selftests/bpf: add regression test for ktls+sockmap verdict UAF

Browse source

Test the scenario where a socket is inserted into a sockmap with a
BPF_SK_SKB_VERDICT program before TLS RX is configured.  Previously
sk_psock_verdict_data_ready() would call tcp_read_skb() and drain the
receive queue without advancing copied_seq, causing tls_decrypt_sg()
to walk a dangling frag_list pointer (use-after-free).

The test drives the full vulnerable sequence and verifies that after
the fix recv() returns the correct decrypted data.

Signed-off-by: Xingwang Xiang <v3rdant.xiang@gmail.com>
Link: https://patch.msgid.link/20260517145630.20521-3-v3rdant.xiang@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Xingwang Xiang 2026-05-17 23:56:27 +09:00 • committed by Jakub Kicinski

parent ddf8029623

commit 33644bd38a

2 changed files with 124 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

103

tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c

View file

21

tools/testing/selftests/bpf/progs/test_sockmap_ktls.c

View file