From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5CC542376B; Mon, 17 Aug 2026 14:45:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786977906; cv=none; b=CrA2ygyl6vAjPZYOtE0DS9WaLEJ3oTLX0KDHxvQxc9zFtTKWvUc0itcDh+CbJcEZSsneoK4wMDRedVMYhCTtE0KmghmtiFfU3QSKtFltU7N6t3PYaTnGl39R8wPqY4ZVI01X3RLjHhR7J/a+py8sgG4fNG0X3bzSKI6+lyTy0k8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786977906; c=relaxed/simple; bh=Uu83kpSBbJsY6CKSp8gs/ED4bqncIEtIqmdIxiFNNxs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ALL6vRfh1HLO6Bp8pQD2yi/XFjTvHWRq/41Gir9PBQds3VzEz4Hp/NdA4Nxq9BrCx6PxY1vNxy32BaVOqBEeBmqZrPRO2qqw23c+bkrQqZhtE+P48meY3ge3Z/66zcLADZJHfHXQ3j7Kphbrmf+ZgIvdmwcjYWVC3+hPt5aGi+0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ijb0macs; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ijb0macs" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B5DCA1F000E9; Mon, 17 Aug 2026 14:45:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786977905; bh=TnW+zpYpA8Yk3UlJbK01Gl5oJJMJw8iIRY84MMma1/g=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ijb0macsl6WkBYKYqYLbD9OatMps3U00toWMmFa4Svp9tbNCfLPj/GLZOm7VTKf6N UaBwPBAmwQxFKqGd5+nHUspQtM4w/cmB5PkAnyRE7PDALEWjMby8eYNFrqunmGEUAP 7OVd5lMzzNSomW5LdaWvxay3yVE16PwgB3yrusdk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jordan Rife , Martin KaFai Lau , Kuniyuki Iwashima , Stanislav Fomichev , Sasha Levin Subject: [PATCH 6.12 033/181] bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items Date: Mon, 17 Aug 2026 15:32:07 +0200 Message-ID: <20260817132536.679293076@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132535.394764707@linuxfoundation.org> References: <20260817132535.394764707@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jordan Rife [ Upstream commit efeb820951ebf3778830256496ff72d00d135310 ] Prepare for the next patch that tracks cookies between iterations by converting struct sock **batch to union bpf_tcp_iter_batch_item *batch inside struct bpf_tcp_iter_state. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Acked-by: Stanislav Fomichev Stable-dep-of: e5fd3f514e27 ("bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()") Signed-off-by: Sasha Levin --- net/ipv4/tcp_ipv4.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index c18eee7ed5378..6a8241367672b 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -2998,12 +2998,16 @@ static int tcp4_seq_show(struct seq_file *seq, void *v) } #ifdef CONFIG_BPF_SYSCALL +union bpf_tcp_iter_batch_item { + struct sock *sk; +}; + struct bpf_tcp_iter_state { struct tcp_iter_state state; unsigned int cur_sk; unsigned int end_sk; unsigned int max_sk; - struct sock **batch; + union bpf_tcp_iter_batch_item *batch; }; struct bpf_iter__tcp { @@ -3029,13 +3033,13 @@ static void bpf_iter_tcp_put_batch(struct bpf_tcp_iter_state *iter) unsigned int cur_sk = iter->cur_sk; while (cur_sk < iter->end_sk) - sock_gen_put(iter->batch[cur_sk++]); + sock_gen_put(iter->batch[cur_sk++].sk); } static int bpf_iter_tcp_realloc_batch(struct bpf_tcp_iter_state *iter, unsigned int new_batch_sz, gfp_t flags) { - struct sock **new_batch; + union bpf_tcp_iter_batch_item *new_batch; new_batch = kvmalloc(sizeof(*new_batch) * new_batch_sz, flags | __GFP_NOWARN); @@ -3059,7 +3063,7 @@ static unsigned int bpf_iter_tcp_listening_batch(struct seq_file *seq, struct sock *sk; sock_hold(*start_sk); - iter->batch[iter->end_sk++] = *start_sk; + iter->batch[iter->end_sk++].sk = *start_sk; sk = sk_nulls_next(*start_sk); *start_sk = NULL; @@ -3067,7 +3071,7 @@ static unsigned int bpf_iter_tcp_listening_batch(struct seq_file *seq, if (seq_sk_match(seq, sk)) { if (iter->end_sk < iter->max_sk) { sock_hold(sk); - iter->batch[iter->end_sk++] = sk; + iter->batch[iter->end_sk++].sk = sk; } else if (!*start_sk) { /* Remember where we left off. */ *start_sk = sk; @@ -3088,7 +3092,7 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq, struct sock *sk; sock_hold(*start_sk); - iter->batch[iter->end_sk++] = *start_sk; + iter->batch[iter->end_sk++].sk = *start_sk; sk = sk_nulls_next(*start_sk); *start_sk = NULL; @@ -3096,7 +3100,7 @@ static unsigned int bpf_iter_tcp_established_batch(struct seq_file *seq, if (seq_sk_match(seq, sk)) { if (iter->end_sk < iter->max_sk) { sock_hold(sk); - iter->batch[iter->end_sk++] = sk; + iter->batch[iter->end_sk++].sk = sk; } else if (!*start_sk) { /* Remember where we left off. */ *start_sk = sk; @@ -3200,7 +3204,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq) WARN_ON_ONCE(iter->end_sk != expected); done: bpf_iter_tcp_unlock_bucket(seq); - return iter->batch[0]; + return iter->batch[0].sk; } static void *bpf_iter_tcp_seq_start(struct seq_file *seq, loff_t *pos) @@ -3235,11 +3239,11 @@ static void *bpf_iter_tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos) * st->bucket. See tcp_seek_last_pos(). */ st->offset++; - sock_gen_put(iter->batch[iter->cur_sk++]); + sock_gen_put(iter->batch[iter->cur_sk++].sk); } if (iter->cur_sk < iter->end_sk) - sk = iter->batch[iter->cur_sk]; + sk = iter->batch[iter->cur_sk].sk; else sk = bpf_iter_tcp_batch(seq); -- 2.53.0