include/net/inet6_hashtables.h | 9 ++++---- include/net/inet_hashtables.h | 9 ++++---- include/net/request_sock.h | 2 +- include/net/sock.h | 11 ++++++++++ net/core/filter.c | 49 +++++++++++++++++++++++++++++------------- net/core/sock_map.c | 8 ++----- net/netfilter/nf_queue.c | 18 ++++++++-------- 7 files changed, 67 insertions(+), 39 deletions(-)
This is a follow-up to Sashiko's report[1].
Several BPF socket helpers acquire a socket reference only when
sk_is_refcounted() == true, and release it, independently, by
re-evaluating sk_is_refcounted() again at the time the release runs. TCP
connect(AF_UNSPEC)+listen() sets SOCK_RCU_FREE on an established socket.
If that happens while a reference is outstanding, the release side sees
sk_is_refcounted() == false and skips the put; the socket is leaked.
unreferenced object 0xffff88811617ce00 (size 3200):
comm "softirq", pid 0, jiffies 4294848512
hex dump (first 32 bytes):
7f 00 00 01 7f 00 00 01 4d 43 02 f6 00 00 00 00 ........MC......
02 00 07 41 00 00 00 00 00 00 00 00 00 00 00 00 ...A............
backtrace (crc fb5bd4c8):
kmem_cache_alloc_noprof+0x53e/0x640
sk_prot_alloc+0x69/0x240
sk_clone+0x79/0x1230
inet_csk_clone_lock+0x30/0x760
tcp_create_openreq_child+0x34/0x2750
tcp_v4_syn_recv_sock+0x12e/0x1080
tcp_check_req+0x447/0x2310
tcp_v4_rcv+0x1026/0x3c90
ip_protocol_deliver_rcu+0x93/0x340
ip_local_deliver_finish+0x356/0x5c0
ip_local_deliver+0x184/0x4a0
ip_rcv+0x4f4/0x5b0
__netif_receive_skb_one_core+0x153/0x1b0
process_backlog+0x28d/0x1190
__napi_poll+0xab/0x520
net_rx_action+0x3f0/0xca0
[1]: https://lore.kernel.org/bpf/20260701235552.2B0AA1F00A3F@smtp.kernel.org/
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
Changes in v3:
- Add a fix for TC bpf_sk_assign() (patch #2)
- Clean up commit messages
- Non-fixes went to bpf-next: https://lore.kernel.org/bpf/20260813-sockmap-lookup-get-ref-v1-0-31f5d55f44ac@rbox.co/
- Link to v2: https://patch.msgid.link/20260803-sockmap-lookup-tcp-leak-v2-0-306e025bfe66@rbox.co
Changes in v2:
- Defer "Use sock_hold() instead of refcount_inc_not_zero() in lookup" to
bpf-next [John]
- Fix comment style [Sashiko]
- Link to v1: https://patch.msgid.link/20260723-sockmap-lookup-tcp-leak-v1-0-1bbdc58ce514@rbox.co
To: Alexei Starovoitov <ast@kernel.org>
To: Daniel Borkmann <daniel@iogearbox.net>
To: Andrii Nakryiko <andrii@kernel.org>
To: Eduard Zingerman <eddyz87@gmail.com>
To: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: Martin KaFai Lau <martin.lau@linux.dev>
To: Song Liu <song@kernel.org>
To: Yonghong Song <yonghong.song@linux.dev>
To: Jiri Olsa <jolsa@kernel.org>
To: Emil Tsalapatis <emil@etsalapatis.com>
To: John Fastabend <john.fastabend@gmail.com>
To: Stanislav Fomichev <sdf@fomichev.me>
To: "David S. Miller" <davem@davemloft.net>
To: Eric Dumazet <edumazet@google.com>
To: Jakub Kicinski <kuba@kernel.org>
To: Paolo Abeni <pabeni@redhat.com>
To: Simon Horman <horms@kernel.org>
To: Kuniyuki Iwashima <kuniyu@google.com>
To: Willem de Bruijn <willemb@google.com>
To: Jakub Sitnicki <jakub@cloudflare.com>
To: Jiayuan Chen <jiayuan.chen@linux.dev>
To: Joe Stringer <joe@wand.net.nz>
To: Ihor Solodrai <ihor.solodrai@linux.dev>
To: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
To: Phil Sutter <phil@nwl.cc>
Cc: bpf@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: netfilter-devel@vger.kernel.org
Cc: coreteam@netfilter.org
---
Michal Luczaj (2):
bpf: Unconditionally take socket references in lookup helpers
bpf: Fix reference leak in bpf_sk_assign()
include/net/inet6_hashtables.h | 9 ++++----
include/net/inet_hashtables.h | 9 ++++----
include/net/request_sock.h | 2 +-
include/net/sock.h | 11 ++++++++++
net/core/filter.c | 49 +++++++++++++++++++++++++++++-------------
net/core/sock_map.c | 8 ++-----
net/netfilter/nf_queue.c | 18 ++++++++--------
7 files changed, 67 insertions(+), 39 deletions(-)
---
base-commit: ce6b9e5dd873de532cd924e2abc928220cdc2738
change-id: 20260628-sockmap-lookup-tcp-leak-bdaba3e083c5
Best regards,
--
Michal Luczaj <mhal@rbox.co>
On Wed, Sep 2, 2026 at 10:55 AM Michal Luczaj <mhal@rbox.co> wrote: > > This is a follow-up to Sashiko's report[1]. > > Several BPF socket helpers acquire a socket reference only when > sk_is_refcounted() == true, and release it, independently, by > re-evaluating sk_is_refcounted() again at the time the release runs. TCP > connect(AF_UNSPEC)+listen() sets SOCK_RCU_FREE on an established socket. Due to several bug reports, we are now inclined to forbid the buggy transformation. https://lore.kernel.org/netdev/CANn89i+px52TtJy3S9=uHxGj3s-WueguRo1Z_4FxO=02KLmwmQ@mail.gmail.com/ > If that happens while a reference is outstanding, the release side sees > sk_is_refcounted() == false and skips the put; the socket is leaked. > > unreferenced object 0xffff88811617ce00 (size 3200): > comm "softirq", pid 0, jiffies 4294848512 > hex dump (first 32 bytes): > 7f 00 00 01 7f 00 00 01 4d 43 02 f6 00 00 00 00 ........MC...... > 02 00 07 41 00 00 00 00 00 00 00 00 00 00 00 00 ...A............ > backtrace (crc fb5bd4c8): > kmem_cache_alloc_noprof+0x53e/0x640 > sk_prot_alloc+0x69/0x240 > sk_clone+0x79/0x1230 > inet_csk_clone_lock+0x30/0x760 > tcp_create_openreq_child+0x34/0x2750 > tcp_v4_syn_recv_sock+0x12e/0x1080 > tcp_check_req+0x447/0x2310 > tcp_v4_rcv+0x1026/0x3c90 > ip_protocol_deliver_rcu+0x93/0x340 > ip_local_deliver_finish+0x356/0x5c0 > ip_local_deliver+0x184/0x4a0 > ip_rcv+0x4f4/0x5b0 > __netif_receive_skb_one_core+0x153/0x1b0 > process_backlog+0x28d/0x1190 > __napi_poll+0xab/0x520 > net_rx_action+0x3f0/0xca0 > > [1]: https://lore.kernel.org/bpf/20260701235552.2B0AA1F00A3F@smtp.kernel.org/ > > Signed-off-by: Michal Luczaj <mhal@rbox.co> > --- > Changes in v3: > - Add a fix for TC bpf_sk_assign() (patch #2) > - Clean up commit messages > - Non-fixes went to bpf-next: https://lore.kernel.org/bpf/20260813-sockmap-lookup-get-ref-v1-0-31f5d55f44ac@rbox.co/ > - Link to v2: https://patch.msgid.link/20260803-sockmap-lookup-tcp-leak-v2-0-306e025bfe66@rbox.co > > Changes in v2: > - Defer "Use sock_hold() instead of refcount_inc_not_zero() in lookup" to > bpf-next [John] > - Fix comment style [Sashiko] > - Link to v1: https://patch.msgid.link/20260723-sockmap-lookup-tcp-leak-v1-0-1bbdc58ce514@rbox.co > > To: Alexei Starovoitov <ast@kernel.org> > To: Daniel Borkmann <daniel@iogearbox.net> > To: Andrii Nakryiko <andrii@kernel.org> > To: Eduard Zingerman <eddyz87@gmail.com> > To: Kumar Kartikeya Dwivedi <memxor@gmail.com> > To: Martin KaFai Lau <martin.lau@linux.dev> > To: Song Liu <song@kernel.org> > To: Yonghong Song <yonghong.song@linux.dev> > To: Jiri Olsa <jolsa@kernel.org> > To: Emil Tsalapatis <emil@etsalapatis.com> > To: John Fastabend <john.fastabend@gmail.com> > To: Stanislav Fomichev <sdf@fomichev.me> > To: "David S. Miller" <davem@davemloft.net> > To: Eric Dumazet <edumazet@google.com> > To: Jakub Kicinski <kuba@kernel.org> > To: Paolo Abeni <pabeni@redhat.com> > To: Simon Horman <horms@kernel.org> > To: Kuniyuki Iwashima <kuniyu@google.com> > To: Willem de Bruijn <willemb@google.com> > To: Jakub Sitnicki <jakub@cloudflare.com> > To: Jiayuan Chen <jiayuan.chen@linux.dev> > To: Joe Stringer <joe@wand.net.nz> > To: Ihor Solodrai <ihor.solodrai@linux.dev> > To: Pablo Neira Ayuso <pablo@netfilter.org> > To: Florian Westphal <fw@strlen.de> > To: Phil Sutter <phil@nwl.cc> > Cc: bpf@vger.kernel.org > Cc: netdev@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Cc: netfilter-devel@vger.kernel.org > Cc: coreteam@netfilter.org > > --- > Michal Luczaj (2): > bpf: Unconditionally take socket references in lookup helpers > bpf: Fix reference leak in bpf_sk_assign() > > include/net/inet6_hashtables.h | 9 ++++---- > include/net/inet_hashtables.h | 9 ++++---- > include/net/request_sock.h | 2 +- > include/net/sock.h | 11 ++++++++++ > net/core/filter.c | 49 +++++++++++++++++++++++++++++------------- > net/core/sock_map.c | 8 ++----- > net/netfilter/nf_queue.c | 18 ++++++++-------- > 7 files changed, 67 insertions(+), 39 deletions(-) > --- > base-commit: ce6b9e5dd873de532cd924e2abc928220cdc2738 > change-id: 20260628-sockmap-lookup-tcp-leak-bdaba3e083c5 > > Best regards, > -- > Michal Luczaj <mhal@rbox.co> >
On Wed, 2 Sep 2026 11:58:49 -0700 Kuniyuki Iwashima wrote: > > Several BPF socket helpers acquire a socket reference only when > > sk_is_refcounted() == true, and release it, independently, by > > re-evaluating sk_is_refcounted() again at the time the release runs. TCP > > connect(AF_UNSPEC)+listen() sets SOCK_RCU_FREE on an established socket. > > Due to several bug reports, we are now inclined to forbid the > buggy transformation. > https://lore.kernel.org/netdev/CANn89i+px52TtJy3S9=uHxGj3s-WueguRo1Z_4FxO=02KLmwmQ@mail.gmail.com/ Kuniyuki, would you be willing to send a patch to do that? Not sure if anyone else is planning to, I wasn't..
On Wed, Sep 2, 2026 at 3:52 PM Jakub Kicinski <kuba@kernel.org> wrote: > > On Wed, 2 Sep 2026 11:58:49 -0700 Kuniyuki Iwashima wrote: > > > Several BPF socket helpers acquire a socket reference only when > > > sk_is_refcounted() == true, and release it, independently, by > > > re-evaluating sk_is_refcounted() again at the time the release runs. TCP > > > connect(AF_UNSPEC)+listen() sets SOCK_RCU_FREE on an established socket. > > > > Due to several bug reports, we are now inclined to forbid the > > buggy transformation. > > https://lore.kernel.org/netdev/CANn89i+px52TtJy3S9=uHxGj3s-WueguRo1Z_4FxO=02KLmwmQ@mail.gmail.com/ > > Kuniyuki, would you be willing to send a patch to do that? > Not sure if anyone else is planning to, I wasn't.. Sure, I'll post one like this with s/synchronize_rcu()/-EINVAL/g https://lore.kernel.org/netdev/20260804015349.2353056-1-kuniyu@google.com/
On Wed, Sep 2, 2026 at 4:04 PM Kuniyuki Iwashima <kuniyu@google.com> wrote: > > On Wed, Sep 2, 2026 at 3:52 PM Jakub Kicinski <kuba@kernel.org> wrote: > > > > On Wed, 2 Sep 2026 11:58:49 -0700 Kuniyuki Iwashima wrote: > > > > Several BPF socket helpers acquire a socket reference only when > > > > sk_is_refcounted() == true, and release it, independently, by > > > > re-evaluating sk_is_refcounted() again at the time the release runs. TCP > > > > connect(AF_UNSPEC)+listen() sets SOCK_RCU_FREE on an established socket. > > > > > > Due to several bug reports, we are now inclined to forbid the > > > buggy transformation. > > > https://lore.kernel.org/netdev/CANn89i+px52TtJy3S9=uHxGj3s-WueguRo1Z_4FxO=02KLmwmQ@mail.gmail.com/ > > > > Kuniyuki, would you be willing to send a patch to do that? > > Not sure if anyone else is planning to, I wasn't.. > > Sure, I'll post one like this with s/synchronize_rcu()/-EINVAL/g > https://lore.kernel.org/netdev/20260804015349.2353056-1-kuniyu@google.com/ and cover IPV6_ADDRFORM.
On Wed, Sep 2, 2026 at 4:06 PM Kuniyuki Iwashima <kuniyu@google.com> wrote: > > On Wed, Sep 2, 2026 at 4:04 PM Kuniyuki Iwashima <kuniyu@google.com> wrote: > > > > On Wed, Sep 2, 2026 at 3:52 PM Jakub Kicinski <kuba@kernel.org> wrote: > > > > > > On Wed, 2 Sep 2026 11:58:49 -0700 Kuniyuki Iwashima wrote: > > > > > Several BPF socket helpers acquire a socket reference only when > > > > > sk_is_refcounted() == true, and release it, independently, by > > > > > re-evaluating sk_is_refcounted() again at the time the release runs. TCP > > > > > connect(AF_UNSPEC)+listen() sets SOCK_RCU_FREE on an established socket. > > > > > > > > Due to several bug reports, we are now inclined to forbid the > > > > buggy transformation. > > > > https://lore.kernel.org/netdev/CANn89i+px52TtJy3S9=uHxGj3s-WueguRo1Z_4FxO=02KLmwmQ@mail.gmail.com/ > > > > > > Kuniyuki, would you be willing to send a patch to do that? > > > Not sure if anyone else is planning to, I wasn't.. > > > > Sure, I'll post one like this with s/synchronize_rcu()/-EINVAL/g > > https://lore.kernel.org/netdev/20260804015349.2353056-1-kuniyu@google.com/ > > and cover IPV6_ADDRFORM. sounds like the fixes in this patch set won't be needed, so I tossed them out of patchwork.
© 2016 - 2026 Red Hat, Inc.