Merge branch 'bpf-sockmap-reject-a-packet-modifying-sk_skb-stream-parser'

Browse source

Sechang Lim says:

====================
bpf, sockmap: reject a packet-modifying SK_SKB stream parser

A BPF_PROG_TYPE_SK_SKB stream parser runs on strparser's message head,
which can chain skbs through frag_list. A parser that resizes the skb
frees the frag_list segments that strparser still tracks through
skb_nextp, leading to a use-after-free.

A stream parser is only meant to measure the next message, not to modify
the packet, so reject a packet-modifying parser at attach time.

v5:
 - target bpf-next instead of bpf
 - add Reviewed-by tag (Jiayuan Chen)

v4:
 - https://lore.kernel.org/all/20260619062959.3277612-1-rhkrqnwk98@gmail.com/

v3:
 - https://lore.kernel.org/all/20260618102718.2331468-1-rhkrqnwk98@gmail.com/

v2:
 - https://lore.kernel.org/all/20260612123553.2724240-1-rhkrqnwk98@gmail.com/

v1:
 - https://lore.kernel.org/all/20260609112316.3685738-1-rhkrqnwk98@gmail.com/
====================

Link: https://patch.msgid.link/20260620024423.4141004-1-rhkrqnwk98@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Alexei Starovoitov 2026-06-25 17:42:02 -07:00

parent 4edcdefd40 05fb34384d

commit 66bb952b44

4 changed files with 58 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

20

net/core/sock_map.c

View file

31

tools/testing/selftests/bpf/prog_tests/sockmap_strp.c

View file

22

tools/testing/selftests/bpf/progs/sockmap_parse_prog.c

View file

7

tools/testing/selftests/bpf/progs/test_sockmap_strp.c

View file