Re: [PATCH] bpf, sockmap: Fix sk_redir use-after-free in send verdict

[John Fastabend]

On Sun, Jul 19, 2026 at 11:22:07PM +0800, Chengfeng Ye wrote:
> sk_psock_msg_verdict() takes a socket reference for psock->sk_redir.
> tcp_bpf_send_verdict() copies that pointer while holding the source socket
> lock, but does not take a reference for the local copy before dropping the
> lock around tcp_bpf_sendmsg_redir().
>
> When apply_bytes keeps the cached verdict active, another sendmsg() on the
> same source socket can consume the remaining bytes and release the cached
> reference while the first thread still holds only the raw local pointer:
>
>  CPU 0                                  CPU 1
>  sk_redir = psock->sk_redir
>  apply_bytes remains nonzero
>  release_sock(sk)
>                                         lock_sock(sk)
>                                         apply_bytes reaches zero
>                                         psock->sk_redir = NULL
>                                         release_sock(sk)
>                                         tcp_bpf_sendmsg_redir(sk_redir)
>                                         sock_put(sk_redir)
>  tcp_bpf_sendmsg_redir(sk_redir)
>
> The final sock_put() can free sk_redir before CPU 0 dereferences it.
>
> KASAN reported:
>
>  BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020
>  Read of size 8 at addr ffff888108537090 by task poc/87
>  Call Trace:
>   tcp_bpf_sendmsg_redir+0xf39/0x1020
>   tcp_bpf_sendmsg+0x977/0x1a50
>   __sys_sendto+0x32c/0x3a0
>   __x64_sys_sendto+0xdb/0x1b0
>  Allocated by task 85:
>   sk_prot_alloc+0x56/0x210
>   sk_clone+0x6f/0x14b0
>   inet_csk_clone_lock+0x24/0x740
>   tcp_create_openreq_child+0x25/0x2710
>   tcp_v4_syn_recv_sock+0x10a/0xe00
>  Freed by task 0:
>   __kasan_slab_free+0x43/0x70
>   slab_free_after_rcu_debug+0xa6/0x1e0
>   rcu_core+0x50a/0x1850
>  Last potentially related work creation:
>   __sk_destruct+0x3da/0x540
>   sk_psock_destroy+0x81e/0xab0
>   process_one_work+0x63a/0x1070
>
> Take a temporary socket reference while the source socket lock still
> protects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()
> returns.  This keeps each unlocked use independent of cached-verdict
> ownership.
>
> Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
> ---

Nice catch.

Reviewed-by: John Fastabend <john.fastabend@xxxxxxxxx>