From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC7A93218BA for ; Sat, 25 Jul 2026 00:00:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784937611; cv=none; b=mBM3v5Oqx3ek/U2KUJvz09XcrCSJ+MJCZrWYoGrZT7ezZVRLMndXIoZ5DVf319x77ZqJOGUXtNRvcvNd3oIsZQBaWFTX+iFtnZbC52xAZ3tMGMXZzZd+GRCjpKGxQc9+jRvjKmpgkbuZmejGWi0jFTi0Lzj6aVcq6s9+wS3wAl4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784937611; c=relaxed/simple; bh=wqzcR2Vb3YK2LAiR+yOwfa+Qq5E5XeCpf8ZN6x3EZZo=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=pNnAe9sYs4HA6ANzDwzZxR1fuQrJSM1GBfy/LfoND1t22TTJTTfANzagJW9/bjOynIVHW83YUtlegGyqpfnRqv2c1xXfQJt/6yoGJ6wHwM9fRmwvlM3yp5n2KFLAKhHfApdJn9uCNdT8cWDMqmDLe9Gip5TKI2Evs6lkyhTlWms= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SqvmOCDB; arc=none smtp.client-ip=209.85.210.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SqvmOCDB" Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-84e27035206so934448b3a.3 for ; Fri, 24 Jul 2026 17:00:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784937608; x=1785542408; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=RcfP1cCpEbGNIQWuA4I35j/s62A27Am7wlHhwJwCgdA=; b=SqvmOCDBUFNxIXmlz55nKwKkV8F7azt4a2KqNZyFDCJCxz4Vm3yalP4T/tLmah9Fqr xNjmRhUE52Ri50JePHkkHqKGEKFpdrX+RT0BHje6e0gN3WviacvC7Q5WLMrqSsVhIcow o0+097TyCt+/0D5iAmvCSgpy+TSS8CUEc4HBxwtUFHlXm8OLdjzVHQoxlTtqYr0R0HlC 34vRbCtsWNDf8ratET2IjRPziFNNXN5HEsLiz90NKIjmBKHmjF9s/qJ0wZwTTW0XqaB5 kdms7R07w8MmZ2+RWPAdWPFU9fioxVNW2oWvqjoG5hPQRbUg1hkPVrOAItd5wlXWETdF nRyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784937608; x=1785542408; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=RcfP1cCpEbGNIQWuA4I35j/s62A27Am7wlHhwJwCgdA=; b=A9BOCNDBXUkCJDE9J9CrUfjeN/BXsorO7T05ssBWbAyFsv/e7PLehxaWsmxvTqPLLz Zb5fE5YWvlhcIRnS20obeCiBWboviHjxXGhWqExk0Vgaf3axPqIQkjuJgihL1oHSGmMz oMLiNrze25QXzVl5tzkTu9H1u8utVNY7nUy3pLArw5viMzNOd6yGbjTDIoNxZEgBC622 cV7/z201aFMcArFSrBgg0JAeY/z6VlhhuijpxgI9wAZSbe4lFy/sEzvJ0+YSLHoZUbAh BKJBXGQfsEeTJW763/HMj9jvTiXhSd80KcP04ErycLcd5/7zuIY6GhqTZ23dFUOlK2Al jYoA== X-Forwarded-Encrypted: i=1; AHgh+RolDQUK9NUmwXsmYPUj1wYCstZKSC0XRpiOPf+DY0ZLyAJp/vh28VOqXLcnO42YnwDuIY8FF5S+NtavFR0=@vger.kernel.org X-Gm-Message-State: AOJu0YxKb9yOGrP/85jk1naPwFb9btxPD58vL4rypCAf/VMxjvQgzd+b ULjCw15OYL0BxN9zrCXpPcuyLkUgFrTt4xlhBjk34RNTith5EaGvRzek X-Gm-Gg: AR+sD11hSPTgUYSzcy21oJ100o1X4Ew8OUjTYyNL9qsbF00Yr2rb4bNPzUh8j29Se3h gR2IlLLyF2dV0AY5xyGqtUDOvO7Sqs1fqoVWUqgYBChFeKeBQumJDdGc9Wch5Cp3AxdqaxLJTzq IgxBY6ef5/Jtx21Tn1MMDzVuSP1qPc0wax3NpZVHVxfR3upCqs9lhPH3UHEdnp119IhCi/cSN69 oOm/tWhcAVe4hRO/aUtvLKXumr9EpQ4xRbzOMTJsVOotrn29PCKonDFwn9HKqEflZ5uywHE72yN 0h11A/+ZPaA9DGvGC4GPN96JaFzW/LDoQdkIJrFnt8SnWMrwuBG753+GWci7xk0oWLGMnOCVfME qmAH5eCZtUMyW6ZJTduSFOW/0mAaYGtTZCmx9R6QmpqAmF/9nnzrMDmEDb9Mb0t1hDQu4OPwl3E a6 X-Received: by 2002:aa7:8896:0:b0:847:9745:2f83 with SMTP id d2e1a72fcca58-84e59435becmr296556b3a.18.1784937608025; Fri, 24 Jul 2026 17:00:08 -0700 (PDT) Received: from john-p8 ([98.97.42.174]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84e5327f22fsm535936b3a.13.2026.07.24.17.00.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 17:00:07 -0700 (PDT) Date: Fri, 24 Jul 2026 17:00:05 -0700 From: John Fastabend To: Michal Luczaj Cc: Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , Jakub Sitnicki , Jiayuan Chen , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Stanislav Fomichev , Martin KaFai Lau , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Joe Stringer , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH bpf 1/3] bpf, sockmap: Use sock_hold() instead of refcount_inc_not_zero() in lookup Message-ID: References: <20260723-sockmap-lookup-tcp-leak-v1-0-1bbdc58ce514@rbox.co> <20260723-sockmap-lookup-tcp-leak-v1-1-1bbdc58ce514@rbox.co> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <20260723-sockmap-lookup-tcp-leak-v1-1-1bbdc58ce514@rbox.co> On Thu, Jul 23, 2026 at 01:33:27PM +0200, Michal Luczaj wrote: >psock's hold on the looked up socket isn't dropped until sk_psock_drop() -> >queue_rcu_work() -> sk_psock_destroy() runs, which happens only after the >entry is unlinked and an RCU grace period elapses. Since the lookup runs >under RCU, a non-NULL result guarantees sk_refcnt >= 1: >refcount_inc_not_zero() can never fail here. Use sock_hold() instead. > >Signed-off-by: Michal Luczaj >--- Should bpf-next right? this is an optimization not a fix? > net/core/sock_map.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > >diff --git a/net/core/sock_map.c b/net/core/sock_map.c >index 9efbd8ca7db8..ca49bc7f8687 100644 >--- a/net/core/sock_map.c >+++ b/net/core/sock_map.c >@@ -392,8 +392,8 @@ static void *sock_map_lookup(struct bpf_map *map, void *key) > sk = __sock_map_lookup_elem(map, *(u32 *)key); > if (!sk) > return NULL; >- if (sk_is_refcounted(sk) && !refcount_inc_not_zero(&sk->sk_refcnt)) >- return NULL; >+ if (sk_is_refcounted(sk)) >+ sock_hold(sk); > return sk; > } > >@@ -1218,8 +1218,8 @@ static void *sock_hash_lookup(struct bpf_map *map, void *key) > sk = __sock_hash_lookup_elem(map, key); > if (!sk) > return NULL; >- if (sk_is_refcounted(sk) && !refcount_inc_not_zero(&sk->sk_refcnt)) >- return NULL; >+ if (sk_is_refcounted(sk)) >+ sock_hold(sk); > return sk; > } > > >-- >2.55.0 >