Re: [PATCH] udp_bpf: fix use-after-free in udp_bpf_recvmsg()

[Kuniyuki Iwashima]

On Wed, Apr 1, 2026 at 11:03 PM Jiayuan Chen <jiayuan.chen@xxxxxxxxx> wrote:
>
>
> On 4/2/26 1:09 PM, Deepanshu Kartikey wrote:
> > udp_bpf_recvmsg() calls sk_msg_recvmsg() without holding lock_sock(),
> > unlike tcp_bpf_recvmsg() which properly acquires lock_sock() before
> > calling __sk_msg_recvmsg(). This allows concurrent tasks to race inside
> > sk_msg_recvmsg() on the same psock ingress queue, where one task can
> > free msg_rx via kfree_sk_msg() while another task is still reading it
> > via sk_msg_elem(), causing a slab-use-after-free.
> >
> > Fix this by adding lock_sock()/release_sock() around the sk_msg_recvmsg()
> > path in udp_bpf_recvmsg(), consistent with tcp_bpf_recvmsg(). Also make
> > udp_msg_wait_data() release lock_sock() before sleeping and reacquire it
> > after waking, so it can be called with the socket lock held, consistent
> > with how tcp_msg_wait_data() uses sk_wait_event() which does the same
> > internally.
> >
> > Note: syzbot testing shows a separate pre-existing warning:
> >    sk->sk_forward_alloc
> >    WARNING: net/ipv4/af_inet.c:162 inet_sock_destruct
> > This warning triggers from the idle CPU path (pv_native_safe_halt)
> > and is unrelated to this patch. It appears to be a pre-existing
> > memory accounting issue in the UDP sockmap path that requires
> > separate investigation.
> >
> >
> > Reported-by: syzbot+431f9a9e3f5227fbb904@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=431f9a9e3f5227fbb904
> > Fixes: 1f5be6b3b063 ("udp: Implement udp_bpf_recvmsg() for sockmap")
> > Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
> > ---
> >   net/ipv4/udp_bpf.c | 5 +++++
> >   1 file changed, 5 insertions(+)
> >
> > diff --git a/net/ipv4/udp_bpf.c b/net/ipv4/udp_bpf.c
> > index 9f33b07b1481..f924b255cee6 100644
> > --- a/net/ipv4/udp_bpf.c
> > +++ b/net/ipv4/udp_bpf.c
> > @@ -50,7 +50,9 @@ static int udp_msg_wait_data(struct sock *sk, struct sk_psock *psock,
> >       sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
> >       ret = udp_msg_has_data(sk, psock);
> >       if (!ret) {
> > +             release_sock(sk);
> >               wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
> > +             lock_sock(sk);
> >               ret = udp_msg_has_data(sk, psock);
> >       }
> >       sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
> > @@ -79,6 +81,7 @@ static int udp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
> >               goto out;
> >       }
> >
> > +     lock_sock(sk);
> >   msg_bytes_ready:
> >       copied = sk_msg_recvmsg(sk, psock, msg, len, flags);
> >       if (!copied) {
> > @@ -90,12 +93,14 @@ static int udp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
> >               if (data) {
> >                       if (psock_has_data(psock))
> >                               goto msg_bytes_ready;
> > +                     release_sock(sk);
> >                       ret = sk_udp_recvmsg(sk, msg, len, flags);
> >                       goto out;
> >               }
> >               copied = -EAGAIN;
> >       }
> >       ret = copied;
> > +     release_sock(sk);
> >   out:
> >       sk_psock_put(sk, psock);
> >       return ret;
>
> Kuniyuki  is already working on this. Please see the
> existing discussion.
>
> https://lore.kernel.org/bpf/20260221233234.3814768-4-kuniyu@xxxxxxxxxx/

Oh I almost forgot about this.. will respin shortly. Thanks.