From nobody Sat Sep 26 09:21:58 2026 Received: from mailtransmit04.runbox.com (mailtransmit04.runbox.com [185.226.149.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B0BAB373C12 for ; Wed, 2 Sep 2026 17:55:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.37 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788371741; cv=none; b=VM3iOA2VNE0LJK++9J2Bxw15l+QruqJ0hE9UCcTo1P5SeSZzdY5BRfBcrM4aPxgD/5k6ljyj3ulCIFbghgBadyflEvQrF4kUAi2K3diCORhDMuFkcJ7g7xPUicyTsSEfPIEXYMsCrtyTLI/0N9QuCd+Ah6XerlKeAzwXbW+QAF0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788371741; c=relaxed/simple; bh=IZhshA9fZOyRiYER+gWCvb7sLy6FkkdGhrHLrnkEMAw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=EVg5KhbeNRc8Iv1Yf1qPu7TtqGj2vInJ1P/RYOnQAEZAUTrEQ0LKuA5DAYk6fWq2Pa8QbavYMc/BVTtyT7o9pG5CFU6O3EN9gwpVEs5c2Oa2sA5zqN4rEDEPLTr7L7l7ncPObV/Cvcum1xABUY27Jij8/L/RHXdksC1NhbFt3/A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=JmDIxZIs; arc=none smtp.client-ip=185.226.149.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="JmDIxZIs" Received: from mailtransmit03.runbox ([10.9.9.163] helo=aibo.runbox.com) by mailtransmit04.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1x1pAz-0093ib-0V; Wed, 02 Sep 2026 19:55:09 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=FXFCe6ONM3mltyRpMuaa6tup/eZ+1813+oHLpm8cwE0=; b=JmDIxZIsDfoI2xLAITZjj+02Xk cHjeyDOj3K3E3fL1Jw1PIAjNXtLuyKujLF7KyH6eO6FUQdpWym8qYRVKZ4kGvndiVXsSBBXdCAN2t jVKm9QLe8pQ+pAPIt9VCRf5J8IQkevrTM8glo3H++fd3HPtTuMobI/lZbw+gtbAqN981FIxcZ8GT+ 1b/tDZy8RuwI1amExLlEUNz8klWvQYcjY8Mq+f0cZ+XXNW6y5bQUd5ezqlxVW9kau378iDxeogJg1 e3A3bxIVof92hRGveKO3FBC789+anH+fBGzxfALreldg+kBtjV/OCCOH7AQBjwH9fnNiY2LFHuOp+ kJOguvkA==; Received: from [10.9.9.73] (helo=submission02.runbox) by mailtransmit03.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1x1pAx-0006J2-En; Wed, 02 Sep 2026 19:55:07 +0200 Received: by submission02.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1x1pAj-0020Qt-Mt; Wed, 02 Sep 2026 19:54:53 +0200 From: Michal Luczaj Date: Wed, 02 Sep 2026 19:52:14 +0200 Subject: [PATCH bpf v3 1/2] bpf: Unconditionally take socket references in lookup helpers Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260902-sockmap-lookup-tcp-leak-v3-1-b998b3d49d07@rbox.co> References: <20260902-sockmap-lookup-tcp-leak-v3-0-b998b3d49d07@rbox.co> In-Reply-To: <20260902-sockmap-lookup-tcp-leak-v3-0-b998b3d49d07@rbox.co> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , John Fastabend , Stanislav Fomichev , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Kuniyuki Iwashima , Willem de Bruijn , Jakub Sitnicki , Jiayuan Chen , Joe Stringer , Ihor Solodrai , Pablo Neira Ayuso , Florian Westphal , Phil Sutter Cc: Michal Luczaj , bpf@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, Sashiko X-Mailer: b4 0.15.2 Lookup helpers gate the reference acquisition on sk_is_refcounted(), and the release side re-evaluates the same check. An established socket can be refcounted at acquire time and later gain SOCK_RCU_FREE via connect(AF_UNSPEC) + listen() before release. The release re-check then sees sk_is_refcounted() =3D=3D false and skips the put, leaking the referen= ce. Make acquire and release unconditional and symmetric: always take a reference, always put it. Adapt sk_select_reuseport(). Drop the misplaced/outdated comment above __bpf_skc_lookup(). Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") Fixes: 64d85290d79c ("bpf: Allow bpf_map_lookup_elem for SOCKMAP and SOCKHA= SH") Reported-by: Sashiko Closes: https://lore.kernel.org/bpf/20260701235552.2B0AA1F00A3F@smtp.kernel= .org/ Signed-off-by: Michal Luczaj Reviewed-by: Emil Tsalapatis --- net/core/filter.c | 30 ++++++++++++++++++------------ net/core/sock_map.c | 8 ++------ 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 61940e753552..66d83a198ea2 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7205,12 +7205,17 @@ static struct sock *sk_lookup(struct net *net, stru= ct bpf_sock_tuple *tuple, WARN_ONCE(1, "Found non-RCU, unreferenced socket!"); sk =3D NULL; } + + /* + * Always take a reference, even if the lookup skipped one; + * bpf_sk_release() always puts one. + */ + if (sk && !refcounted && !refcount_inc_not_zero(&sk->sk_refcnt)) + sk =3D NULL; + return sk; } =20 -/* bpf_skc_lookup performs the core lookup for different types of sockets, - * taking a reference on the socket if it doesn't have the flag SOCK_RCU_F= REE. - */ static struct sock * __bpf_skc_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 le= n, struct net *caller_net, u32 ifindex, u8 proto, u64 netns_id, @@ -7263,11 +7268,16 @@ bpf_sk_lookup_full_sk(struct sock *sk) */ if (sk2 !=3D sk) { sock_gen_put(sk); - /* Ensure there is no need to bump sk2 refcnt. */ if (unlikely(sk2 && !sock_flag(sk2, SOCK_RCU_FREE))) { WARN_ONCE(1, "Found non-RCU, unreferenced socket!"); return NULL; } + /* + * sk2 is not refcounted, but take a reference anyway; + * bpf_sk_release() puts. + */ + if (sk2 && !refcount_inc_not_zero(&sk2->sk_refcnt)) + sk2 =3D NULL; sk =3D sk2; } =20 @@ -7448,7 +7458,7 @@ static const struct bpf_func_proto bpf_tc_sk_lookup_u= dp_proto =3D { =20 BPF_CALL_1(bpf_sk_release, struct sock *, sk) { - if (sk && sk_is_refcounted(sk)) + if (sk) sock_gen_put(sk); return 0; } @@ -11736,11 +11746,13 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reusepo= rt_kern *, reuse_kern, bool is_sockarray =3D map->map_type =3D=3D BPF_MAP_TYPE_REUSEPORT_SOCKARR= AY; struct sock_reuseport *reuse; struct sock *selected_sk; - int err; + int err =3D 0; =20 selected_sk =3D map->ops->map_lookup_elem(map, key); if (!selected_sk) return -ENOENT; + if (!is_sockarray) + sock_put(selected_sk); =20 reuse =3D rcu_dereference(selected_sk->sk_reuseport_cb); if (!reuse) { @@ -11770,13 +11782,7 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reusepor= t_kern *, reuse_kern, } =20 reuse_kern->selected_sk =3D selected_sk; - - return 0; error: - /* Lookup in sock_map can return TCP ESTABLISHED sockets. */ - if (sk_is_refcounted(selected_sk)) - sock_put(selected_sk); - return err; } =20 diff --git a/net/core/sock_map.c b/net/core/sock_map.c index ca49bc7f8687..ae18dc4d60f9 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -390,9 +390,7 @@ static void *sock_map_lookup(struct bpf_map *map, void = *key) struct sock *sk; =20 sk =3D __sock_map_lookup_elem(map, *(u32 *)key); - if (!sk) - return NULL; - if (sk_is_refcounted(sk)) + if (sk) sock_hold(sk); return sk; } @@ -1216,9 +1214,7 @@ static void *sock_hash_lookup(struct bpf_map *map, vo= id *key) struct sock *sk; =20 sk =3D __sock_hash_lookup_elem(map, key); - if (!sk) - return NULL; - if (sk_is_refcounted(sk)) + if (sk) sock_hold(sk); return sk; } --=20 2.55.0 From nobody Sat Sep 26 09:21:58 2026 Received: from mailtransmit05.runbox.com (mailtransmit05.runbox.com [185.226.149.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D841386C36; Wed, 2 Sep 2026 18:41:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.38 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788374506; cv=none; b=lB7SskkU0LSokRPc7mPf7+w8GmBL0PpZvPQnEwcjFhZ0kZliKh/KPEaTPCCrfb+++SmZqeNg80/9s4VcPlLEyc9fIoNKJNY66qfco4fSF8cFVsmGh+p9KpYMcv+y+/WBmjR+fch8byJsrzzMPIY8NilJ9ZSz+Van3jHK9rhYa6c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788374506; c=relaxed/simple; bh=cHuW+PoC/Z1Qut9eKmuFeNWun/CMk2X5AcPMdTDPNdc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Pi3uhhXpTSud5dF9JtBlcVM2jSpBa0z+0wdvQ8JP4XKpORgCrJab/tP6r/D/4UKIjMXEM5VZSOfrTwRC+Fx8/gOBD6FRmQqJC2lVUYEVYVEXyIdrlfMRpXCJ24S5lmA41nyQJPxyO0ukAoM7EyK9P6cjue+TMwS4/Cy7YICZV8Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=F6mOaSIn; arc=none smtp.client-ip=185.226.149.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="F6mOaSIn" Received: from mailtransmit02.runbox ([10.9.9.162] helo=aibo.runbox.com) by mailtransmit05.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1x1pAz-00Apwz-F0; Wed, 02 Sep 2026 19:55:09 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=2fxNQ3cklJgeh+Wdn7qij4WTU+lRYoEvYB4H1QfnGkk=; b=F6mOaSInNmI/4+IX8kuWbZXR4j bXw7nbZ+2Ow0ksDuY1b0KmeDwmr3ZrlYy7UFaFsJV6Zg31+qRRiIqM9s2GcoWAJBD7fy5f0xpbsQ5 rvCZEWJ+ddfkrtcqvtgvOEWrl/hXwdQiUUYNxU3egKq+8lgsAq/fNaQJrcfVCZwgoIvCIzv73Y+IH QLY40ejF/ZUhkcVhVZWwCIy69bQnu/Pkt4VTsKQRG2aIfkbzJjQMGFUif1WY6tYURNtUAOEDkaJoa aVfLOm4AsrBEn9GlTUoPYDVAPqhQXwAHGPqpGmFPDRLAIDLghnw2m3JSQzaU5CWrx1iDeEGOkoMjc sdauiRMw==; Received: from [10.9.9.73] (helo=submission02.runbox) by mailtransmit02.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1x1pAy-00072p-U0; Wed, 02 Sep 2026 19:55:09 +0200 Received: by submission02.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.95) id 1x1pAk-0020Qt-QS; Wed, 02 Sep 2026 19:54:54 +0200 From: Michal Luczaj Date: Wed, 02 Sep 2026 19:52:15 +0200 Subject: [PATCH bpf v3 2/2] bpf: Fix reference leak in bpf_sk_assign() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260902-sockmap-lookup-tcp-leak-v3-2-b998b3d49d07@rbox.co> References: <20260902-sockmap-lookup-tcp-leak-v3-0-b998b3d49d07@rbox.co> In-Reply-To: <20260902-sockmap-lookup-tcp-leak-v3-0-b998b3d49d07@rbox.co> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , John Fastabend , Stanislav Fomichev , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Kuniyuki Iwashima , Willem de Bruijn , Jakub Sitnicki , Jiayuan Chen , Joe Stringer , Ihor Solodrai , Pablo Neira Ayuso , Florian Westphal , Phil Sutter Cc: Michal Luczaj , bpf@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org X-Mailer: b4 0.15.2 sk_is_refcounted() is mutable; it depends on sk_state and SOCK_RCU_FREE. TC bpf_sk_assign() uses it at assign time to take a reference and lets sock_pfree() re-evaluate it at free time. If the socket becomes non-refcounted in between, e.g. connect(AF_UNSPEC) + listen() sets SOCK_RCU_FREE, the reference is leaked. Freeze the decision at assign time. If the socket is refcounted (i.e. can become non-refcounted), take a reference and set sock_pfree_refcounted() as the destructor; otherwise stick with sock_pfree(), which effectively becomes a no-op destructor. Next, extend skb_sk_is_prefetched() to handle both dtors and, for the sake of CONFIG_INET=3Dn, add a specialized skb_sk_is_prefetched_noref(). Adapt prefetched-skb treatment in __nf_queue() and skb_steal_sock(). The latter changes its contract with callers: inet{,6}_steal_sock() must now expect a refcounted TCP_LISTEN socket. Fixes: 7ae215d23c12 ("bpf: Don't refcount LISTEN sockets in sk_assign()") Signed-off-by: Michal Luczaj --- include/net/inet6_hashtables.h | 9 +++++---- include/net/inet_hashtables.h | 9 +++++---- include/net/request_sock.h | 2 +- include/net/sock.h | 11 +++++++++++ net/core/filter.c | 19 ++++++++++++++++--- net/netfilter/nf_queue.c | 18 +++++++++--------- 6 files changed, 47 insertions(+), 21 deletions(-) diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h index 2cc5d416bbb5..a310cb91611c 100644 --- a/include/net/inet6_hashtables.h +++ b/include/net/inet6_hashtables.h @@ -134,10 +134,11 @@ struct sock *inet6_steal_sock(struct net *net, struct= sk_buff *skb, int doff, if (!reuse_sk) return sk; =20 - /* We've chosen a new reuseport sock which is never refcounted. This - * implies that sk also isn't refcounted. - */ - WARN_ON_ONCE(*refcounted); + /* New reuseport sock is never refcounted; drop the old sk's ref. */ + if (*refcounted) { + sock_put(sk); + *refcounted =3D false; + } =20 return reuse_sk; } diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h index 6e2fe186d0dc..1589e9e7ecb2 100644 --- a/include/net/inet_hashtables.h +++ b/include/net/inet_hashtables.h @@ -474,10 +474,11 @@ struct sock *inet_steal_sock(struct net *net, struct = sk_buff *skb, int doff, if (!reuse_sk) return sk; =20 - /* We've chosen a new reuseport sock which is never refcounted. This - * implies that sk also isn't refcounted. - */ - WARN_ON_ONCE(*refcounted); + /* New reuseport sock is never refcounted; drop the old sk's ref. */ + if (*refcounted) { + sock_put(sk); + *refcounted =3D false; + } =20 return reuse_sk; } diff --git a/include/net/request_sock.h b/include/net/request_sock.h index 5a9c826a7092..3fb114fa77de 100644 --- a/include/net/request_sock.h +++ b/include/net/request_sock.h @@ -113,7 +113,7 @@ static inline struct sock *skb_steal_sock(struct sk_buf= f *skb, return sk; } #endif - *refcounted =3D sk_is_refcounted(sk); + *refcounted =3D !skb_sk_is_prefetched_noref(skb); } else { *refcounted =3D true; } diff --git a/include/net/sock.h b/include/net/sock.h index 51185222aac2..fb553697db83 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1870,6 +1870,7 @@ void sock_efree(struct sk_buff *skb); #ifdef CONFIG_INET void sock_edemux(struct sk_buff *skb); void sock_pfree(struct sk_buff *skb); +void sock_pfree_refcounted(struct sk_buff *skb); =20 static inline void skb_set_owner_edemux(struct sk_buff *skb, struct sock *= sk) { @@ -3015,6 +3016,16 @@ static inline void sk_eat_skb(struct sock *sk, struc= t sk_buff *skb) static inline bool skb_sk_is_prefetched(struct sk_buff *skb) { +#ifdef CONFIG_INET + return skb->destructor =3D=3D sock_pfree || + skb->destructor =3D=3D sock_pfree_refcounted; +#else + return false; +#endif /* CONFIG_INET */ +} + +static inline bool skb_sk_is_prefetched_noref(struct sk_buff *skb) +{ #ifdef CONFIG_INET return skb->destructor =3D=3D sock_pfree; #else diff --git a/net/core/filter.c b/net/core/filter.c index 66d83a198ea2..e473ad8c9b3c 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7989,8 +7989,20 @@ static const struct bpf_func_proto bpf_tcp_gen_synco= okie_proto =3D { .arg5_type =3D ARG_MEM_SIZE, }; =20 +/* + * skb destructor set by TC bpf_sk_assign(), refcounted path only. + * Acts as a "prefetched by bpf, ref taken" marker. + */ +void sock_pfree_refcounted(struct sk_buff *skb) +{ + sock_gen_put(skb->sk); +} +EXPORT_SYMBOL(sock_pfree_refcounted); + BPF_CALL_3(bpf_sk_assign, struct sk_buff *, skb, struct sock *, sk, u64, f= lags) { + bool refcounted; + if (!sk || flags !=3D 0) return -EINVAL; if (!skb_at_tc_ingress(skb)) @@ -7999,13 +8011,14 @@ BPF_CALL_3(bpf_sk_assign, struct sk_buff *, skb, st= ruct sock *, sk, u64, flags) return -ENETUNREACH; if (sk_unhashed(sk)) return -EOPNOTSUPP; - if (sk_is_refcounted(sk) && - unlikely(!refcount_inc_not_zero(&sk->sk_refcnt))) + + refcounted =3D sk_is_refcounted(sk); + if (refcounted && unlikely(!refcount_inc_not_zero(&sk->sk_refcnt))) return -ENOENT; =20 skb_orphan(skb); skb->sk =3D sk; - skb->destructor =3D sock_pfree; + skb->destructor =3D refcounted ? sock_pfree_refcounted : sock_pfree; =20 return 0; } diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c index 73363ceedebe..e2e9739c00ac 100644 --- a/net/netfilter/nf_queue.c +++ b/net/netfilter/nf_queue.c @@ -195,16 +195,16 @@ static int __nf_queue(struct sk_buff *skb, const stru= ct nf_hook_state *state, break; } =20 - if (skb_sk_is_prefetched(skb)) { - struct sock *sk =3D skb->sk; - - if (!sk_is_refcounted(sk)) { - if (!refcount_inc_not_zero(&sk->sk_refcnt)) - return -ENOTCONN; + /* + * If the skb was prefetched without taking sock's ref, bump it. + * Skip sock_pfree-dtor'ed skbs coming from bpf_sk_assign_tcp_reqsk(). + */ + if (skb_sk_is_prefetched_noref(skb) && sk_fullsock(skb->sk)) { + if (!refcount_inc_not_zero(&skb->sk->sk_refcnt)) + return -ENOTCONN; =20 - /* drop refcount on skb_orphan */ - skb->destructor =3D sock_edemux; - } + /* drop refcount on skb_orphan */ + skb->destructor =3D sock_edemux; } =20 entry =3D kmalloc(sizeof(*entry) + route_key_size, GFP_ATOMIC); --=20 2.55.0