CVE-2024-56633

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg<br /> <br /> The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging<br /> tosend bytes, which is either msg-&gt;sg.size or a smaller value apply_bytes.<br /> <br /> Potential problems with this strategy are as follows:<br /> <br /> - If the actual sent bytes are smaller than tosend, we need to charge some<br /> bytes back, as in line 487, which is okay but seems not clean.<br /> <br /> - When tosend is set to apply_bytes, as in line 417, and (ret sg.size - apply_bytes) bytes.<br /> <br /> [...]<br /> 415 tosend = msg-&gt;sg.size;<br /> 416 if (psock-&gt;apply_bytes &amp;&amp; psock-&gt;apply_bytes apply_bytes;<br /> [...]<br /> 443 sk_msg_return(sk, msg, tosend);<br /> 444 release_sock(sk);<br /> 446 origsize = msg-&gt;sg.size;<br /> 447 ret = tcp_bpf_sendmsg_redir(sk_redir, redir_ingress,<br /> 448 msg, tosend, flags);<br /> 449 sent = origsize - msg-&gt;sg.size;<br /> [...]<br /> 454 lock_sock(sk);<br /> 455 if (unlikely(ret