On Wed, Jul 08, 2020 at 23:11:10 -0700, Martin KaFai Lau wrote: > bpf_sk_reuseport_detach is currently called when sk->sk_user_data > is not NULL. It is incorrect because sk->sk_user_data may not be > managed by the bpf's reuseport_array. It has been reported in [1] that, > the bpf_sk_reuseport_detach() which is called from udp_lib_unhash() has > corrupted the sk_user_data managed by l2tp. > > This patch solves it by using another bit (defined as SK_USER_DATA_BPF) > of the sk_user_data pointer value. It marks that a sk_user_data is > managed/owned by BPF. I have reservations about using a bit in sk_user_data to indicate ownership of that pointer. But putting that aside, I confirm that the patch fixes the problem. Acked-by: James Chapman <jchapman@xxxxxxxxxxx> Tested-by: James Chapman <jchapman@xxxxxxxxxxx> Reported-by: syzbot+9f092552ba9a5efca5df@xxxxxxxxxxxxxxxxxxxxxxxxx
