
Kuniyuki Iwashima <kuniyu@google.com>,
Kuniyuki Iwashima <kuni1840@gmail.com>,
bpf@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH v1 bpf/net 0/6] sockmap: Fix UAF and broken memory accounting for UDP.
Date: Sun, 15 Feb 2026 20:41:35 +0000 [thread overview]
Message-ID: <20260215204353.3645744-1-kuniyu@google.com> (raw)
syzbot reported 3 issues in SOCKMAP for UDP.
Patch 1 - 2 fix lockless accesses to sk->sk_data_ready()
and sk->sk_write_space().
Patch 3 fixes UAF in sk_msg_recvmsg().
Patch 4 - 5 consolidate sk_psock_skb_ingress_self() into
sk_psock_skb_ingress() as prep for patch 6.
Patch 6 fixes broken memory accounting.
Kuniyuki Iwashima (6):
sockmap: Annotate sk->sk_data_ready() for UDP.
sockmap: Annotate sk->sk_write_space() for UDP.
sockmap: Fix use-after-free in udp_bpf_recvmsg().
sockmap: Pass gfp_t flag to sk_psock_skb_ingress().
sockmap: Consolidate sk_psock_skb_ingress_self().
sockmap: Fix broken memory accounting for UDP.
include/net/udp.h | 2 ++
net/core/skmsg.c | 90 ++++++++++++++++++----------------------------
net/core/sock.c | 2 +-
net/ipv4/udp.c | 11 +++++-
net/ipv4/udp_bpf.c | 9 +++++
5 files changed, 57 insertions(+), 57 deletions(-)
--
2.53.0.310.g728cabbaf7-goog
next reply other threads:[~2026-02-15 20:43 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-15 20:41 Kuniyuki Iwashima [this message]
2026-02-15 20:41 ` [PATCH v1 bpf/net 1/6] sockmap: Annotate sk->sk_data_ready() for UDP Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 2/6] sockmap: Annotate sk->sk_write_space() " Kuniyuki Iwashima
2026-02-15 21:21 ` bot+bpf-ci
2026-02-16 1:04 ` Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 3/6] sockmap: Fix use-after-free in udp_bpf_recvmsg() Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 4/6] sockmap: Pass gfp_t flag to sk_psock_skb_ingress() Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 5/6] sockmap: Consolidate sk_psock_skb_ingress_self() Kuniyuki Iwashima
2026-02-15 21:50 ` bot+bpf-ci
2026-02-16 1:05 ` Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 6/6] sockmap: Fix broken memory accounting for UDP Kuniyuki Iwashima
2026-02-16 2:50 ` kernel test robot
2026-02-16 5:18 ` Kuniyuki Iwashima
2026-02-16 4:26 ` kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260215204353.3645744-1-kuniyu@google.com \
--to=kuniyu@google.com \
--cc=bpf@vger.kernel.org \
--cc=cong.wang@bytedance.com \
--cc=jakub@cloudflare.com \
--cc=john.fastabend@gmail.com \
--cc=kuni1840@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox