From nobody Fri Jul 24 21:30:25 2026 Received: from mailtransmit05.runbox.com (mailtransmit05.runbox.com [185.226.149.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B20B233BBC0; Thu, 23 Jul 2026 11:34:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.38 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784806471; cv=none; b=ur8wI5RbqsmPYZEbzzdJjWje8AnTDyH0Ng+/C8MILaC+CiPYURnrZuEOTLKBV/JpVgR3czPVK0WdmK2NrykfYrD8QoXCLFYKO0SpxctJLYccsbpbOzZTfzLVZRG6KnrhxnNztfG8tZkA6yTpKwKES8XWDHe4qgreei85GGCHUC0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784806471; c=relaxed/simple; bh=2XfbegwDgk32hzymslP1u+I7qkHyP75VxS7Qf6Qo2hM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=amh+5JAO2OGOUuhvGKatz6rniTgHOECDxTX2XHDxECg+NsRMfSLpmTNTQlLGiMyf+YUn4hoFHlzTRJdIK5iDBY7cbHhmql+9reQno8f9xqnz/v+/jU13SOQAAqaEz0nFl52T7IeP1LbMFoJA7mzDbEfVhk+WNrxs4SjU6n/qRjY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=PISoSM5o; arc=none smtp.client-ip=185.226.149.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="PISoSM5o" Received: from mailtransmit03.runbox ([10.9.9.163] helo=aibo.runbox.com) by mailtransmit05.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1wmrgo-007G5e-Qm; Thu, 23 Jul 2026 13:34:10 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=W/Squ/6n9U/tVVqLPQzzUtwkXyf10bQergVKjvP/hvE=; b=PISoSM5ofb5BwIIciPTaQB0/v+ hD6raYqqsUWl+web8PNiw2TFQ4C7U2ttVEHrztc0E39MRLNAkqcOo/O5PcfAaPB5WVbwzpW7vmiwR cnPYReCj0F0ehxC/LpxMShyw/CbQTY3lpPYJnAKBK47GY09vh7G/VEfYScR5XrowI51ytWO2J2RiA NuBKlnKoTWSwvFnrprOuPwHoC45Rr6UKW5fok8wR0+Ec72bdXJYEx868/pB4F8ZVhf9DebGSZypnm 4mP0+7HMJgUIAntid1zuWjTNowoALA50pLB/S3P9RC2xLl9Wsy/o98HedutcVn3U9nmzAJQuaxH3k pe71JZ8A==; Received: from [10.9.9.74] (helo=submission03.runbox) by mailtransmit03.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1wmrgm-0006Gd-UD; Thu, 23 Jul 2026 13:34:09 +0200 Received: by submission03.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1wmrgV-0060aI-7P; Thu, 23 Jul 2026 13:33:51 +0200 From: Michal Luczaj Date: Thu, 23 Jul 2026 13:33:27 +0200 Subject: [PATCH bpf 1/3] bpf, sockmap: Use sock_hold() instead of refcount_inc_not_zero() in lookup Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260723-sockmap-lookup-tcp-leak-v1-1-1bbdc58ce514@rbox.co> References: <20260723-sockmap-lookup-tcp-leak-v1-0-1bbdc58ce514@rbox.co> In-Reply-To: <20260723-sockmap-lookup-tcp-leak-v1-0-1bbdc58ce514@rbox.co> To: Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , John Fastabend , Jakub Sitnicki , Jiayuan Chen , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Stanislav Fomichev , Martin KaFai Lau , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Joe Stringer Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, Michal Luczaj X-Mailer: b4 0.15.2 psock's hold on the looked up socket isn't dropped until sk_psock_drop() -> queue_rcu_work() -> sk_psock_destroy() runs, which happens only after the entry is unlinked and an RCU grace period elapses. Since the lookup runs under RCU, a non-NULL result guarantees sk_refcnt >=3D 1: refcount_inc_not_zero() can never fail here. Use sock_hold() instead. Signed-off-by: Michal Luczaj --- net/core/sock_map.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/core/sock_map.c b/net/core/sock_map.c index 9efbd8ca7db8..ca49bc7f8687 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -392,8 +392,8 @@ static void *sock_map_lookup(struct bpf_map *map, void = *key) sk =3D __sock_map_lookup_elem(map, *(u32 *)key); if (!sk) return NULL; - if (sk_is_refcounted(sk) && !refcount_inc_not_zero(&sk->sk_refcnt)) - return NULL; + if (sk_is_refcounted(sk)) + sock_hold(sk); return sk; } =20 @@ -1218,8 +1218,8 @@ static void *sock_hash_lookup(struct bpf_map *map, vo= id *key) sk =3D __sock_hash_lookup_elem(map, key); if (!sk) return NULL; - if (sk_is_refcounted(sk) && !refcount_inc_not_zero(&sk->sk_refcnt)) - return NULL; + if (sk_is_refcounted(sk)) + sock_hold(sk); return sk; } =20 --=20 2.55.0 From nobody Fri Jul 24 21:30:25 2026 Received: from mailtransmit04.runbox.com (mailtransmit04.runbox.com [185.226.149.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B284A46E018 for ; Thu, 23 Jul 2026 11:34:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.37 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784806467; cv=none; b=HsMfzEYaH5aLTMrhIspluYaiKHcCl4nXwVj4KJJrO0u3NNkF7aKFRyk1pCc/Welt/QIbjSaOfqLp9cYT2zE5DUBM5JFb2G7v3g4NbJTmErrPFlu3UjqINmT60hUNleZRbijuCSeA9Qibxyh4HfU+k6n3mquBG0klKVBHuMc2VgA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784806467; c=relaxed/simple; bh=9dy3OBmEmptmBnLZGWx3UFrj5VqOypMzcqIRauS8+6k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=LXlm2Gt/fWadB/p1N56FLMn8sVSvShZgfRiOB7OWe99QBmp38PfAYElLG+5vc4q+RYX7LsA0kaI+Xmdte91uREgazWx9/GkpRlRwDDpFo0JE1oJNeeSWeu2jzJ5qQHbdvJ5hnUztrR/vjnYLWLfhAUt9rOqbtQHbjF4kYGWO9us= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=ZqZLaLX1; arc=none smtp.client-ip=185.226.149.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="ZqZLaLX1" Received: from mailtransmit02.runbox ([10.9.9.162] helo=aibo.runbox.com) by mailtransmit04.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1wmrgr-005wby-Sh; Thu, 23 Jul 2026 13:34:13 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=lgd9qrAh/mt8mpiZLiLW/J3JKlUYADrx2KtmKJcePSQ=; b=ZqZLaLX1y+YgxF+pYF3jGg2vRD tF0JSoyrBTclcR8kKRxc7+9AOowPz/cb8iVUuDXvwxg+nMNZxCKsBYEHmp/tpqqQ4swvRa9RMvWY8 pWNELy9CmNGnKpvWgbDzhg1YBuX7/FgY6HsOka9PvjKF3DVmjVTS2VwMM1U7L0iRfk2M9QJbWr8Hn mzy3wjb84JiZzVXZ7q6J4os43zANTE8Ax4TcL8yhxl5AHUhO3u/bf1SpIAEcE3dnx2Ylo0qb/WCjR 9HBDOiI/wZ+2OjqpPdpNxlR0Yk1vHKr3W7R1j2RXCvoYONhYIaNNHgNZZG/p5J91+fE4muv+z55dD urNR2P7g==; Received: from [10.9.9.74] (helo=submission03.runbox) by mailtransmit02.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1wmrgm-00079t-Ge; Thu, 23 Jul 2026 13:34:08 +0200 Received: by submission03.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1wmrgW-0060aI-BM; Thu, 23 Jul 2026 13:33:52 +0200 From: Michal Luczaj Date: Thu, 23 Jul 2026 13:33:28 +0200 Subject: [PATCH bpf 2/3] bpf: Extract shared reqsk-to-listener upgrade Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260723-sockmap-lookup-tcp-leak-v1-2-1bbdc58ce514@rbox.co> References: <20260723-sockmap-lookup-tcp-leak-v1-0-1bbdc58ce514@rbox.co> In-Reply-To: <20260723-sockmap-lookup-tcp-leak-v1-0-1bbdc58ce514@rbox.co> To: Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , John Fastabend , Jakub Sitnicki , Jiayuan Chen , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Stanislav Fomichev , Martin KaFai Lau , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Joe Stringer Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, Michal Luczaj X-Mailer: b4 0.15.2 __bpf_sk_lookup() and bpf_sk_lookup() duplicate the same sk_to_full_sk() reqsk-to-listener upgrade. Extract it into a helper. Leave the currently unreachable WARN_ONCE as a defensive assert. No functional change. Signed-off-by: Michal Luczaj --- net/core/filter.c | 57 ++++++++++++++++++++++++---------------------------= ---- 1 file changed, 25 insertions(+), 32 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index b446aa8be5c3..403aba3ce891 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7074,6 +7074,27 @@ __bpf_skc_lookup(struct sk_buff *skb, struct bpf_soc= k_tuple *tuple, u32 len, return sk; } =20 +static struct sock * +bpf_sk_lookup_full_sk(struct sock *sk) +{ + struct sock *sk2 =3D sk_to_full_sk(sk); + + /* sk_to_full_sk() may return sk->rsk_listener, make sure the original + * sk sock refcnt is decremented to prevent a request_sock leak. + */ + if (sk2 !=3D sk) { + sock_gen_put(sk); + /* Ensure there is no need to bump sk2 refcnt. */ + if (unlikely(sk2 && !sock_flag(sk2, SOCK_RCU_FREE))) { + WARN_ONCE(1, "Found non-RCU, unreferenced socket!"); + return NULL; + } + sk =3D sk2; + } + + return sk; +} + static struct sock * __bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len, struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id, @@ -7083,22 +7104,8 @@ __bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock= _tuple *tuple, u32 len, ifindex, proto, netns_id, flags, sdif); =20 - if (sk) { - struct sock *sk2 =3D sk_to_full_sk(sk); - - /* sk_to_full_sk() may return (sk)->rsk_listener, so make sure the origi= nal sk - * sock refcnt is decremented to prevent a request_sock leak. - */ - if (sk2 !=3D sk) { - sock_gen_put(sk); - /* Ensure there is no need to bump sk2 refcnt */ - if (unlikely(sk2 && !sock_flag(sk2, SOCK_RCU_FREE))) { - WARN_ONCE(1, "Found non-RCU, unreferenced socket!"); - return NULL; - } - sk =3D sk2; - } - } + if (sk) + sk =3D bpf_sk_lookup_full_sk(sk); =20 return sk; } @@ -7129,22 +7136,8 @@ bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_t= uple *tuple, u32 len, struct sock *sk =3D bpf_skc_lookup(skb, tuple, len, proto, netns_id, flags); =20 - if (sk) { - struct sock *sk2 =3D sk_to_full_sk(sk); - - /* sk_to_full_sk() may return (sk)->rsk_listener, so make sure the origi= nal sk - * sock refcnt is decremented to prevent a request_sock leak. - */ - if (sk2 !=3D sk) { - sock_gen_put(sk); - /* Ensure there is no need to bump sk2 refcnt */ - if (unlikely(sk2 && !sock_flag(sk2, SOCK_RCU_FREE))) { - WARN_ONCE(1, "Found non-RCU, unreferenced socket!"); - return NULL; - } - sk =3D sk2; - } - } + if (sk) + sk =3D bpf_sk_lookup_full_sk(sk); =20 return sk; } --=20 2.55.0 From nobody Fri Jul 24 21:30:25 2026 Received: from mailtransmit05.runbox.com (mailtransmit05.runbox.com [185.226.149.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1FB642BC2B; Thu, 23 Jul 2026 11:34:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.38 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784806467; cv=none; b=lt6BhJt0B1Hld0qyvXpCJPRC9t/OYS2t2S5IlSUwOHgnKV6+vlGIwcmil7wBPdsm7f4KFoWXq4TSX+wXih2UogReOvnguZzUOlaelGpirccjFQvKoTCreiG5MLpYIkkFjhnNkhhqtKKGatNWSdK8Vn1mF2sMTADnwtjP8yA5XWA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784806467; c=relaxed/simple; bh=5zsJURl3gkFpfGTzJNX0BHG29S9pjPdFCEagmTkgvXA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=moCQ19y9Khp3a6E1oeO/Wvi5u46S8ECaHulkYIyIMVAHzUa37N1aHKz7NX1oZyDIq/VZwJLDFPFYhAQSw9F9OJ4VFQLhAyh2sBApxJLu0AAJDZom2W+qulGpNJw83ZRM7Fqcj/dwCCW16bIKTLSKXPGO1cLXxdDOQVrn4Up3tKY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=PI2FIzK2; arc=none smtp.client-ip=185.226.149.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="PI2FIzK2" Received: from mailtransmit02.runbox ([10.9.9.162] helo=aibo.runbox.com) by mailtransmit05.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1wmrgo-007G5Y-Gu; Thu, 23 Jul 2026 13:34:10 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=k7p+B/COPdonMnN0TNVDcPtVKw0DyjIEi9WHuqqWM5g=; b=PI2FIzK2OkgIBWyRuzNq4muSse XTq2QI7XP15D001zM5pCLVGQI0FU+5up0G17a0hUvM8HPlBYHT4wdGPFhx8XFymXhNmwjANeMZ+aa lLRMTDBnzA+VPAHi85hHYBEvkVAPOQOobZG9uMQi1mw9uCFO7B+3zxRo7oH0mgmmxB4gD7d9dNxcR /9zUJMvxA3oiBhvJKhgcc5nuQcCLxJiQoGkMDsLd12qpFyuhbMrWlv7X/Fn7ZehY3aayMulBdc+0U tZECP7r6nA9H0JfMQmEmYvZm6NTCkHdv2leN1n1J9NduzJy43A22ojwv+oH66R0/G1trsamozoPVh eon7HTqw==; Received: from [10.9.9.74] (helo=submission03.runbox) by mailtransmit02.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1wmrgm-00079p-AE; Thu, 23 Jul 2026 13:34:08 +0200 Received: by submission03.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1wmrgX-0060aI-HC; Thu, 23 Jul 2026 13:33:53 +0200 From: Michal Luczaj Date: Thu, 23 Jul 2026 13:33:29 +0200 Subject: [PATCH bpf 3/3] bpf: Unconditionally take socket references in lookup helpers Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260723-sockmap-lookup-tcp-leak-v1-3-1bbdc58ce514@rbox.co> References: <20260723-sockmap-lookup-tcp-leak-v1-0-1bbdc58ce514@rbox.co> In-Reply-To: <20260723-sockmap-lookup-tcp-leak-v1-0-1bbdc58ce514@rbox.co> To: Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , John Fastabend , Jakub Sitnicki , Jiayuan Chen , "David S. Miller" , Jakub Kicinski , Simon Horman , Daniel Borkmann , Stanislav Fomichev , Martin KaFai Lau , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Joe Stringer Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, Michal Luczaj , Sashiko X-Mailer: b4 0.15.2 Lookup helpers gate whether to acquire a socket reference on sk_is_refcounted(), a check re-evaluated at release. An established socket refcounted at acquire time can gain SOCK_RCU_FREE via connect(AF_UNSPEC)+listen() before release runs; the release-side re-check then reads sk_is_refcounted() =3D=3D false and skips the put. The reference leaks. Make acquire and release unconditional and symmetric: always take a reference, always put it. Adapt sk_select_reuseport(). Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") Fixes: 64d85290d79c ("bpf: Allow bpf_map_lookup_elem for SOCKMAP and SOCKHA= SH") Reported-by: Sashiko Closes: https://lore.kernel.org/bpf/20260701235552.2B0AA1F00A3F@smtp.kernel= .org/ Signed-off-by: Michal Luczaj --- net/core/filter.c | 25 ++++++++++++++++--------- net/core/sock_map.c | 8 ++------ 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 403aba3ce891..4bc0b59668fa 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7027,6 +7027,13 @@ static struct sock *sk_lookup(struct net *net, struc= t bpf_sock_tuple *tuple, WARN_ONCE(1, "Found non-RCU, unreferenced socket!"); sk =3D NULL; } + + /* Always take a reference, even if the lookup skipped one; + * bpf_sk_release() always puts one. + */ + if (sk && !refcounted && !refcount_inc_not_zero(&sk->sk_refcnt)) + sk =3D NULL; + return sk; } =20 @@ -7084,11 +7091,15 @@ bpf_sk_lookup_full_sk(struct sock *sk) */ if (sk2 !=3D sk) { sock_gen_put(sk); - /* Ensure there is no need to bump sk2 refcnt. */ if (unlikely(sk2 && !sock_flag(sk2, SOCK_RCU_FREE))) { WARN_ONCE(1, "Found non-RCU, unreferenced socket!"); return NULL; } + /* sk2 is RCU-free, but take a reference anyway; + * bpf_sk_release() puts. + */ + if (sk2 && !refcount_inc_not_zero(&sk2->sk_refcnt)) + sk2 =3D NULL; sk =3D sk2; } =20 @@ -7273,7 +7284,7 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_u= dp_proto =3D { =20 BPF_CALL_1(bpf_sk_release, struct sock *, sk) { - if (sk && sk_is_refcounted(sk)) + if (sk) sock_gen_put(sk); return 0; } @@ -11565,11 +11576,13 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reusepo= rt_kern *, reuse_kern, bool is_sockarray =3D map->map_type =3D=3D BPF_MAP_TYPE_REUSEPORT_SOCKARR= AY; struct sock_reuseport *reuse; struct sock *selected_sk; - int err; + int err =3D 0; =20 selected_sk =3D map->ops->map_lookup_elem(map, key); if (!selected_sk) return -ENOENT; + if (!is_sockarray) + sock_put(selected_sk); =20 reuse =3D rcu_dereference(selected_sk->sk_reuseport_cb); if (!reuse) { @@ -11599,13 +11612,7 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reusepor= t_kern *, reuse_kern, } =20 reuse_kern->selected_sk =3D selected_sk; - - return 0; error: - /* Lookup in sock_map can return TCP ESTABLISHED sockets. */ - if (sk_is_refcounted(selected_sk)) - sock_put(selected_sk); - return err; } =20 diff --git a/net/core/sock_map.c b/net/core/sock_map.c index ca49bc7f8687..ae18dc4d60f9 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -390,9 +390,7 @@ static void *sock_map_lookup(struct bpf_map *map, void = *key) struct sock *sk; =20 sk =3D __sock_map_lookup_elem(map, *(u32 *)key); - if (!sk) - return NULL; - if (sk_is_refcounted(sk)) + if (sk) sock_hold(sk); return sk; } @@ -1216,9 +1214,7 @@ static void *sock_hash_lookup(struct bpf_map *map, vo= id *key) struct sock *sk; =20 sk =3D __sock_hash_lookup_elem(map, key); - if (!sk) - return NULL; - if (sk_is_refcounted(sk)) + if (sk) sock_hold(sk); return sk; } --=20 2.55.0