[PATCH bpf v5 0/2] bpf: guard sock_ops rtt_min against non-locked tcp_sock

Werner Kasselman
2026-04-20T23:00:42Z

sock_ops ctx rewriting guards the direct tcp_sock field loads with
is_locked_tcp_sock, but rtt_min still used a raw load sequence. On
request_sock-backed sock_ops callbacks, that can read past the end of a
tcp_request_sock allocation.

This series switches rtt_min over to the shared guarded tcp_sock field
load helper and adds a tcpbpf runtime test that exercises the
same-register request_sock path.

v4 -> v5:
- rebase onto current origin/master to address CI conflict
- no functional changes beyond the rebase

Werner Kasselman (2):
bpf: guard sock_ops rtt_min against non-locked tcp_sock
selftests/bpf: cover same-reg sock_ops rtt_min request_sock access

net/core/filter.c | 36 +++++++++----------
.../selftests/bpf/prog_tests/tcpbpf_user.c | 4 +++
.../selftests/bpf/progs/test_tcpbpf_kern.c | 14 ++++++++
tools/testing/selftests/bpf/test_tcpbpf.h | 2 ++
4 files changed, 38 insertions(+), 18 deletions(-)

--
2.43.0