From nobody Thu Apr 2 11:03:41 2026 Received: from mailtransmit05.runbox.com (mailtransmit05.runbox.com [185.226.149.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9F36370D54; Thu, 5 Mar 2026 23:31:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.38 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772753520; cv=none; b=jgMyoXX58AJ9jxnvXGvHM4F0wxKolY+7uvezo3dwzrPXCxRq4thlnu0QXc+WvstRjDo5MQ7QBsF7ZNpZMtlo1XFt7/VhJ2XLfzu/s3xHaKc1GXmtqq4nQh23hYVIC6NzQ3FsGWpen8ouQArQ85loiOvSvXRTwhtWxN2EIQhtKbw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772753520; c=relaxed/simple; bh=gdJT7K1pKjQBOSjWRelJahkezXPG1ww/h/3ZYeVts6M=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=uas4kbnPSEz03XXczq5WSLfTnKZuNEaYtWCcXmnOCHJaXNHivn36OL2+O2MrSyDGke/HSvy9APNBdhee4R4RgDHn2IsFxcqxCPyzxSBR5MU11xd4bvZdQvkJR4vuyZ0NGKRQe03VV0DAm5r4+dkNihxE/kEChH10Ek6MZqh6XD0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=bGZon8dJ; arc=none smtp.client-ip=185.226.149.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="bGZon8dJ" Received: from mailtransmit02.runbox ([10.9.9.162] helo=aibo.runbox.com) by mailtransmit05.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1vyIAP-00EUZ1-Kc; Fri, 06 Mar 2026 00:31:41 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector1; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=8LWn31xqqYR+DksBi9atiCH/RgX+9qrk7M9IefQaoMc=; b=bGZon8dJbeXZyyTY4uSgtjXTa+ zB4PHn92c/D5m55kF0HgorZl4z+cvCthP7pw9goRRYszTXpEA6hdQO65LWhj2l3OI8G+yv7x232GU TU4DFW2dvTUEbmIA/qkWJePUqICTTwttm7JVGNVhjPV/YxHKKVvhpOM/RT3CMZpYkhgKk342k1BnR G0Yfv5HIYlhzz9qp2u1H7o2zuDBfZnh+cyqKkPdSXo+3dxNxrIXDnQk0m7HrRp2Wt30h2HQEiDy2T zdFK7xl1vjqQCRKy5AqZg1aNEKa+trd6mXLYo/gRsskbwPbPo4JCm9L4S903xahWrXwr2NOrIEFvg cAmmWsSg==; Received: from [10.9.9.73] (helo=submission02.runbox) by mailtransmit02.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1vyIAP-0004Bc-BG; Fri, 06 Mar 2026 00:31:41 +0100 Received: by submission02.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.93) id 1vyIAH-00141B-KO; Fri, 06 Mar 2026 00:31:33 +0100 From: Michal Luczaj Date: Fri, 06 Mar 2026 00:30:55 +0100 Subject: [PATCH bpf v3 1/5] bpf, sockmap: Annotate af_unix sock::sk_state data-races Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260306-unix-proto-update-null-ptr-deref-v3-1-2f0c7410c523@rbox.co> References: <20260306-unix-proto-update-null-ptr-deref-v3-0-2f0c7410c523@rbox.co> In-Reply-To: <20260306-unix-proto-update-null-ptr-deref-v3-0-2f0c7410c523@rbox.co> To: John Fastabend , Jakub Sitnicki , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , "David S. Miller" , Jakub Kicinski , Simon Horman , Yonghong Song , Andrii Nakryiko , Alexei Starovoitov , Daniel Borkmann , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Cong Wang Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Michal Luczaj X-Mailer: b4 0.14.3 sock_map_sk_state_allowed() and sock_map_redirect_allowed() read af_unix socket sk_state locklessly. Use READ_ONCE(). Note that for sock_map_redirect_allowed() change affects not only af_unix, but all non-TCP sockets (UDP, af_vsock). Suggested-by: Kuniyuki Iwashima Suggested-by: Martin KaFai Lau Signed-off-by: Michal Luczaj Reviewed-by: Jiayuan Chen Reviewed-by: Kuniyuki Iwashima --- net/core/sock_map.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/sock_map.c b/net/core/sock_map.c index b0e96337a269..02a68be3002a 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -530,7 +530,7 @@ static bool sock_map_redirect_allowed(const struct sock= *sk) if (sk_is_tcp(sk)) return sk->sk_state !=3D TCP_LISTEN; else - return sk->sk_state =3D=3D TCP_ESTABLISHED; + return READ_ONCE(sk->sk_state) =3D=3D TCP_ESTABLISHED; } =20 static bool sock_map_sk_is_suitable(const struct sock *sk) @@ -543,7 +543,7 @@ static bool sock_map_sk_state_allowed(const struct sock= *sk) if (sk_is_tcp(sk)) return (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_LISTEN); if (sk_is_stream_unix(sk)) - return (1 << sk->sk_state) & TCPF_ESTABLISHED; + return (1 << READ_ONCE(sk->sk_state)) & TCPF_ESTABLISHED; if (sk_is_vsock(sk) && (sk->sk_type =3D=3D SOCK_STREAM || sk->sk_type =3D=3D SOCK_SEQPACKET)) return (1 << sk->sk_state) & TCPF_ESTABLISHED; --=20 2.52.0