Merge branch 'tcp-fix-use-after-free-in-do_tcp_getsockopt'

Browse source

Cen Zhang says:

====================
tcp: fix use-after-free in do_tcp_getsockopt()

do_tcp_getsockopt() has two lockless reads of icsk_ca_ops. Since BPF
struct_ops congestion control made icsk_ca_ops point to dynamically
allocated memory, a concurrent setsockopt(TCP_CONGESTION) can replace
the pointer and free the old object while either reader is using it.

Patch 1 fixes the TCP_CONGESTION path by copying ca_ops->name to a
stack buffer while holding rcu_read_lock(). It also uses READ_ONCE()
for the lockless load and annotates the relevant icsk_ca_ops stores
with WRITE_ONCE().

Patch 2 fixes the TCP_CC_INFO path by keeping the READ_ONCE() load,
ca_ops->get_info lookup, and call inside an RCU read-side critical
section.
====================

Link: https://patch.msgid.link/cover.1787870710.git.blbllhy@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Jakub Kicinski 2026-08-28 16:09:04 -07:00

parent 7e1d6caa9c 385e474086

commit b84cc38f3f

5 changed files with 20 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

18

net/ipv4/tcp.c

View file

4

net/ipv4/tcp_cong.c

View file

4

net/ipv4/tcp_dctcp.c

View file

2

net/ipv4/tcp_minisocks.c

View file

2

net/ipv4/tcp_output.c

View file