From: Alexei Starovoitov Date: Fri, 26 Jun 2026 00:42:02 +0000 (-0700) Subject: Merge branch 'bpf-sockmap-reject-a-packet-modifying-sk_skb-stream-parser' X-Git-Tag: v7.2-rc2~20^2~11 X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=66bb952b449eac53dffb341108251d632767fd2d;p=thirdparty%2Flinux.git Merge branch 'bpf-sockmap-reject-a-packet-modifying-sk_skb-stream-parser' Sechang Lim says: ==================== bpf, sockmap: reject a packet-modifying SK_SKB stream parser A BPF_PROG_TYPE_SK_SKB stream parser runs on strparser's message head, which can chain skbs through frag_list. A parser that resizes the skb frees the frag_list segments that strparser still tracks through skb_nextp, leading to a use-after-free. A stream parser is only meant to measure the next message, not to modify the packet, so reject a packet-modifying parser at attach time. v5: - target bpf-next instead of bpf - add Reviewed-by tag (Jiayuan Chen) v4: - https://lore.kernel.org/all/20260619062959.3277612-1-rhkrqnwk98@gmail.com/ v3: - https://lore.kernel.org/all/20260618102718.2331468-1-rhkrqnwk98@gmail.com/ v2: - https://lore.kernel.org/all/20260612123553.2724240-1-rhkrqnwk98@gmail.com/ v1: - https://lore.kernel.org/all/20260609112316.3685738-1-rhkrqnwk98@gmail.com/ ==================== Link: https://patch.msgid.link/20260620024423.4141004-1-rhkrqnwk98@gmail.com Signed-off-by: Alexei Starovoitov --- 66bb952b449eac53dffb341108251d632767fd2d