bpf: fix bpf_tcp_ingress addr use after free

euleros inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I545NW
CVE: NA

--------------------------------

fix a bug in bpf_tcp_ingress(), addr use after free
Signed-off-by: Nzhangmingyi <zhangmingyi5@huawei.com>
Reviewed-by: Nliuxin <liuxin350@huawei.com>
Reviewed-by: Nwuchangye <wuchangye@huawei.com>
Fixes: 8818e269 ("bpf, sockmap: Add sk_rmem_alloc check for sockmap")
Signed-off-by: NLiu Jian <liujian56@huawei.com>
(cherry picked from commit 46613645)

net/ipv4/tcp_bpf.c

@@ -138,7 +138,8 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock,
 	if (!ret) {
 		msg->sg.start = i;
 		sk_psock_queue_msg(psock, tmp);
-		atomic_add(tmp->sg.size, &sk->sk_rmem_alloc);
+		if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
+			atomic_add(tmp->sg.size, &sk->sk_rmem_alloc);
 		sk_psock_data_ready(sk, psock);
 	} else {
 		sk_msg_free(sk, tmp);