From: Jakub Kicinski Date: Sun, 12 Apr 2026 19:28:07 +0000 (-0700) Subject: Merge branch 'bpf-fix-sock_ops_get_sk-same-register-oob-read-in-sock_ops-and-add... X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ba69b788ed79d82ed4940fc8dbee9b3f9c5b1a88;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'bpf-fix-sock_ops_get_sk-same-register-oob-read-in-sock_ops-and-add-selftest' Jiayuan Chen says: ==================== bpf: Fix SOCK_OPS_GET_SK same-register OOB read in sock_ops and add selftest When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path, leading to OOB read (GET_SK) and kernel pointer leak (GET_FIELD). Patch 1: Fix both macros by adding BPF_MOV64_IMM(si->dst_reg, 0) in the !fullsock landing pad. Patch 2: Add selftests covering same-register and different-register cases for both GET_SK and GET_FIELD. [1] https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u ==================== Link: https://patch.msgid.link/20260407022720.162151-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski --- ba69b788ed79d82ed4940fc8dbee9b3f9c5b1a88