From nobody Sat Jul 25 06:09:17 2026 Received: from out-180.mta0.migadu.com (out-180.mta0.migadu.com [91.218.175.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF2DB32B10B for ; Fri, 17 Jul 2026 02:34:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784255666; cv=none; b=bs3z4iyd4jY0SgattBjfTZ31wTemH6tKVykiFqBSRD6pTezEAHz8BSjY5p/tP0SlzKkplpMDUha95VFkV7+S78v9HFk4yh/EHG1OGSwVbLblDnC+2Gxqdn0qM/SnJZqGlCbvw2JRAqVQRMKFurcbDoYsqQ6Q8g55Uj98wRkRQrw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784255666; c=relaxed/simple; bh=Brr5YpvyIEbwl6bXGjVS+6/FYUh1bXbGFn6QyWdneys=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=MyeyxkqF3hY886DjrhLCVFPhnvIeS43B9q1dOqCgrkXIrS+a3Uhr73an+bvtze7Bgzuwt/kgIlFm4veDDBSuDl8BMAtpHiKMhwWsGMICNzxEtorEO7cIoY/4yQW6tJm8s5y7U/chi8SN6ls/nk5tkXyXEJmWOyJxFGSBxydsnLw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=BraKDExx; arc=none smtp.client-ip=91.218.175.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="BraKDExx" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1784255661; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4T94ezU5X0wUKTtG7idgEvi4FCGsEKNO8D+AVcM+Pq8=; b=BraKDExxOv/rpCW+7IUKFUbEvd/xN/i8RiKM6ceK/Kc2sYmZN9LBeOBL7qJN72+8CcrZtk SJjGFCTCE4fs62aiFNuEmXasi3ZWBUM5yqAaRHMsszzf96ZSLa7iCC3I7fF1ivc8ouC2wB BncdCribXsVLJ+rbL5QvLD6geagLL+I= From: "Jose Fernandez (Anthropic)" Date: Fri, 17 Jul 2026 02:33:43 +0000 Subject: [PATCH bpf v2] bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260717-bpf-iter-tcp-refcnt-v2-1-8e81f0ac6f3e@linux.dev> X-B4-Tracking: v=1; b=H4sIAIaUWWoC/22Nyw6CMBREf4XctVdoeUhd+R+GBS0XqSGFtIVgC P9ugaUuZzJzzgqOrCYH92gFS7N2ejAh8EsEqqvNi1A3IQNPeJEUTKAcW9SeLHo1oqVWGY8suTU 5lzwtmxrCcwy9Xg7qE8IBqrN0k3yT8jtvn3Xa+cF+DvfMjvGp4clfzcyQYVmmshVUiEzkj16ba bk2NEO1BaCsHaG0tVHd7ujHWGbxWf7iYNu+4JK8KP4AAAA= X-Change-ID: 20260619-bpf-iter-tcp-refcnt-107d52b238da To: Eric Dumazet , Neal Cardwell , Kuniyuki Iwashima , "David S. Miller" , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrii Nakryiko , Yonghong Song , Martin KaFai Lau Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, Daniel Borkmann , Jiayuan Chen , Emil Tsalapatis , "Jose Fernandez (Anthropic)" X-Migadu-Flow: FLOW_OUT reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt to 3. Lockless readers such as __inet_lookup_established() handle this with refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain sock_hold() while holding the bucket lock, on the assumption that the lock guarantees sk_refcnt > 0. That assumption does not hold for request_sock: CPU 0 CPU 1 ----- ----- tcp_conn_request() reqsk_queue_hash_req() inet_ehash_insert(req) spin_lock(bucket) __sk_nulls_add_node_rcu(req) // rsk_refcnt =3D=3D 0 spin_unlock(bucket) bpf_iter_tcp_established_batch() spin_lock(bucket) sock_hold(req) <-- addition on 0 spin_unlock(bucket) refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value which surfaces as: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1 Call Trace: bpf_iter_tcp_established_batch+0x14e/0x170 bpf_iter_tcp_batch+0x53/0x200 bpf_iter_tcp_seq_next+0x27/0x70 bpf_seq_read+0x107/0x410 vfs_read+0xb9/0x380 The iterator's stolen reference is lost when the publishing CPU's refcount_set() overwrites the count, leaving the socket one reference short. When the last legitimate owner drops its reference the reqsk is freed while still reachable, leading to use-after-free. This reproduces in seconds with tcp_syncookies=3D0, a handful of threads doing connect()/close() to a local listener while others read an iter/tcp link in a tight loop. Use refcount_inc_not_zero() and skip the socket on failure. A skipped socket is still part of the bucket, so keep counting it in expected. The reallocations are sized from expected, and a request sock whose refcount gets published while the lock is held across the last realloc must already have room. A skipped socket is counted in expected but never batched, so end_sk can be short of expected on a batch that is actually complete. Decide completeness by whether the walk left any socket behind instead. The WARN after the locked realloc checks the same, replacing an end_sk =3D=3D expected check that could not hold on that path since cdec67a489d4. If every matching socket in a bucket is mid-init (refcount 0), end_sk stays 0. Advance to the next bucket rather than returning a batch entry that was never filled this round. Fixes: 04c7820b776f ("bpf: tcp: Bpf iter batching and lock_sock") Assisted-by: Claude:unspecified Signed-off-by: Jose Fernandez (Anthropic) --- Changes in v2: - Count expected right after seq_sk_match() so the batch reallocations are sized for the whole bucket, including request socks whose refcount is not yet published (Kuniyuki) - Signal batch completeness by the walk leaving no leftover socket instead of end_sk =3D=3D expected, and check the same condition in the WARN after the locked reallocation - Drop the Reviewed-by tags given the code changes - Rebase onto bpf/master - Link to v1: https://lore.kernel.org/bpf/20260620-bpf-iter-tcp-refcnt-v1-1= -883bf9e69495@linux.dev The pre-existing double-put on the realloc failure path (raised in the v1 thread) will be addressed in a separate follow-up patch. --- net/ipv4/tcp_ipv4.c | 44 +++++++++++++++++++++++++------------------- 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 209ef7522508..d8640d114c0d 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -3073,24 +3073,24 @@ static unsigned int bpf_iter_tcp_established_batch(= struct seq_file *seq, { struct bpf_tcp_iter_state *iter =3D seq->private; struct hlist_nulls_node *node; - unsigned int expected =3D 1; - struct sock *sk; + unsigned int expected =3D 0; + struct sock *sk =3D *start_sk; =20 - sock_hold(*start_sk); - iter->batch[iter->end_sk++].sk =3D *start_sk; - - sk =3D sk_nulls_next(*start_sk); *start_sk =3D NULL; sk_nulls_for_each_from(sk, node) { - if (seq_sk_match(seq, sk)) { - if (iter->end_sk < iter->max_sk) { - sock_hold(sk); - iter->batch[iter->end_sk++].sk =3D sk; - } else if (!*start_sk) { - /* Remember where we left off. */ - *start_sk =3D sk; - } - expected++; + if (!seq_sk_match(seq, sk)) + continue; + expected++; + if (iter->end_sk < iter->max_sk) { + /* reqsk_queue_hash_req() inserts with sk_refcnt =3D=3D 0 + * and refcount_set()s it after the bucket lock drops. + */ + if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt))) + continue; + iter->batch[iter->end_sk++].sk =3D sk; + } else if (!*start_sk) { + /* Remember where we left off. */ + *start_sk =3D sk; } } =20 @@ -3128,12 +3128,14 @@ static struct sock *bpf_iter_tcp_batch(struct seq_f= ile *seq) struct sock *sk; int err; =20 +again: sk =3D bpf_iter_tcp_resume(seq); if (!sk) return NULL; /* Done */ =20 expected =3D bpf_iter_fill_batch(seq, &sk); - if (likely(iter->end_sk =3D=3D expected)) + /* sk carries the first socket that did not fit in the batch. */ + if (likely(!sk)) goto done; =20 /* Batch size was too small. */ @@ -3149,7 +3151,7 @@ static struct sock *bpf_iter_tcp_batch(struct seq_fil= e *seq) return NULL; /* Done */ =20 expected =3D bpf_iter_fill_batch(seq, &sk); - if (likely(iter->end_sk =3D=3D expected)) + if (likely(!sk)) goto done; =20 /* Batch size was still too small. Hold onto the lock while we try @@ -3162,10 +3164,14 @@ static struct sock *bpf_iter_tcp_batch(struct seq_f= ile *seq) return ERR_PTR(err); } =20 - expected =3D bpf_iter_fill_batch(seq, &sk); - WARN_ON_ONCE(iter->end_sk !=3D expected); + bpf_iter_fill_batch(seq, &sk); + WARN_ON_ONCE(sk); done: bpf_iter_tcp_unlock_bucket(seq); + if (unlikely(!iter->end_sk)) { + ++iter->state.bucket; + goto again; + } return iter->batch[0].sk; } =20 --- base-commit: 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f change-id: 20260619-bpf-iter-tcp-refcnt-107d52b238da Best regards, -- =20 Jose Fernandez (Anthropic)