diff options
| author |   Xingwang Xiang <v3rdant.xiang@gmail.com> | 2026-05-17 23:56:27 +0900 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2026-05-20 17:23:56 -0700 |
| commit | 33644bd38aec24fe043e78ce5dca38e7156f8328 (patch) | |
| tree | 4cd53be437895e52c8767edb947d578e53fba14a /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (diff) | |
selftests/bpf: add regression test for ktls+sockmap verdict UAF
Test the scenario where a socket is inserted into a sockmap with a
BPF_SK_SKB_VERDICT program before TLS RX is configured. Previously
sk_psock_verdict_data_ready() would call tcp_read_skb() and drain the
receive queue without advancing copied_seq, causing tls_decrypt_sg()
to walk a dangling frag_list pointer (use-after-free).
The test drives the full vulnerable sequence and verifies that after
the fix recv() returns the correct decrypted data.
Signed-off-by: Xingwang Xiang <v3rdant.xiang@gmail.com>
Link: https://patch.msgid.link/20260517145630.20521-3-v3rdant.xiang@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions