Jiayuan Chen 01b245ba01 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() ... sk_protocol lives in struct sock, not in struct sock_common. A timewait or request sock handed to bpf_sock_destroy() by the tcp iterator is neither, so reading sk->sk_protocol runs past the object: ================================================================== BUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0 Read of size 2 at addr ffff8881047d11b4 by task test_progs/428 Tainted: [W]=WARN Call Trace: <TASK> dump_stack_lvl+0x91/0xf0 print_report+0xd1/0x630 kasan_report+0xf3/0x130 __asan_report_load2_noabort+0x14/0x30 bpf_sock_destroy+0xc7/0xe0 bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7 bpf_iter_run_prog+0x538/0xde0 bpf_iter_tcp_seq_show+0x26b/0x4b0 bpf_seq_read+0x424/0x1210 vfs_read+0x197/0xe40 ksys_read+0x119/0x240 __x64_sys_read+0x72/0xc0 x64_sys_call+0x647/0x27e0 do_syscall_64+0xe5/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Only check sk_protocol on full socks. tcp_abort() already knows how to deal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it never matched the code. Fixes: 4ddbcb8862 ("bpf: Add bpf_sock_destroy kfunc") Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu> Closes: https://lore.kernel.org/bpf/20260702224519.800135-1-xmei5@asu.edu/ Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://lore.kernel.org/r/20260910112634.152195-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2026-09-10 16:58:40 -07:00
..
bpf_ksock.c	bpf: Add ksock kfuncs	2026-08-15 23:36:18 +02:00
bpf_sk_storage.c	bpf: Fix UAF in sock clone early bailouts	2026-07-09 18:44:16 +02:00
datagram.c	net: devmem: prevent net-iov / page mixing	2026-07-30 16:27:03 -07:00
dev_addr_lists_test.c	net: cache snapshot entries for ndo_set_rx_mode_async	2026-04-21 12:50:13 +02:00
dev_addr_lists.c	net: turn the rx_mode work into a generic netdev_work facility	2026-06-25 10:18:40 -07:00
dev_api.c	net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work	2026-04-21 12:50:03 +02:00
dev_ioctl.c	net: ethtool: make dev->hwprov ops-protected	2026-06-09 10:13:04 -07:00
dev.c	net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().	2026-09-02 18:30:00 -07:00
dev.h	net: avoid theoretical races with ref drain	2026-08-06 09:37:03 -07:00
devmem.c	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
devmem.h	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
drop_monitor.c	drop_monitor: perform u64_stats updates under IRQ-disabled section	2026-07-23 11:00:01 -07:00
dst_cache.c
dst.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
failover.c	net: failover: check register_netdevice_notifier() error in failover_init()	2026-08-04 18:46:34 -07:00
fib_notifier.c	net: Add SPDX ids to some source files	2026-03-09 18:32:45 -07:00
fib_rules.c	net: fib_rules: Destroy ops->lock in fib_rules_unregister().	2026-07-07 10:51:06 +02:00
filter.c	bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()	2026-09-10 16:58:40 -07:00
flow_dissector.c	flow_dissector: check device type before reading ETH_ADDRS	2026-06-18 18:07:00 -07:00
flow_offload.c	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
gen_estimator.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
gen_stats.c	net/sched: add const qualifiers to gnet_stats helpers	2026-05-11 18:28:08 -07:00
gro_cells.c	net: iptunnel: fix stale transport header during tunnel decapsulation	2026-08-28 15:53:46 -07:00
gro.c	net: gro: fix double aggregation of flush-marked skbs	2026-07-21 08:30:54 -07:00
gso.c
hotdata.c	net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros	2026-03-29 11:21:22 -07:00
hwbm.c
ieee8021q_helpers.c
link_watch.c	net: rename netdev_ops_assert_locked()	2026-06-04 14:04:55 -07:00
lock_debug.c	net: require instance lock for NETDEV_DOWN/GOING_DOWN notifiers	2026-07-07 15:31:37 +02:00
lwt_bpf.c	lwt_bpf: Restore reserved headroom after xmit program	2026-08-17 10:59:03 +02:00
lwtunnel.c	net: lwtunnel: Drop skb metadata before LWT encapsulation	2026-06-23 19:07:23 -07:00
Makefile	bpf: Add ksock kfuncs	2026-08-15 23:36:18 +02:00
mp_dmabuf_devmem.h
neighbour.c	neighbour: remove obsolete EXPORT_SYMBOL()	2026-06-08 15:59:17 -07:00
net_namespace.c	net: fix a resource leak in copy_net_ns() error handling path	2026-08-25 12:30:55 +02:00
net_test.c
net-procfs.c	net: add proper RCU protection to /proc/net/ptype	2026-02-03 19:20:30 -08:00
net-sysfs.c	net: add READ_ONCE()/WRITE_ONCE() annotations for dev->num_tc	2026-08-17 10:27:48 -07:00
net-sysfs.h	net: Defer netdev KOBJ_ADD uevent until the device is published	2026-08-06 09:36:18 -07:00
net-traces.c
netclassid_cgroup.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
netdev_config.c	net: add queue config validation callback	2026-01-23 11:49:02 -08:00
netdev_queues.c	net: expect instance lock in netdev_queue_get_dma_dev()	2026-08-10 15:54:42 -07:00
netdev_rx_queue.c	net: Stop leased rxq before uninstalling its memory provider	2026-06-11 15:57:39 -07:00
netdev_work.c	net: avoid theoretical races with ref drain	2026-08-06 09:37:03 -07:00
netdev-genl-gen.c	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
netdev-genl-gen.h	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
netdev-genl.c	netdev: check for nla_put_u32() failures	2026-08-10 16:38:40 -07:00
netevent.c
netmem_priv.h	Revert "mm: introduce a new page type for page pool in page type"	2026-05-21 19:06:13 -07:00
netpoll.c	netconsole: move netpoll_wait_carrier() as netcons_wait_carrier()	2026-07-30 12:14:39 +02:00
netprio_cgroup.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
of_net.c
page_pool_priv.h
page_pool_user.c	net: make page_pool_get_stats() void	2026-05-28 18:10:03 -07:00
page_pool.c	page_pool: keep frag_offset aligned for odd-sized requests	2026-08-31 16:24:51 -07:00
pktgen.c	net: pktgen: use a consistent flow count	2026-08-17 12:50:51 -07:00
ptp_classifier.c
rtnetlink.c	rtnetlink: cap IFLA_VFINFO_LIST at a documented number of VFs	2026-08-06 12:42:49 +02:00
scm.c	net: af_unix: useful handling of LSM denials on SCM_RIGHTS	2026-08-17 18:14:52 -07:00
secure_seq.c	tcp: secure_seq: add back ports to TS offset	2026-03-04 17:44:35 -08:00
selftests.c	net: Use helpers to get/set UDP len tree-wide	2026-07-22 13:47:02 +02:00
skb_fault_injection.c
skbuff.c	net: Guard for gso_segs overflow in skb_segment	2026-08-27 15:47:18 +02:00
skmsg.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-06-16 14:59:58 -07:00
sock_diag.c	net: Add SPDX ids to some source files	2026-03-09 18:32:45 -07:00
sock_map.c	bpf, sockmap: Use sock_hold() instead of refcount_inc_not_zero() in lookup	2026-08-17 10:22:19 +02:00
sock_reuseport.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
sock.c	net: psp: do not inherit the Rx association on clone	2026-09-01 15:12:24 +02:00
stream.c	net: remove some unused EXPORT_SYMBOL()s	2026-06-12 16:43:11 -07:00
sysctl_net_core.c	net: Const qualify network templated ctl_tables Arrays	2026-08-13 13:12:24 +02:00
timestamping.c
tso.c	net: Use helpers to get/set UDP len tree-wide	2026-07-22 13:47:02 +02:00
utils.c	kernel.h: drop hex.h and update all hex.h users	2026-01-20 19:44:19 -08:00
xdp.c	xdp: fix zero-copy frame layout	2026-08-22 13:10:48 -07:00