AZL-97212

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix sk_redir use-after-free in send verdict

skpsockmsgverdict() takes a socket reference for psock->skredir. tcpbpfsendverdict() copies that pointer while holding the source socket lock, but does not take a reference for the local copy before dropping the lock around tcpbpfsendmsgredir().

When apply_bytes keeps the cached verdict active, another sendmsg() on the same source socket can consume the remaining bytes and release the cached reference while the first thread still holds only the raw local pointer:

CPU 0 CPU 1 skredir = psock->skredir applybytes remains nonzero releasesock(sk) locksock(sk) applybytes reaches zero psock->skredir = NULL releasesock(sk) tcpbpfsendmsgredir(skredir) sockput(skredir) tcpbpfsendmsgredir(skredir)

The final sockput() can free skredir before CPU 0 dereferences it.

KASAN reported:

BUG: KASAN: slab-use-after-free in tcpbpfsendmsgredir+0xf39/0x1020 Read of size 8 at addr ffff888108537090 by task poc/87 Call Trace: tcpbpfsendmsgredir+0xf39/0x1020 tcpbpfsendmsg+0x977/0x1a50 __sys_sendto+0x32c/0x3a0 __x64syssendto+0xdb/0x1b0 Allocated by task 85: skprotalloc+0x56/0x210 sk_clone+0x6f/0x14b0 inetcskclonelock+0x24/0x740 tcpcreateopenreqchild+0x25/0x2710 tcpv4synrecvsock+0x10a/0xe00 Freed by task 0: __kasanslabfree+0x43/0x70 slab_freeafterrcudebug+0xa6/0x1e0 rcucore+0x50a/0x1850 Last potentially related work creation: _skdestruct+0x3da/0x540 skpsockdestroy+0x81e/0xab0 processonework+0x63a/0x1070

Take a temporary socket reference while the source socket lock still protects psock->skredir, and drop it after tcpbpfsendmsgredir() returns. This keeps each unlocked use independent of cached-verdict ownership.