kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity

Merge branch 'bpf-tcp-fix-bpf_sock_destroy-on-time_wait-and-listener-socks'

Browse source 
Jiayuan Chen says:

====================
bpf,tcp: Fix bpf_sock_destroy() on TIME_WAIT and listener socks

Fix two bugs in bpf_sock_destroy(). One is an out-of-bounds read of
sk->sk_protocol on TIME_WAIT and NEW_SYN_RECV socks, since the field is
not in struct sock_common. The other is a might_sleep splat when
destroying a listener with children in its accept queue, the
cond_resched() in inet_csk_listen_stop() runs under the iterator's
rcu_read_lock(). Patch 3 adds a subtest for each.

v2 -> v3:
 - Patch 1: add Reviewed-by from Kuniyuki.
 - Patch 2: reword why cond_resched() has to go, it can reschedule or
   report a bogus quiescent state there.
 - Patch 2: keep the cond_resched() for the non-BPF path rather than
   removing it as Kuniyuki suggested. VOLUNTARY and NONE are still
   there on some arches, and on x86 in stable where this goes, so a
   big listener close() still relies on it. Can go once those modes
   are gone.
 - Selftest: don't leak the fd if accept() unexpectedly succeeds.
v2: https://lore.kernel.org/bpf/20260906074135.185212-1-jiayuan.chen@linux.dev/

v1 -> v2:
 - Patch 1: fix the return comment too.
 - Patch 2: new.
 - Selftest: server recv()s EOF before close so the FINs can't cross,
   comment style, keep the blank line before RUN_TESTS(), add the
   tcp_listen_pending subtest.
v1: https://lore.kernel.org/bpf/20260903125306.299943-1-jiayuan.chen@linux.dev/
====================

Link: https://patch.msgid.link/20260910112107.148770-1-jiayuan.chen@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Alexei Starovoitov 2026-09-10 16:58:40 -07:00
commit 15071f2a12
4 changed files with 162 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files