CVE-2025-39913: tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.

In the Linux kernel, the following vulnerability has been resolved:

tcpbpf: Call skmsgfree() when tcpbpfsendverdict() fails to allocate psock->cork.

syzbot reported the splat below. [0]

The repro does the following:

1. Load a skmsg prog that calls bpfmsgcorkbytes(msg, corkbytes) 2. Attach the prog to a SOCKMAP 3. Add a socket to the SOCKMAP 4. Activate fault injection 5. Send data less than corkbytes

At 5., the data is carried over to the next sendmsg() as it is smaller than the corkbytes specified by bpfmsgcorkbytes().

Then, tcpbpfsendverdict() tries to allocate psock->cork to hold the data, but this fails silently due to fault injection + GFPNOWARN.

If the allocation fails, we need to revert the sk->skforwardalloc change done by skmsgalloc().

Let's call skmsgfree() when tcpbpfsendverdict fails to allocate psock->cork.

The "copied" also needs to be updated such that a proper error can be returned to the caller, sendmsg. It fails to allocate psock->cork. Nothing has been corked so far, so this patch simply sets "copied" to 0.

[0]: WARNING: net/ipv4/afinet.c:156 at inetsockdestruct+0x623/0x730 net/ipv4/afinet.c:156, CPU#1: syz-executor/5983 Modules linked in: CPU: 1 UID: 0 PID: 5983 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:inetsockdestruct+0x623/0x730 net/ipv4/afinet.c:156 Code: 0f 0b 90 e9 62 fe ff ff e8 7a db b5 f7 90 0f 0b 90 e9 95 fe ff ff e8 6c db b5 f7 90 0f 0b 90 e9 bb fe ff ff e8 5e db b5 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc RSP: 0018:ffffc90000a08b48 EFLAGS: 00010246 RAX: ffffffff8a09d0b2 RBX: dffffc0000000000 RCX: ffff888024a23c80 RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 RBP: 0000000000000fff R08: ffff88807e07c627 R09: 1ffff1100fc0f8c4 R10: dffffc0000000000 R11: ffffed100fc0f8c5 R12: ffff88807e07c380 R13: dffffc0000000000 R14: ffff88807e07c60c R15: 1ffff1100fc0f872 FS: 00005555604c4500(0000) GS:ffff888125af1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555604df5c8 CR3: 0000000032b06000 CR4: 00000000003526f0 Call Trace: <IRQ> skdestruct+0x86/0x660 net/core/sock.c:2339 rcudobatch kernel/rcu/tree.c:2605 [inline] rcucore+0xca8/0x1770 kernel/rcu/tree.c:2861 handlesoftirqs+0x286/0x870 kernel/softirq.c:579 dosoftirq kernel/softirq.c:613 [inline] invokesoftirq kernel/softirq.c:453 [inline] irqexitrcu+0xca/0x1f0 kernel/softirq.c:680 irqexitrcu+0x9/0x30 kernel/softirq.c:696 instrsysvecapictimerinterrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvecapictimerinterrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052 </IRQ>