Two BPF MPTCP packet-scheduler kfuncs accept a generic "struct sock *"
but internally reinterpret it as a specific role (the MPTCP-level
socket, or a subflow's TCP socket). The verifier only enforces that the
argument is a trusted struct sock, so a scheduler struct_ops program can
pass the wrong kind of socket; the kfunc then upcasts and dereferences
it, causing wild pointer use. Both are reachable from a scheduler hook
with no privilege beyond loading the scheduler.
Patch 1: mptcp_set_timeout() expects the msk. A subflow socket passed
instead is cast via mptcp_sk() and walked as msk->conn_list, causing a
GPF. Found by an MPTCP protocol-flow harness extending BRF
(arXiv:2305.08782). Fixed by narrowing the kfunc arg to
struct mptcp_sock *, so the verifier rejects a non-msk socket at load.
Patch 2: mptcp_pm_subflow_chk_stale()'s ssk arg is a subflow TCP
socket; a non-subflow socket passed in is reinterpreted via
mptcp_subflow_ctx() and both read and written through. This kfunc
legitimately takes a generic socket, so it is fixed with a runtime
role check in a __bpf_kfunc wrapper, like bpf_mptcp_subflow_ctx().
Patch 3: adds a negative selftest: a scheduler that passes a subflow
socket to the narrowed bpf_mptcp_set_timeout() must be rejected by the
verifier; the test asserts the specific load-time type-mismatch
message.
Patch 4: extends that selftest into a small suite guarding both socket
type-confusion directions across the narrow-typed scheduler kfunc
surface (mptcp_wnd_end and mptcp_subflow_set_scheduled), so the
contract cannot silently regress.
Patches 1 and 2 are squash-to "bpf: Export mptcp packet scheduler
helpers" and update the in-tree burst scheduler selftest to the new
kfunc names.
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
Shardul Bankar (4):
Squash to "bpf: Export mptcp packet scheduler helpers"
Squash to "bpf: Export mptcp packet scheduler helpers"
selftests/bpf: mptcp: verify scheduler rejects non-msk socket to set_timeout
selftests/bpf: mptcp: extend bad scheduler test to the kfunc type contract
net/mptcp/bpf.c | 17 +++-
tools/testing/selftests/bpf/prog_tests/mptcp.c | 57 ++++++++++++
.../selftests/bpf/progs/mptcp_bpf_bad_sched.c | 100 +++++++++++++++++++++
.../testing/selftests/bpf/progs/mptcp_bpf_burst.c | 8 +-
4 files changed, 176 insertions(+), 6 deletions(-)
---
base-commit: ba8940c77ff7e7f3081e7e3d8a9146000a3ff2aa
change-id: 20260629-mptcp_bpf_kfunc_fixes-7ab60edc2902
Best regards,
--
Shardul Bankar <shardul.b@mpiricsoftware.com>