From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f179.google.com (mail-dy1-f179.google.com [74.125.82.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82E1A3ACF02 for ; Tue, 23 Jun 2026 21:19:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782249555; cv=none; b=m8JN1Dw+8lxe8MSrq9tsS9nRxWtNzKO0DIEyWAp95aCxmOz+UQpPpZSwlPiv8BHQcq3+7RIUqKse52FgnvFgsV8Ocm+imx5eABcufd0Uv9jJVrBAT6BbAxIPKi8cvKFoh/K0Aer41lUHtqkMyvpU9xXn4ch4+5Fazzycyd4UMJE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782249555; c=relaxed/simple; bh=wjU+QQV4ZbhrClmDZG0wh2L8aqWrT43sZmShel/LIuw=; h=Mime-Version:Content-Type:Date:Message-Id:Cc:Subject:From:To: References:In-Reply-To; b=W8J8v66VSXgYjlWiqs2qI7bjT3+gjoRJKMeYLzZ+NFjcmmUuOOyQWzByfXZWlJvOEOIqWlCz2RDIpB1kAeYCrKftlNGTUSooa2+R2TZk8XXFQaRNK8LAsfkG+Z3ggsQNv7LoYnWJzLBhIv73nKTb+AmK3bJ6+/Y0V4GKLFnIPyo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=etsalapatis.com; spf=pass smtp.mailfrom=etsalapatis.com; dkim=pass (2048-bit key) header.d=etsalapatis-com.20251104.gappssmtp.com header.i=@etsalapatis-com.20251104.gappssmtp.com header.b=XBhaFr3g; arc=none smtp.client-ip=74.125.82.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=etsalapatis.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=etsalapatis.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=etsalapatis-com.20251104.gappssmtp.com header.i=@etsalapatis-com.20251104.gappssmtp.com header.b="XBhaFr3g" Received: by mail-dy1-f179.google.com with SMTP id 5a478bee46e88-30c09f29b64so286699eec.0 for ; Tue, 23 Jun 2026 14:19:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=etsalapatis-com.20251104.gappssmtp.com; s=20251104; t=1782249554; x=1782854354; darn=vger.kernel.org; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=YdxmerIAihadrns5k6AeCU+dX7jwGWrd5Ynsr92j6uE=; b=XBhaFr3gRyUgr3akoYHpuKyF/S6FyR4zDIpUJZzvE6L+RDzhxBFzCRRJwJTOViKwQY PhaFT5Zqd6w0Q+iFrBhRPwOJljeT1MMiDhc0hYr8NU9vTUYocB7E07KBWxvV0xmwV2u3 T7Qs0z9mPTehQYRn0OMGK5VcaBu+IFA1Z+VSXOBIVPEfFIKM8Qrl1dHWSY8uqsmksNFT xjRxFEsyLMiF1uVFVwAExfQOUZ+FeCSiLuxwhIsQTKlwjIMfJ6TPgDe1dUm9P1zabfqC ITJGAmD6MC/4jyWlKnV6eJIH+3VUoztvFNo9N41u6D3kaZAkSZwjS0kMvvwSFKmlS3nz D7sg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782249554; x=1782854354; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=YdxmerIAihadrns5k6AeCU+dX7jwGWrd5Ynsr92j6uE=; b=eSv76mPUFVz4jsWbnu/pnzTBxdgLP2fuEZx5YuoyQqF5dnmdTia7KD92cs5JhSkFB1 7f7rq0qepb1D9oeAg0n3pxJvlIiWsVksT1zpDUuScXc+07bjjMJaRWXw1MBNDe7Yhm1f gtS9ebtnOlPAQdvC72+7D961dGB/PXalIeowjecds5h5ciXcFFKuY4WsWchBUoN1DtaY SPuYkyr2RmrIXF/ohi0tB6Vt78fstaGYayJEloSgeQaMrQnCQd1axQA4LwIxaECNkBGl /aT100eB7aQe+v95tlKLViFg7H1JYM37GXGr2NDMBx/w/OOXhCpcsThF3f60qizBGo+O EhZA== X-Gm-Message-State: AOJu0YyLfnJ3ofsYY+mT4z4BMEVK4WH98p2HinILM3x46NN2q7Uvp6Fe RHHm8OY8/64vXjXOM0FcKs7/UnjBpHHCRFGgG0ZFcKNSoJqLcFcW/3oBYfQB1jOhVo4= X-Gm-Gg: AfdE7cle+7fjHCsD1zHWK4bhZnDklnvQAMSP62qgHEnNEOQLD/eOdIwzrBz3pO1GEVb +GMsgS0puMWp2KPC79FcyQ0xzzlo5xYShd6DzizmlBq1iiMVIMJV+/mlqHyZ23HmyN2SGDQ1kSs CK2Ix6KZ6jqWueprjYZGm5D05XGO4Z/SbbkC/2EsnTqnuiZs9+lf25YWCqj1nRbneyEmRQqSOE8 xiOKEiGbLnWdzbMdpvRpDrnb/AoMbfvRBI7PWA8mcPJvcVZxO77XX0YXSqrqw98zIYVdfoF5GET jiD8nY498fF2I0X//DHkudVj8yj1yCBApnEv2om3GjN9p9wUvrOoxKxR4xxoDCINZy8LCE86Vt2 zuYf6vefxgTIquGGL03zcAcrVO20DrQKdKcqkJ+dl5YbdMf9HqlXpnz91aiGO2+X+75DJNQ== X-Received: by 2002:a05:7301:3e0b:b0:30a:e52f:9b99 with SMTP id 5a478bee46e88-30c553f5be2mr4493143eec.0.1782249553428; Tue, 23 Jun 2026 14:19:13 -0700 (PDT) Received: from localhost ([2620:10d:c090:600::2526]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30c1be4967fsm17804817eec.26.2026.06.23.14.19.10 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 23 Jun 2026 14:19:13 -0700 (PDT) Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Tue, 23 Jun 2026 17:19:10 -0400 Message-Id: Cc: , , , Subject: Re: [PATCH bpf 1/2] bpf, sockmap: Don't leak UDP socks on lookup-bind-release From: "Emil Tsalapatis" To: "Michal Luczaj" , "John Fastabend" , "Jakub Sitnicki" , "Jiayuan Chen" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , "Simon Horman" , "Alexei Starovoitov" , "Cong Wang" , "Daniel Borkmann" , "Andrii Nakryiko" , "Eduard Zingerman" , "Kumar Kartikeya Dwivedi" , "Martin KaFai Lau" , "Song Liu" , "Yonghong Song" , "Jiri Olsa" , "Emil Tsalapatis" , "Shuah Khan" X-Mailer: aerc 0.21.0-0-g5549850facc2 References: <20260623-sockmap-lookup-udp-leak-v1-0-05804f9308e4@rbox.co> <20260623-sockmap-lookup-udp-leak-v1-1-05804f9308e4@rbox.co> In-Reply-To: <20260623-sockmap-lookup-udp-leak-v1-1-05804f9308e4@rbox.co> On Tue Jun 23, 2026 at 2:03 PM EDT, Michal Luczaj wrote: > UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means > sk_is_refcounted(unbound) =3D true, while sk_is_refcounted(bound) =3D fal= se. > > Because sockmap accepts unbound UDP sockets, a BPF program can increment = a > socket's refcount via lookup. If the socket is subsequently bound, the > transition from unbound to bound causes bpf_sk_release() to skip the > decrement of the refcount, causing a memory leak. > > unreferenced object 0xffff88810bc2eb40 (size 1984): > comm "test_progs", pid 2451, jiffies 4295320596 > hex dump (first 32 bytes): > 7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................ > 02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ > backtrace (crc bdee079d): > kmem_cache_alloc_noprof+0x557/0x660 > sk_prot_alloc+0x69/0x240 > sk_alloc+0x30/0x460 > inet_create+0x2ce/0xf80 > __sock_create+0x25b/0x5c0 > __sys_socket+0x119/0x1d0 > __x64_sys_socket+0x72/0xd0 > do_syscall_64+0xa1/0x5f0 > entry_SYSCALL_64_after_hwframe+0x76/0x7e > > Maintain balanced refcounts across sk lookup/release: (re-)set > SOCK_RCU_FREE on proto update to treat the socket (whether bound or > unbound) as not requiring a refcount increment on (a RCU protected) looku= p. > > Fixes: 0c48eefae712 ("sock_map: Lift socket state restriction for datagra= m sockets") > Signed-off-by: Michal Luczaj Reviewed-by: Emil Tsalapatis > --- > Note: this issue is related to commit 67312adc96b5 ("bpf: reject unhashed > sockets in bpf_sk_assign"). > --- > net/ipv4/udp_bpf.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/ipv4/udp_bpf.c b/net/ipv4/udp_bpf.c > index ad57c4c9eaab..970327b59582 100644 > --- a/net/ipv4/udp_bpf.c > +++ b/net/ipv4/udp_bpf.c > @@ -173,6 +173,9 @@ int udp_bpf_update_proto(struct sock *sk, struct sk_p= sock *psock, bool restore) > if (sk->sk_family =3D=3D AF_INET6) > udp_bpf_check_v6_needs_rebuild(psock->sk_proto); > =20 > + /* Treat all sockets as non-refcounted, regardless of binding state. */ > + sock_set_flag(sk, SOCK_RCU_FREE); > + > sock_replace_proto(sk, &udp_bpf_prots[family]); > return 0; > }