CVE-2022-49205: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49205 affects the Linux kernel's BPF (Berkeley Packet Filter) sockmap functionality. The vulnerability was discovered in the tcp_bpf_sendmsg operation where a double uncharge of the memory of sk_msg occurs during tear down operations (Kernel Git).

The issue occurs when tcp_bpf_sendmsg is running during a tear down operation, where psock may be freed. The execution flow goes through tcp_bpf_sendmsg() -> tcp_bpf_send_verdict() -> sk_msg_return() -> tcp_bpf_sendmsg_redir(), where the memory of msg is uncharged twice: once in tcp_bpf_send_verdict() by sk_msg_return(), and again by sk_msg_free() (Kernel Git).

The vulnerability can trigger a kernel warning when the memory is double-uncharged, potentially affecting system stability. This manifests as a warning message: 'WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260' (Kernel Git).

The fix involves modifying the error handling in tcp_bpf_sendmsg_redir(). When psock is null, instead of calling sk_msg_free() and returning 0, the function now returns -EPIPE. This triggers sk_msg_free_nocharge in the error path of __SK_REDIRECT, preventing the double uncharge issue (Kernel Git).