Commit 2d66a033864e for kernel

commit 2d66a033864e27ab8d5e44cb36f31d9d2413bee4
Author: Chengfeng Ye <nicoyip.dev@gmail.com>
Date:   Fri Jul 24 18:38:56 2026 +0800

    bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

    tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which
    drops and reacquires the socket lock.  Its error path tries to decide
    whether msg_tx names the local temporary message by comparing it with
    the current value of psock->cork.

    This comparison is unsafe when two threads send on the same socket:

      Thread A                         Thread B
      msg_tx = psock->cork
      sk_msg_alloc() fails
      sk_stream_wait_memory()
        releases the socket lock      acquires the socket lock
                                      completes the cork
                                      psock->cork = NULL
                                      frees the cork
        reacquires the socket lock
      msg_tx != psock->cork
      sk_msg_free(msg_tx)

    The stale cork is therefore mistaken for the local temporary message
    and freed again.  KASAN reported:

      BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50
      Read of size 4 at addr ffff88810c908800 by task poc/90
      Call Trace:
       sk_msg_free+0x49/0x50
       tcp_bpf_sendmsg+0x14f5/0x1cc0
       __sys_sendto+0x32c/0x3a0
       __x64_sys_sendto+0xdb/0x1b0
      Allocated by task 89:
       __kasan_kmalloc+0x8f/0xa0
       tcp_bpf_sendmsg+0x16b3/0x1cc0
      Freed by task 91:
       __kasan_slab_free+0x43/0x70
       kfree+0x131/0x3c0
       tcp_bpf_sendmsg+0xec3/0x1cc0

    msg_tx can only name the stack-local tmp or the shared cork. Check for
    tmp directly so a changed psock->cork cannot turn a shared message into
    an apparent local one.

    Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
    Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
    Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
    Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
    Link: https://lore.kernel.org/bpf/87fr18lmzo.fsf%40cloudflare.com/
    Link: https://lore.kernel.org/netdev/20260719161630.2901208-1-nicoyip.dev%40gmail.com/ [v1]
    Link: https://patch.msgid.link/20260724103856.3399001-1-nicoyip.dev@gmail.com
    Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 8e905b50dead..a30475afb6f8 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -604,7 +604,7 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 wait_for_memory:
 		err = sk_stream_wait_memory(sk, &timeo);
 		if (err) {
-			if (msg_tx && msg_tx != psock->cork)
+			if (msg_tx == &tmp)
 				sk_msg_free(sk, msg_tx);
 			goto out_err;
 		}