[PATCH bpf v5 0/2] bpf: guard sock_ops rtt_min against non-locked tcp_sock

[Werner Kasselman <werner@verivus.ai>]

sock_ops ctx rewriting guards the direct tcp_sock field loads with
is_locked_tcp_sock, but rtt_min still used a raw load sequence. On
request_sock-backed sock_ops callbacks, that can read past the end of a
tcp_request_sock allocation.

This series switches rtt_min over to the shared guarded tcp_sock field
load helper and adds a tcpbpf runtime test that exercises the
same-register request_sock path.

v4 -> v5:
- rebase onto current origin/master to address CI conflict
- no functional changes beyond the rebase

Werner Kasselman (2):
  bpf: guard sock_ops rtt_min against non-locked tcp_sock
  selftests/bpf: cover same-reg sock_ops rtt_min request_sock access

 net/core/filter.c                             | 36 +++++++++----------
 .../selftests/bpf/prog_tests/tcpbpf_user.c    |  4 +++
 .../selftests/bpf/progs/test_tcpbpf_kern.c    | 14 ++++++++
 tools/testing/selftests/bpf/test_tcpbpf.h     |  2 ++
 4 files changed, 38 insertions(+), 18 deletions(-)

-- 
2.43.0