[PATCH v4 bpf/net 0/6] sockmap: Fix UAF and broken memory accounting for UDP.

[Kuniyuki Iwashima <kuniyu@google.com>]

syzbot reported 3 issues in SOCKMAP for UDP.

Patch 1 - 2 fix lockless accesses to sk->sk_data_ready()
and sk->sk_write_space().

Patch 3 fixes UAF in sk_msg_recvmsg().

Patch 4 - 5 consolidate sk_psock_skb_ingress_self() into
sk_psock_skb_ingress() as prep.

Patch 6 fixes broken memory accounting.


Changes:
  v4:
    Patch 4: Don't pass gfp_flags and instead change it based on
              take_ref in the next patch
    Patch 5: Fix memory accounting condition from (skb->sk != sk) to
              (skb->sk != sk && take_ref), the cause of selftest failure
    Patch 6: Fix deadlock when requeued

  v3: https://lore.kernel.org/netdev/20260219173756.315077-1-kuniyu@google.com/
    Patch 2: Use WRITE_ONCE() in udp_bpf_update_proto()

  v2: https://lore.kernel.org/netdev/20260217000701.791189-1-kuniyu@google.com/
    Patch 2: Cache sk->sk_write_space in sock_wfree()
    Patch 5: Keep msg->sk assignment
    Patch 6: Fix build failure when CONFIG_INET=n

  v1: https://lore.kernel.org/netdev/20260215204353.3645744-1-kuniyu@google.com/


Kuniyuki Iwashima (6):
  sockmap: Annotate sk->sk_data_ready() for UDP.
  sockmap: Annotate sk->sk_write_space() for UDP.
  sockmap: Fix use-after-free in udp_bpf_recvmsg().
  sockmap: Inline sk_psock_create_ingress_msg().
  sockmap: Consolidate sk_psock_skb_ingress_self().
  sockmap: Fix broken memory accounting for UDP.

 include/net/udp.h  |   9 ++++
 net/core/skmsg.c   | 100 +++++++++++++++++++++------------------------
 net/core/sock.c    |   8 +++-
 net/ipv4/udp.c     |  11 ++++-
 net/ipv4/udp_bpf.c |  11 ++++-
 5 files changed, 81 insertions(+), 58 deletions(-)

-- 
2.53.0.371.g1d285c8824-goog