[PATCH bpf v4 0/2] bpf: guard sock_ops rtt_min against non-locked tcp_sock

Werner Kasselman
2026-04-20T22:16:29Z

sock_ops ctx rewriting guards the direct tcp_sock field loads with
is_locked_tcp_sock, but rtt_min still used a raw load sequence. On
request_sock-backed sock_ops callbacks, that can read past the end of a
tcp_request_sock allocation.

This series switches rtt_min over to the shared guarded tcp_sock field
load helper and adds a tcpbpf runtime test that exercises the
same-register request_sock path.

v3 -> v4:
- reuse a shared guarded tcp_sock field load helper for rtt_min
- preserve the dst_reg == src_reg failure path that zeros the destination
register when the guard fails
- replace the weaker ctx_rewrite test with a runtime tcpbpf selftest that
exercises same-register request_sock access

Werner Kasselman (2):
bpf: guard sock_ops rtt_min against non-locked tcp_sock
selftests/bpf: cover same-reg sock_ops rtt_min request_sock access

net/core/filter.c | 39 ++++++++++---------
.../selftests/bpf/prog_tests/tcpbpf_user.c | 4 ++
.../selftests/bpf/progs/test_tcpbpf_kern.c | 14 +++++++
tools/testing/selftests/bpf/test_tcpbpf.h | 2 +
4 files changed, 40 insertions(+), 19 deletions(-)

--
2.43.0