[PATCH bpf v4 0/2] bpf: guard sock_ops rtt_min against non-locked tcp_sock

[Werner Kasselman <werner@verivus.ai>]

sock_ops ctx rewriting guards the direct tcp_sock field loads with
is_locked_tcp_sock, but rtt_min still used a raw load sequence. On
request_sock-backed sock_ops callbacks, that can read past the end of a
tcp_request_sock allocation.

This series switches rtt_min over to the shared guarded tcp_sock field
load helper and adds a tcpbpf runtime test that exercises the
same-register request_sock path.

v3 -> v4:
- reuse a shared guarded tcp_sock field load helper for rtt_min
- preserve the dst_reg == src_reg failure path that zeros the destination
  register when the guard fails
- replace the weaker ctx_rewrite test with a runtime tcpbpf selftest that
  exercises same-register request_sock access

Werner Kasselman (2):
  bpf: guard sock_ops rtt_min against non-locked tcp_sock
  selftests/bpf: cover same-reg sock_ops rtt_min request_sock access

 net/core/filter.c                             | 39 ++++++++++---------
 .../selftests/bpf/prog_tests/tcpbpf_user.c    |  4 ++
 .../selftests/bpf/progs/test_tcpbpf_kern.c    | 14 +++++++
 tools/testing/selftests/bpf/test_tcpbpf.h     |  2 +
 4 files changed, 40 insertions(+), 19 deletions(-)

-- 
2.43.0