All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Jose Fernandez (Anthropic)" <jose.fernandez@linux.dev>
To: Eric Dumazet <edumazet@google.com>,
	 Neal Cardwell <ncardwell@google.com>,
	Kuniyuki Iwashima <kuniyu@google.com>,
	 "David S. Miller" <davem@davemloft.net>,
	Jakub Kicinski <kuba@kernel.org>,
	 Paolo Abeni <pabeni@redhat.com>, Simon Horman <horms@kernel.org>,
	 Andrii Nakryiko <andrii@kernel.org>,
	Yonghong Song <yonghong.song@linux.dev>,
	 Martin KaFai Lau <martin.lau@linux.dev>,
	Jiayuan Chen <jiayuan.chen@linux.dev>,
	 Emil Tsalapatis <emil@etsalapatis.com>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	 bpf@vger.kernel.org, Ben Cressey <ben@cressey.dev>
Subject: Re: [PATCH bpf] bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Date: Fri, 10 Jul 2026 13:44:04 +0000	[thread overview]
Message-ID: <alD1FJjR5r5n5Eau@linux.dev> (raw)
In-Reply-To: <20260620-bpf-iter-tcp-refcnt-v1-1-883bf9e69495@linux.dev>

Hi all,

Gentle ping. This has Reviewed-by from Jiayuan Chen and Emil Tsalapatis
and no outstanding objections since Jun 29. Is anything else needed for
bpf-fixes?

On the automated review's flag about the pre-existing double-put on the
bpf_iter_tcp_realloc_batch() failure path (cur_sk/end_sk not reset
before seq_stop, so cookies can be re-put as pointers): agreed it is
real, and it predates this change. As Jiayuan noted, it is a separate,
pre-existing issue best addressed on its own; I kept this patch minimal
for stable.

Thanks,
Jose

  parent reply	other threads:[~2026-07-10 13:44 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-20  0:32 [PATCH bpf] bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Jose Fernandez (Anthropic)
2026-06-20  0:48 ` sashiko-bot
2026-06-20 14:06 ` Jiayuan Chen
2026-06-29  7:37 ` Emil Tsalapatis
2026-07-10 13:44 ` Jose Fernandez (Anthropic) [this message]
2026-07-10 14:32   ` Daniel Borkmann
2026-07-10 16:17     ` Kuniyuki Iwashima
2026-07-10 22:24     ` Jose Fernandez (Anthropic)
2026-07-11 12:36 ` Kuniyuki Iwashima
2026-07-11 15:00   ` Jose Fernandez (Anthropic)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alD1FJjR5r5n5Eau@linux.dev \
    --to=jose.fernandez@linux.dev \
    --cc=andrii@kernel.org \
    --cc=ben@cressey.dev \
    --cc=bpf@vger.kernel.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=emil@etsalapatis.com \
    --cc=horms@kernel.org \
    --cc=jiayuan.chen@linux.dev \
    --cc=kuba@kernel.org \
    --cc=kuniyu@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=martin.lau@linux.dev \
    --cc=ncardwell@google.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=yonghong.song@linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.