net/ipv4/tcp_bpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which
drops and reacquires the socket lock. Its error path tries to decide
whether msg_tx names the local temporary message by comparing it with
the current value of psock->cork.
This comparison is unsafe when two threads send on the same socket:
Thread A Thread B
msg_tx = psock->cork
sk_msg_alloc() fails
sk_stream_wait_memory()
releases the socket lock acquires the socket lock
completes the cork
psock->cork = NULL
frees the cork
reacquires the socket lock
msg_tx != psock->cork
sk_msg_free(msg_tx)
The stale cork is therefore mistaken for the local temporary message
and freed again. KASAN reported:
BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50
Read of size 4 at addr ffff88810c908800 by task poc/90
Call Trace:
sk_msg_free+0x49/0x50
tcp_bpf_sendmsg+0x14f5/0x1cc0
__sys_sendto+0x32c/0x3a0
__x64_sys_sendto+0xdb/0x1b0
Allocated by task 89:
__kasan_kmalloc+0x8f/0xa0
tcp_bpf_sendmsg+0x16b3/0x1cc0
Freed by task 91:
__kasan_slab_free+0x43/0x70
kfree+0x131/0x3c0
tcp_bpf_sendmsg+0xec3/0x1cc0
msg_tx can only name the stack-local tmp or the shared cork. Check for
tmp directly so a changed psock->cork cannot turn a shared message into
an apparent local one.
Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
---
Changes in v4:
- Use the PATCH bpf prefix.
- Restore the minimal v1 fix, as suggested by Jakub Sitnicki.
- Drop the changes from v2 and v3 for other issues flagged by sashiko.
Please queue this fix for stable kernels affected by the Fixes commit.
Link: https://lore.kernel.org/bpf/87fr18lmzo.fsf%40cloudflare.com/
Link: https://lore.kernel.org/netdev/20260719161630.2901208-1-nicoyip.dev%40gmail.com/ [v1]
net/ipv4/tcp_bpf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 8e905b50dead..a30475afb6f8 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -604,7 +604,7 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
wait_for_memory:
err = sk_stream_wait_memory(sk, &timeo);
if (err) {
- if (msg_tx && msg_tx != psock->cork)
+ if (msg_tx == &tmp)
sk_msg_free(sk, msg_tx);
goto out_err;
}
--
2.43.0On Fri, Jul 24, 2026 at 06:38 PM +08, Chengfeng Ye wrote:
> tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which
> drops and reacquires the socket lock. Its error path tries to decide
> whether msg_tx names the local temporary message by comparing it with
> the current value of psock->cork.
>
> This comparison is unsafe when two threads send on the same socket:
>
> Thread A Thread B
> msg_tx = psock->cork
> sk_msg_alloc() fails
> sk_stream_wait_memory()
> releases the socket lock acquires the socket lock
> completes the cork
> psock->cork = NULL
> frees the cork
> reacquires the socket lock
> msg_tx != psock->cork
> sk_msg_free(msg_tx)
>
> The stale cork is therefore mistaken for the local temporary message
> and freed again. KASAN reported:
>
> BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50
> Read of size 4 at addr ffff88810c908800 by task poc/90
> Call Trace:
> sk_msg_free+0x49/0x50
> tcp_bpf_sendmsg+0x14f5/0x1cc0
> __sys_sendto+0x32c/0x3a0
> __x64_sys_sendto+0xdb/0x1b0
> Allocated by task 89:
> __kasan_kmalloc+0x8f/0xa0
> tcp_bpf_sendmsg+0x16b3/0x1cc0
> Freed by task 91:
> __kasan_slab_free+0x43/0x70
> kfree+0x131/0x3c0
> tcp_bpf_sendmsg+0xec3/0x1cc0
>
> msg_tx can only name the stack-local tmp or the shared cork. Check for
> tmp directly so a changed psock->cork cannot turn a shared message into
> an apparent local one.
>
> Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
> ---
Thanks!
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
© 2016 - 2026 Red Hat, Inc.