Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:
On Tue, 7 Apr 2026 10:26:26 +0800 you wrote:
> When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg,
> the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the
> destination register in the !fullsock / !locked_tcp_sock path, leading to
> OOB read (GET_SK) and kernel pointer leak (GET_FIELD).
>
> Patch 1: Fix both macros by adding BPF_MOV64_IMM(si->dst_reg, 0) in the
> !fullsock landing pad.
> Patch 2: Add selftests covering same-register and different-register cases
> for both GET_SK and GET_FIELD.
>
> [...]
Here is the summary with links:
- [bpf,v3,1/2] bpf: Fix same-register dst/src OOB read and pointer leak in
sock_ops
https://git.kernel.org/netdev/net/c/10f86a2a5c91
- [bpf,v3,2/2] selftests/bpf: Add tests for sock_ops ctx access with same
src/dst register
https://git.kernel.org/netdev/net/c/04013c3ca022
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
