From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B2CBB426693; Mon, 17 Aug 2026 14:53:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786978405; cv=none; b=l2VoQW3rE1fhJ/mghjqFiwaOAUNLFKMPJHax8xVsEKouGLyT4iM30JIEwomdKNOv/me8aMWjMvPQdQ6hndnTW8ACNGupdsmFMxHbT0JE3JlJ2C/aZumnOIv5rA93cUhRAkUd398yDLciTUnzD6JkOl8uEaIahvGTtJ91c6WBFnk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786978405; c=relaxed/simple; bh=F947ruOccjCxGi6vz6iErwFz067pCyW+K9p8s+nf7kM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XElVP3aAd1aKlCSP6U7yCGQKrroEEQ1Ac5TrQTYjm3wF+C7WJEfZbofCuNE9iNOrTq8gMICXSUq2XJQKmVTt+5BulLNHgtjtOtC2zi3pISGwfQ3mtsmoYfi96YSBqLcug257F7a8cu4HESxEg4X0u9lQeI3x2BSNE8pQTrfw2z0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mvEgwZvF; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="mvEgwZvF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 188AF1F000E9; Mon, 17 Aug 2026 14:53:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786978404; bh=Hq0wHLvC5/2UvN+LSTJuNgHqBrFpwXTOqZ10kDm6JRs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=mvEgwZvFmoyutZzeg+B/3pKBZ8+KlIMferTzQQnk4r0vPGnQBo7gQLpo+M390SLns 8vJeN8e7e53tuqfnOEO/qBuNRM/KSCkMq0MbeJlT3yGJjO2miynciL0OPk2kBYJr1q zxROo4Iiz6IaaPjUOJ9oKkwulYXqcISniG4jkFYI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jordan Rife , Martin KaFai Lau , Kuniyuki Iwashima , Stanislav Fomichev , Sasha Levin Subject: [PATCH 6.6 025/156] bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items Date: Mon, 17 Aug 2026 15:32:39 +0200 Message-ID: <20260817132535.615258527@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132534.666299318@linuxfoundation.org> References: <20260817132534.666299318@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jordan Rife [ Upstream commit efeb820951ebf3778830256496ff72d00d135310 ] Prepare for the next patch that tracks cookies between iterations by converting struct sock **batch to union bpf_tcp_iter_batch_item *batch inside struct bpf_tcp_iter_state. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Acked-by: Stanislav Fomichev Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()") Signed-off-by: Sasha Levin --- net/ipv4/tcp_ipv4.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index c32902c07bd0c..a826d137c86b4 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -2776,12 +2776,16 @@ static int tcp4_seq_show(struct seq_file *seq, void *v) } #ifdef CONFIG_BPF_SYSCALL +union bpf_tcp_iter_batch_item { + struct sock *sk; +}; + struct bpf_tcp_iter_state { struct tcp_iter_state state; unsigned int cur_sk; unsigned int end_sk; unsigned int max_sk; - struct sock **batch; + union bpf_tcp_iter_batch_item *batch; }; struct bpf_iter__tcp { @@ -2807,13 +2811,13 @@ static void bpf_iter_tcp_put_batch(struct bpf_tcp_iter_state *iter) unsigned int cur_sk = iter->cur_sk; while (cur_sk < iter->end_sk) - sock_gen_put(iter->batch[cur_sk++]); + sock_gen_put(iter->batch[cur_sk++].sk); } static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter, unsigned int new_batch_sz, gfp_t flags) { - struct sock **new_batch; + union bpf_tcp_iter_batch_item *new_batch; new_batch = kvmalloc(sizeof(*new_batch) * new_batch_sz, flags | __GFP_NOWARN); @@ -2837,7 +2841,7 @@ static unsigned int bpf_iter_tcp_listening_batch(struct seq_file *seq, struct sock *sk; sock_hold(*start_sk); - iter->batch[iter->end_sk++] = *start_sk; + iter->batch[iter->end_sk++].sk = *start_sk; sk = sk_nulls_next(*start_sk); *start_sk = NULL; @@ -2845,7 +2849,7 @@ static unsigned int bpf_iter_tcp_listening_batch(struct seq_file *seq, if (seq_sk_match(seq, sk)) { if (iter->end_sk < iter->max_sk) { sock_hold(sk); - iter->batch[iter->end_sk++] = sk; + iter->batch[iter->end_sk++].sk = sk; } else if (!*start_sk) { /* Remember where we left off. */ *start_sk = sk; @@ -2866,7 +2870,7 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq, struct sock *sk; sock_hold(*start_sk); - iter->batch[iter->end_sk++] = *start_sk; + iter->batch[iter->end_sk++].sk = *start_sk; sk = sk_nulls_next(*start_sk); *start_sk = NULL; @@ -2874,7 +2878,7 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq, if (seq_sk_match(seq, sk)) { if (iter->end_sk < iter->max_sk) { sock_hold(sk); - iter->batch[iter->end_sk++] = sk; + iter->batch[iter->end_sk++].sk = sk; } else if (!*start_sk) { /* Remember where we left off. */ *start_sk = sk; @@ -2978,7 +2982,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq) WARN_ON_ONCE(iter->end_sk != expected); done: bpf_iter_tcp_unlock_bucket(seq); - return iter->batch[0]; + return iter->batch[0].sk; } static void *bpf_iter_tcp_seq_start(struct seq_file *seq, loff_t *pos) @@ -3013,11 +3017,11 @@ static void *bpf_iter_tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos) * st->bucket. See tcp_seek_last_pos(). */ st->offset++; - sock_gen_put(iter->batch[iter->cur_sk++]); + sock_gen_put(iter->batch[iter->cur_sk++].sk); } if (iter->cur_sk < iter->end_sk) - sk = iter->batch[iter->cur_sk]; + sk = iter->batch[iter->cur_sk].sk; else sk = bpf_iter_tcp_batch(seq); -- 2.53.0