Re: [PATCH] bpf, sockmap: Fix sk_redir use-after-free in send verdict

Hello:

This patch was applied to bpf/bpf.git (master)
by Kumar Kartikeya Dwivedi <[email protected]>:

On Sun, 19 Jul 2026 23:22:07 +0800 you wrote:
> sk_psock_msg_verdict() takes a socket reference for psock->sk_redir.
> tcp_bpf_send_verdict() copies that pointer while holding the source socket
> lock, but does not take a reference for the local copy before dropping the
> lock around tcp_bpf_sendmsg_redir().
> 
> When apply_bytes keeps the cached verdict active, another sendmsg() on the
> same source socket can consume the remaining bytes and release the cached
> reference while the first thread still holds only the raw local pointer:
> 
> [...]

Here is the summary with links:
  - bpf, sockmap: Fix sk_redir use-after-free in send verdict
    https://git.kernel.org/bpf/bpf/c/a76624733730

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html