* [PATCH net] tcp: clear sock_ops cb flags before force-closing a child socket
@ 2026-06-05 9:49 Sechang Lim
2026-06-05 11:16 ` Jiayuan Chen
0 siblings, 1 reply; 2+ messages in thread
From: Sechang Lim @ 2026-06-05 9:49 UTC (permalink / raw)
To: Eric Dumazet, Neal Cardwell, David S . Miller, Jakub Kicinski,
Paolo Abeni
Cc: Kuniyuki Iwashima, Simon Horman, Lawrence Brakmo,
Alexei Starovoitov, netdev, linux-kernel, bpf
A child socket inherits the listener's bpf_sock_ops_cb_flags via
sk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() /
tcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where
inet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs
without it.
If BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state()
calls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me():
WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550
RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799
Call Trace:
<IRQ>
tcp_done+0xba/0x250 net/ipv4/tcp.c:5095
tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787
tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926
tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164
</IRQ>
The child is freed before it is ever established, so it should run no
sock_ops callback. Clear its cb flags before the forced close.
Fixes: d44874910a26 ("bpf: Add BPF_SOCK_OPS_STATE_CB")
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
---
include/net/tcp.h | 7 +++++++
net/ipv4/tcp_ipv4.c | 1 +
net/ipv6/tcp_ipv6.c | 1 +
3 files changed, 9 insertions(+)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 98848db62894..97eac5fa341c 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2942,6 +2942,11 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2,
return tcp_call_bpf(sk, op, 3, args);
}
+static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk)
+{
+ tcp_sk(sk)->bpf_sock_ops_cb_flags = 0;
+}
+
#else
static inline int tcp_call_bpf(struct sock *sk, int op, u32 nargs, u32 *args)
{
@@ -2959,6 +2964,8 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2,
return -EPERM;
}
+static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk) {}
+
#endif
static inline u32 tcp_timeout_init(struct sock *sk)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index fdc81150ff6c..7748668dba82 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1783,6 +1783,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
return NULL;
put_and_exit:
newinet->inet_opt = NULL;
+ tcp_clear_sock_ops_cb_flags(newsk);
inet_csk_prepare_forced_close(newsk);
tcp_done(newsk);
goto exit;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 36d75fb50a70..493477b786db 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1531,6 +1531,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
tcp_listendrop(sk);
return NULL;
put_and_exit:
+ tcp_clear_sock_ops_cb_flags(newsk);
inet_csk_prepare_forced_close(newsk);
tcp_done(newsk);
goto exit;
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH net] tcp: clear sock_ops cb flags before force-closing a child socket
2026-06-05 9:49 [PATCH net] tcp: clear sock_ops cb flags before force-closing a child socket Sechang Lim
@ 2026-06-05 11:16 ` Jiayuan Chen
0 siblings, 0 replies; 2+ messages in thread
From: Jiayuan Chen @ 2026-06-05 11:16 UTC (permalink / raw)
To: Sechang Lim, Eric Dumazet, Neal Cardwell, David S . Miller,
Jakub Kicinski, Paolo Abeni
Cc: Kuniyuki Iwashima, Simon Horman, Lawrence Brakmo,
Alexei Starovoitov, netdev, linux-kernel, bpf
On 6/5/26 5:49 PM, Sechang Lim wrote:
> A child socket inherits the listener's bpf_sock_ops_cb_flags via
> sk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() /
> tcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where
> inet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs
> without it.
>
> If BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state()
> calls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me():
>
> WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550
> RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799
> Call Trace:
> <IRQ>
> tcp_done+0xba/0x250 net/ipv4/tcp.c:5095
> tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787
> tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926
> tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164
> </IRQ>
>
> The child is freed before it is ever established, so it should run no
> sock_ops callback. Clear its cb flags before the forced close.
>
> Fixes: d44874910a26 ("bpf: Add BPF_SOCK_OPS_STATE_CB")
> Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
> ---
> include/net/tcp.h | 7 +++++++
> net/ipv4/tcp_ipv4.c | 1 +
> net/ipv6/tcp_ipv6.c | 1 +
> 3 files changed, 9 insertions(+)
>
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 98848db62894..97eac5fa341c 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -2942,6 +2942,11 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2,
> return tcp_call_bpf(sk, op, 3, args);
> }
>
> +static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk)
> +{
> + tcp_sk(sk)->bpf_sock_ops_cb_flags = 0;
> +}
> +
> #else
> static inline int tcp_call_bpf(struct sock *sk, int op, u32 nargs, u32 *args)
> {
> @@ -2959,6 +2964,8 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2,
> return -EPERM;
> }
>
> +static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk) {}
> +
> #endif
>
> static inline u32 tcp_timeout_init(struct sock *sk)
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index fdc81150ff6c..7748668dba82 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -1783,6 +1783,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
> return NULL;
> put_and_exit:
> newinet->inet_opt = NULL;
> + tcp_clear_sock_ops_cb_flags(newsk);
> inet_csk_prepare_forced_close(newsk);
I prefer clearing the bit in inet_csk_prepare_forced_close(), since it
looks like inet_csk_prepare_forced_close()
is already a TCP-specific function.
Let's wait for the TCP maintainer's.
> tcp_done(newsk);
> goto exit;
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index 36d75fb50a70..493477b786db 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -1531,6 +1531,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
> tcp_listendrop(sk);
> return NULL;
> put_and_exit:
> + tcp_clear_sock_ops_cb_flags(newsk);
> inet_csk_prepare_forced_close(newsk);
> tcp_done(newsk);
> goto exit;
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-05 11:16 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-05 9:49 [PATCH net] tcp: clear sock_ops cb flags before force-closing a child socket Sechang Lim
2026-06-05 11:16 ` Jiayuan Chen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox