mptcp_set_timeout() is exposed to BPF MPTCP packet schedulers as a kfunc
taking a generic "struct sock *". The verifier only checks that the
argument is a trusted struct sock; it cannot distinguish an MPTCP-level
socket (msk) from a subflow's TCP socket. A scheduler get_send() program
can therefore pass a subflow socket (e.g. msk->first, or the result of
bpf_mptcp_subflow_tcp_sock()), which mptcp_set_timeout() upcasts via
mptcp_sk() and iterates as msk->conn_list. On a subflow socket those
bytes are live TCP state, so the walk yields a wild mptcp_subflow_context
and the subsequent subflow->tcp_sock dereference faults (GPF / KASAN
user-memory-access).
Narrow the kfunc-facing type: register a bpf_mptcp_set_timeout() wrapper
taking "struct mptcp_sock *" instead of the raw mptcp_set_timeout()
symbol, so the verifier's BTF-id check rejects a non-msk socket at
program load time. A scheduler that passes its msk is unaffected. The
in-tree burst scheduler selftest is updated to the wrapper name in a
separate squash-to.
Found by an MPTCP protocol-flow harness extending BRF (arXiv:2305.08782).
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
net/mptcp/bpf.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/mptcp/bpf.c b/net/mptcp/bpf.c
index 0845061ddc65c..9355fb53e89d5 100644
--- a/net/mptcp/bpf.c
+++ b/net/mptcp/bpf.c
@@ -301,6 +301,11 @@ bpf_sk_stream_memory_free(const struct mptcp_subflow_context *subflow)
return false;
}
+__bpf_kfunc static void bpf_mptcp_set_timeout(struct mptcp_sock *msk)
+{
+ mptcp_set_timeout((struct sock *)msk);
+}
+
__bpf_kfunc_end_defs();
BTF_KFUNCS_START(bpf_mptcp_iter_kfunc_ids)
@@ -319,7 +324,7 @@ BTF_ID_FLAGS(func, bpf_mptcp_subflow_ctx, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_mptcp_subflow_tcp_sock, KF_RET_NULL)
BTF_ID_FLAGS(func, mptcp_subflow_set_scheduled)
BTF_ID_FLAGS(func, mptcp_subflow_active)
-BTF_ID_FLAGS(func, mptcp_set_timeout)
+BTF_ID_FLAGS(func, bpf_mptcp_set_timeout)
BTF_ID_FLAGS(func, mptcp_wnd_end)
BTF_ID_FLAGS(func, bpf_sk_stream_memory_free)
BTF_ID_FLAGS(func, mptcp_pm_subflow_chk_stale, KF_SLEEPABLE)
--
2.34.1