[PATCH v1 net 0/2] net: Fix two issues in sk_clone() error path.

[PATCH v1 net 0/2] net: Fix two issues in sk_clone() error path.

[Kuniyuki Iwashima]

Sashiko reported issues in the sk_clone() error path.

  https://lore.kernel.org/bpf/20260709032007.9E4D61F000E9@smtp.kernel.org/

This series fixes them.

Note that Sashiko may point out the same issue for sk_bpf_storage,
but the fix was already merged in the bpf tree:

  7cbd0c4cebe4 ("bpf: Fix UAF in sock clone early bailouts")


Kuniyuki Iwashima (2):
  soreuseport: Clear sk_reuseport_cb before failure in sk_clone().
  net: Call net_enable_timestamp() before failure in sk_clone().

 net/core/sock.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

-- 
2.55.0.795.g602f6c329a-goog

[PATCH v1 net 1/2] soreuseport: Clear sk_reuseport_cb before failure in sk_clone().

[Kuniyuki Iwashima]

When sk_clone() fails, sk_destruct() is called for the new socket.

If the parent socket has sk->sk_reuseport_cb, the child will call
reuseport_detach_sock() for the reuseport group.

Let's clear sk->sk_reuseport_cb before any failure path in sk_clone().

Note that this was not a problem before the cited commit because
reuseport_detach_sock() did nothing if the socket was not found in
the reuseport array.

Fixes: 5dc4c4b7d4e8 ("bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260709032007.9E4D61F000E9@smtp.kernel.org/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
 net/core/sock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index 8a59bfaa8096..fc3ff0552d68 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2544,6 +2544,8 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
 
 	cgroup_sk_clone(&newsk->sk_cgrp_data);
 
+	RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
+
 	rcu_read_lock();
 	filter = rcu_dereference(sk->sk_filter);
 	if (filter != NULL)
@@ -2566,8 +2568,6 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
 		goto free;
 	}
 
-	RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
-
 	if (bpf_sk_storage_clone(sk, newsk))
 		goto free;
 
-- 
2.55.0.795.g602f6c329a-goog

[PATCH v1 net 2/2] net: Call net_enable_timestamp() before failure in sk_clone().

[Kuniyuki Iwashima]

When sk_clone() fails, sk_destruct() is called for the new socket.

If the parent socket has SK_FLAGS_TIMESTAMP in sk->sk_flags,
net_disable_timestamp() is called for the child socket even though
net_enable_timestamp() is not called for it.

Let's call net_enable_timestamp() before any failure path in
sk_clone().

Fixes: 704da560c0a0 ("tcp: update the netstamp_needed counter when cloning sockets")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260709032007.9E4D61F000E9@smtp.kernel.org/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
 net/core/sock.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index fc3ff0552d68..504d82a3aacd 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2546,6 +2546,9 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
 
 	RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
 
+	if (sock_needs_netstamp(sk) && newsk->sk_flags & SK_FLAGS_TIMESTAMP)
+		net_enable_timestamp();
+
 	rcu_read_lock();
 	filter = rcu_dereference(sk->sk_filter);
 	if (filter != NULL)
@@ -2595,9 +2598,6 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
 
 	if (newsk->sk_prot->sockets_allocated)
 		sk_sockets_allocated_inc(newsk);
-
-	if (sock_needs_netstamp(sk) && newsk->sk_flags & SK_FLAGS_TIMESTAMP)
-		net_enable_timestamp();
 out:
 	return newsk;
 free:
-- 
2.55.0.795.g602f6c329a-goog

Re: [PATCH v1 net 0/2] net: Fix two issues in sk_clone() error path.

[Simon Horman]

On Thu, Jul 09, 2026 at 06:31:38PM +0000, Kuniyuki Iwashima wrote:
> Sashiko reported issues in the sk_clone() error path.
> 
>   https://lore.kernel.org/bpf/20260709032007.9E4D61F000E9@smtp.kernel.org/
> 
> This series fixes them.
> 
> Note that Sashiko may point out the same issue for sk_bpf_storage,
> but the fix was already merged in the bpf tree:
> 
>   7cbd0c4cebe4 ("bpf: Fix UAF in sock clone early bailouts")
> 
> 
> Kuniyuki Iwashima (2):
>   soreuseport: Clear sk_reuseport_cb before failure in sk_clone().
>   net: Call net_enable_timestamp() before failure in sk_clone().

For the series:

Reviewed-by: Simon Horman <horms@kernel.org>