Re: [PATCH mptcp-next v2 2/5] Squash to "bpf: Export mptcp packet scheduler helpers"

Hi Shardul,

On 03/07/2026 18:57, Shardul Bankar wrote:
> mptcp_pm_subflow_chk_stale() is exposed to BPF MPTCP packet schedulers as
> a kfunc taking a generic "struct sock *ssk", but it treats ssk as a
> subflow TCP socket: it derives the subflow context with
> mptcp_subflow_ctx(), an unchecked cast of inet_csk(ssk)->icsk_ulp_data,
> then reads and writes through it. The verifier only proves ssk is a
> trusted struct sock, not that it is one of msk's subflows, so a mistyped
> or foreign socket would make the helper operate on a bogus context.
> 
> Register a bpf_mptcp_pm_subflow_chk_stale() wrapper that validates ssk is
> a full MPTCP subflow TCP socket belonging to the passed msk before calling
> the helper, which assumes both but checks neither. This mirrors
> bpf_mptcp_subflow_ctx(). A scheduler passing one of its own subflows is
> unaffected; the in-tree burst scheduler selftest is updated to the wrapper
> name in a separate squash-to.
Thank you for this!

FYI, this modification should no longer be needed after:

https://lore.kernel.org/0a81a4bf60008faefdd1688012b8fcebc291a4d6.1786026372.git.pabeni@redhat.com

(Being applied now)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.