From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: bot+bpf-ci@kernel.org, bpf@vger.kernel.org
Cc: xmei5@asu.edu, kuniyu@google.com, ast@kernel.org,
daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com,
memxor@gmail.com, martin.lau@linux.dev, song@kernel.org,
yonghong.song@linux.dev, jolsa@kernel.org, emil@etsalapatis.com,
ihor.solodrai@linux.dev, john.fastabend@gmail.com,
sdf@fomichev.me, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org,
ncardwell@google.com, shuah@kernel.org, aditi.ghag@isovalent.com,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest@vger.kernel.org, martin.lau@kernel.org,
mason@kernel.org
Subject: Re: [PATCH bpf v3 1/3] bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
Date: Thu, 10 Sep 2026 20:20:29 +0800 [thread overview]
Message-ID: <5cabb13b-1079-4e49-af6b-a6c2fc801657@linux.dev> (raw)
In-Reply-To: <0a661bac8b617cc979ba16eeaec5f7c64a0b74bb01be40347dca187cbd7c24e4@mail.kernel.org>
On 9/10/26 8:07 PM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/net/core/filter.c b/net/core/filter.c
>> index 2a84f9d01131..cae43b999162 100644
>> --- a/net/core/filter.c
>> +++ b/net/core/filter.c
>> @@ -12913,8 +12913,9 @@ __bpf_kfunc_start_defs();
>> * @sock: Pointer to socket to be destroyed
>> *
>> * Return:
>> - * On error, may return EPROTONOSUPPORT, EINVAL.
>> - * EPROTONOSUPPORT if protocol specific destroy handler is not supported.
>> + * On error, may return EOPNOTSUPP, or whatever the protocol specific
>> + * destroy handler returns.
>> + * EOPNOTSUPP if protocol specific destroy handler is not supported.
>> * 0 otherwise
>> */
>> __bpf_kfunc int bpf_sock_destroy(struct sock_common *sock)
>> @@ -12926,8 +12927,12 @@ __bpf_kfunc int bpf_sock_destroy(struct sock_common *sock)
>> * Supporting protocols will need to acquire sock lock in the BPF context
>> * prior to invoking this kfunc.
>> */
>> - if (!sk->sk_prot->diag_destroy || (sk->sk_protocol != IPPROTO_TCP &&
>> - sk->sk_protocol != IPPROTO_UDP))
>> + if (!sk->sk_prot->diag_destroy)
>> + return -EOPNOTSUPP;
>> +
>> + if (sk_fullsock(sk) &&
>> + sk->sk_protocol != IPPROTO_TCP &&
>> + sk->sk_protocol != IPPROTO_UDP)
>> return -EOPNOTSUPP;
>>
>> return sk->sk_prot->diag_destroy(sk, ECONNABORTED);
> This isn't a bug, but would it help to keep the TCP/UDP rationale comment
> next to the protocol check, and add a short note that sk_protocol is only
> valid on full socks? The block comment explaining the locking semantics
> and TCP/UDP restriction now sits two statements away from the protocol
> test it documents, and the newly added sk_fullsock() guard doesn't have
> any nearby note explaining why it's there. The reason (sk_protocol is a
> struct sock member not present in sock_common) is only in the changelog.
>
Current commit message is enough.
That's why we encourage high quality commit message.
next prev parent reply other threads:[~2026-09-10 12:20 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-10 11:20 [PATCH bpf v3 0/3] bpf,tcp: Fix bpf_sock_destroy() on TIME_WAIT and listener socks Jiayuan Chen
2026-09-10 11:26 ` [PATCH bpf v3 1/3] bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() Jiayuan Chen
2026-09-10 12:07 ` bot+bpf-ci
2026-09-10 12:20 ` Jiayuan Chen [this message]
2026-09-10 11:27 ` [PATCH bpf v3 2/3] tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context Jiayuan Chen
2026-09-10 11:44 ` sashiko-bot
2026-09-10 11:50 ` Jiayuan Chen
2026-09-10 11:28 ` [PATCH bpf v3 3/3] selftests/bpf: Test bpf_sock_destroy() on TIME_WAIT and listener socks Jiayuan Chen
2026-09-11 0:00 ` [PATCH bpf v3 0/3] bpf,tcp: Fix " patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5cabb13b-1079-4e49-af6b-a6c2fc801657@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=aditi.ghag@isovalent.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bot+bpf-ci@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=edumazet@google.com \
--cc=emil@etsalapatis.com \
--cc=horms@kernel.org \
--cc=ihor.solodrai@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kuba@kernel.org \
--cc=kuniyu@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@kernel.org \
--cc=martin.lau@linux.dev \
--cc=mason@kernel.org \
--cc=memxor@gmail.com \
--cc=ncardwell@google.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sdf@fomichev.me \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=xmei5@asu.edu \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.