Re: [PATCH bpf] bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Double put / invalid pointer dereference when bpf_iter_tcp_realloc_batch fails.
--

commit a46eb4f81a6720ac273041ac646bef28306e6aea
Author: Jose Fernandez (Anthropic) <jose.fernandez@linux.dev>

bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto
the ehash chain (via inet_ehash_insert(), which drops the bucket lock on
return) and only afterwards refcount_set()s rsk_refcnt to 3.

> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index fdc81150ff6cf..92342dcc6892a 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
[ ... ]
> @@ -3129,6 +3129,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)
>  	struct sock *sk;
>  	int err;
>  
> +again:
>  	sk = bpf_iter_tcp_resume(seq);
>  	if (!sk)
>  		return NULL; /* Done */

[Severity: High]
This isn't a bug introduced by this patch, but could this error path later
in bpf_iter_tcp_batch() trigger a double put and invalid pointer dereference?

If bpf_iter_tcp_realloc_batch() fails:

	/* Batch size was too small. */
	bpf_iter_tcp_unlock_bucket(seq);
	bpf_iter_tcp_put_batch(iter);
	err = bpf_iter_tcp_realloc_batch(iter, expected * 3 / 2,
					 GFP_USER);
	if (err)
		return ERR_PTR(err);

bpf_iter_tcp_put_batch() replaces the socket pointers with numeric cookies,
but it uses a local variable and leaves iter->cur_sk and iter->end_sk
unchanged. 

When the iterator is aborted, the stop handler bpf_iter_tcp_seq_stop() is
called:

static void bpf_iter_tcp_seq_stop(struct seq_file *seq, void *v)
{
	...
	if (iter->cur_sk < iter->end_sk)
		bpf_iter_tcp_put_batch(iter);
}

Since the condition remains true, bpf_iter_tcp_put_batch() will be called a
second time on the same elements, but now passing the integer cookie to
sock_gen_put() as if it were a valid pointer. Can this cause a panic?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260620-bpf-iter-tcp-refcnt-v1-1-883bf9e69495@linux.dev?part=1