diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-07-24 19:31:12 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-07-24 19:31:12 -0700 |
| commit | ae453eef925945a02bb558bff9debbee352e33e9 (patch) | |
| tree | a071743445037e2fe2bad72664932a51a55a0d42 /net | |
| parent | e2a936998ab25cf7272847356390041c3143b498 (diff) | |
| parent | 2d66a033864e27ab8d5e44cb36f31d9d2413bee4 (diff) | |
| download | linux-ae453eef925945a02bb558bff9debbee352e33e9.tar.gz linux-ae453eef925945a02bb558bff9debbee352e33e9.zip | |
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Eduard Zingerman:
- Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
sk_psock->cork for the local temporary message and freeing it again
(Chengfeng Ye)
- Reject passing scalar NULL to nonnull arg of a global subprog.
Previously the verifier did not account for the cases directly
passing scalars to a global subprog, e.g.: 'global_func(0);' would
pass even if 'global_func' argument was marked nonnull (Amery Hung)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
selftests/bpf: Test passing scalar NULL to nonnull global subprog
bpf: Reject passing scalar NULL to nonnull arg of a global subprog
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/tcp_bpf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 8e905b50dead..a30475afb6f8 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -604,7 +604,7 @@ wait_for_sndbuf: wait_for_memory: err = sk_stream_wait_memory(sk, &timeo); if (err) { - if (msg_tx && msg_tx != psock->cork) + if (msg_tx == &tmp) sk_msg_free(sk, msg_tx); goto out_err; } |