From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: Kuniyuki Iwashima <kuniyu@google.com>
Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>,
Alexei Starovoitov <ast@kernel.org>, bpf <bpf@vger.kernel.org>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Martin KaFai Lau <martin.lau@linux.dev>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>, Shuah Khan <shuah@kernel.org>,
Joe Stringer <joe@wand.net.nz>,
Network Development <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@vger.kernel.org>
Subject: Re: [PATCH bpf v8 1/2] net: Validate protocol in skb_steal_sock() for BPF-assigned sockets
Date: Wed, 10 Jun 2026 09:37:16 +0800 [thread overview]
Message-ID: <82860b36-4a8a-43df-a737-1bed1d42d2c4@linux.dev> (raw)
In-Reply-To: <CAAVpQUC=AJvJS1yppw+aAVpmRhB6GganrUKMsKSo7WUKNkZHfA@mail.gmail.com>
On 6/10/26 1:14 AM, Kuniyuki Iwashima wrote:
>> Hi Kuniyuki and Alexei,
>>
>>
>> Thanks both for the discussion, it makes sense to me.
>>
>> I'll go back to fixing this in the helper itself, like the previous
>> version did.
> I think even the previous version is the same type of change
> for intentional misuse.
>
> Both bpf_sk_assign() and bpf_sk_assign_tcp_reqsk() assumes
> sk_lookup() in advance, meaning the bpf must have dissected
> skb, and bpf_sk_assign() relies on it and has no protocol check.
Hi Kuniyuki,
Fair point. The "immutable skb" idea is more more worthy.
next prev parent reply other threads:[~2026-06-10 1:37 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-08 12:58 [PATCH bpf v8 0/2] bpf: tcp: Fix null-ptr-deref in arbitrary SYN Cookie Jiayuan Chen
2026-06-08 12:58 ` [PATCH bpf v8 1/2] net: Validate protocol in skb_steal_sock() for BPF-assigned sockets Jiayuan Chen
2026-06-08 13:31 ` bot+bpf-ci
2026-06-08 17:21 ` Kuniyuki Iwashima
2026-06-08 20:02 ` Alexei Starovoitov
2026-06-08 20:55 ` Kuniyuki Iwashima
2026-06-08 21:25 ` Alexei Starovoitov
2026-06-08 21:35 ` Kuniyuki Iwashima
2026-06-08 22:16 ` Alexei Starovoitov
2026-06-08 22:34 ` Kuniyuki Iwashima
2026-06-09 13:54 ` Jiayuan Chen
2026-06-09 17:14 ` Kuniyuki Iwashima
2026-06-10 1:37 ` Jiayuan Chen [this message]
2026-06-08 12:58 ` [PATCH bpf v8 2/2] selftests/bpf: Add protocol check test for bpf_sk_assign_tcp_reqsk() Jiayuan Chen
2026-06-08 13:31 ` bot+bpf-ci
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=82860b36-4a8a-43df-a737-1bed1d42d2c4@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=joe@wand.net.nz \
--cc=jolsa@kernel.org \
--cc=kuba@kernel.org \
--cc=kuniyu@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox