Re: [PATCH bpf v3 0/2] bpf: Fix socket leaks around connect(AF_UNSPEC)+listen()

Jakub Kicinski <[email protected]> Wed, 2 Sep 2026 15:52:16 -0700

Newsgroups	gmane.linux.kernel.bpf,gmane.linux.network,gmane.linux.kernel,gmane.comp.security.firewalls.netfilter.devel
Message-ID	<[email protected]>

On Wed, 2 Sep 2026 11:58:49 -0700 Kuniyuki Iwashima wrote:
> > Several BPF socket helpers acquire a socket reference only when
> > sk_is_refcounted() == true, and release it, independently, by
> > re-evaluating sk_is_refcounted() again at the time the release runs. TCP
> > connect(AF_UNSPEC)+listen() sets SOCK_RCU_FREE on an established socket.  
> 
> Due to several bug reports, we are now inclined to forbid the
> buggy transformation.
> https://lore.kernel.org/netdev/CANn89i+px52TtJy3S9=uHxGj3s-WueguRo1Z_4FxO=02KLmwmQ@mail.gmail.com/

Kuniyuki, would you be willing to send a patch to do that?
Not sure if anyone else is planning to, I wasn't..