Re: [PATCH net-next v9 2/2] bpf: make tcp_tso_autosize() available to BPF congestion controls

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly exposed kfunc `tcp_tso_autosize` unconditionally casts a generic `struct sock *` to a `struct tcp_sock *`, allowing BPF programs to trigger out-of-bounds reads by passing non-TCP sockets.
--

commit 772ad73b0346c50ea5e65074e40bac4513abf11b
Author: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>

bpf: make tcp_tso_autosize() available to BPF congestion controls

This commit exposes tcp_tso_autosize() as a BPF kfunc and registers it in
the TCP congestion-control kfunc set. It also adds sanitization for the
min_tso_segs and mss_now parameters.

> diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
> index b1b493d46b9cf..b7f2ee5e7a6b1 100644
> --- a/net/ipv4/tcp_output.c
> +++ b/net/ipv4/tcp_output.c

[ ... ]

> -u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now,
> -		     int min_tso_segs)
> +__bpf_kfunc u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now,
> +				 int min_tso_segs)
>  {

[Severity: High]
Does exposing this function as a generic kfunc allow BPF programs to pass
non-TCP sockets into it?

Since the kfunc signature accepts a generic struct sock pointer, it appears
a BPF program of type BPF_PROG_TYPE_STRUCT_OPS could extract a non-TCP
socket (for example, a UDP socket from skb->sk) and pass it here.

Because bpf_tcp_ca_kfunc_set is registered without a .filter callback, these
kfuncs might be accessible to all BPF_PROG_TYPE_STRUCT_OPS programs, not
just TCP congestion control programs.

If a non-TCP socket is passed, the function later performs an unconditional
cast and dereference:

net/ipv4/tcp_output.c:tcp_tso_autosize() {
    ...
    r = tcp_min_rtt(tcp_sk(sk)) >> READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_tso_rtt_log);
    ...
}

Could this result in an out-of-bounds memory read and potential crash when
tcp_sk() accesses memory beyond the bounds of smaller socket structures?

> +	u32 min_tso = max(min_tso_segs, 1);
>  	unsigned long bytes;
>  	u32 r;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831165230.2696893-1-chia-yu.chang@nokia-bell-labs.com?part=2