Subject: Re: [PATCH bpf v3] bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

From: Martin KaFai Lau <[email-masked]>
Date: Thu, 23 Apr 2026 17:41:56 -0700

On Tue, Apr 21, 2026 at 11:54:12PM -0700, Weiming Shi wrote:
> @@ -668,7 +670,11 @@ int bpf_sk_storage_diag_put(struct bpf_sk_storage_diag *diag,
>  
>  		diag_size += nla_value_size(diag->maps[i]->value_size);

This is the same issue pointed out as v1. diag_size is updated with
a smap in diag->maps[i]...

>  
> -		if (nla_stgs && diag_get(sdata, skb))
> +		smap = rcu_dereference(sdata->smap);
> +		if (!smap)
> +			continue;

... and then nothing is stored in skb, so diag_size is incorrectly inflated.

> +
> +		if (nla_stgs && diag_get(smap, sdata, skb))

diag->maps[i] can be directly used here. I fixed it up before applying.

>  			/* Continue to learn diag_size */
>  			err = -EMSGSIZE;
>  	}
> -- 
> 2.43.0
>