linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00

No description

C 96.9%
Assembly 0.9%
Rust 0.6%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Chengfeng Ye b2bcbeabfd bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() [ Upstream commit `2d66a03386` ] tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which drops and reacquires the socket lock. Its error path tries to decide whether msg_tx names the local temporary message by comparing it with the current value of psock->cork. This comparison is unsafe when two threads send on the same socket: Thread A Thread B msg_tx = psock->cork sk_msg_alloc() fails sk_stream_wait_memory() releases the socket lock acquires the socket lock completes the cork psock->cork = NULL frees the cork reacquires the socket lock msg_tx != psock->cork sk_msg_free(msg_tx) The stale cork is therefore mistaken for the local temporary message and freed again. KASAN reported: BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50 Read of size 4 at addr ffff88810c908800 by task poc/90 Call Trace: sk_msg_free+0x49/0x50 tcp_bpf_sendmsg+0x14f5/0x1cc0 __sys_sendto+0x32c/0x3a0 __x64_sys_sendto+0xdb/0x1b0 Allocated by task 89: __kasan_kmalloc+0x8f/0xa0 tcp_bpf_sendmsg+0x16b3/0x1cc0 Freed by task 91: __kasan_slab_free+0x43/0x70 kfree+0x131/0x3c0 tcp_bpf_sendmsg+0xec3/0x1cc0 msg_tx can only name the stack-local tmp or the shared cork. Check for tmp directly so a changed psock->cork cannot turn a shared message into an apparent local one. Fixes: `604326b41a` ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/87fr18lmzo.fsf%40cloudflare.com/ Link: https://lore.kernel.org/netdev/20260719161630.2901208-1-nicoyip.dev%40gmail.com/ [v1] Link: https://patch.msgid.link/20260724103856.3399001-1-nicoyip.dev@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2026-08-19 17:13:59 +02:00
arch	powerpc/vtime: Initialize starttime at boot for native accounting	2026-08-19 17:13:54 +02:00
block	partitions: aix: bound the pp_count scan to the ppe array	2026-07-24 15:51:24 +02:00
certs	X.509: Fix validation of ASN.1 certificate header	2026-07-24 15:51:59 +02:00
crypto	crypto: rsa-pkcs1pad: Don't WARN on an empty digest	2026-08-19 17:13:55 +02:00
Documentation	PCI: Move Resizable BAR code to rebar.c	2026-07-24 15:51:58 +02:00
drivers	net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation	2026-08-19 17:13:59 +02:00
fs	btrfs: free mapping node on duplicate reloc root insert	2026-08-19 17:13:56 +02:00
include	raw: use more conventional iterators	2026-08-19 17:13:59 +02:00
init	randomize_kstack: Maintain kstack_offset per task	2026-06-19 13:33:41 +02:00
io_uring	io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item	2026-07-24 15:51:21 +02:00
ipc	ipc/shm: serialize orphan cleanup with shm_nattch updates	2026-06-19 13:33:38 +02:00
kernel	bpf: Fix ld_{abs,ind} failure path analysis in subprogs	2026-08-19 17:13:56 +02:00
lib	lib/test_meminit: use && for bools	2026-07-24 15:51:32 +02:00
LICENSES	LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes"	2021-07-15 06:31:24 -06:00
mm	mm/huge_memory: update file PMD counter before folio_put()	2026-06-19 13:33:49 +02:00
net	bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()	2026-08-19 17:13:59 +02:00
samples	tracing/events: Fix to check the simple_tsk_fn creation	2026-07-24 15:51:42 +02:00
scripts	kconfig: fix potential NULL pointer dereference in conf_askvalue	2026-07-24 15:51:28 +02:00
security	apparmor: fix label can not be immediately before a declaration	2026-07-24 15:51:39 +02:00
sound	ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI	2026-08-19 17:13:57 +02:00
tools	bitops: make BYTES_TO_BITS() treewide-available	2026-07-24 15:51:56 +02:00
usr	kbuild: hdrcheck: fix cross build with clang	2025-06-27 11:05:22 +01:00
virt	KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers	2026-07-24 15:52:02 +02:00
.clang-format	clang-format: Update with the latest for_each macro list	2021-05-12 23:32:39 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	Remove *.orig pattern from .gitignore	2024-10-17 15:11:10 +02:00
.mailmap	mailmap: add Andrej Shadura	2021-10-18 20:22:03 -10:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Daniel Drake to credits	2021-09-21 08:34:58 +03:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	staging: rtl8712: Remove driver using deprecated API wext	2025-12-07 06:09:36 +09:00
Makefile	Linux 5.15.215	2026-08-07 08:07:31 +02:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.