Re: [PATCH mptcp-net v5] mptcp: bpf: fix NULL deref and UAF in bpf_mptcp_sock_from_subflow()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] UAPI Breakage: Unnecessary removal of BPF helper `bpf_skc_to_mptcp_sock` from tracing programs.
--

--- Patch [1]: [PATCH mptcp-net v5] mptcp: bpf: fix NULL deref and UAF in bpf_mptcp_sock_from_subflow() ---
commit 38297906a34000d9bfada12a688129bcb90092ca
Author: Kalpan Jani <[email protected]>

mptcp: bpf: fix NULL deref and UAF in bpf_mptcp_sock_from_subflow()

This patch fixes several race conditions and use-after-free bugs in
bpf_mptcp_sock_from_subflow() when accessed locklessly. It introduces RCU
dereferencing, acquire/release semantics, and delays parent socket freeing
via an RCU grace period. Additionally, it removes the helper from tracing
programs.

Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/622

> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 75495a5c35079..ad4b8d04b190a 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -1745,8 +1745,6 @@ tracing_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>  		return &bpf_skc_to_udp6_sock_proto;
>  	case BPF_FUNC_skc_to_unix_sock:
>  		return &bpf_skc_to_unix_sock_proto;
> -	case BPF_FUNC_skc_to_mptcp_sock:
> -		return &bpf_skc_to_mptcp_sock_proto;

[Severity: Medium]
Does removing this BPF helper break ABI backward compatibility for existing
userspace tracing tools?

The commit message states "Tracing stays removed since nothing needs it
there", but out-of-tree tracing scripts or tools might already rely on
BPF_FUNC_skc_to_mptcp_sock being available to tracing programs.

Since the underlying lockless read was properly fixed to be safe via RCU,
acquire/release semantics, and SOCK_RCU_FREE, can this helper be preserved
for tracing programs? If sleepable tracing hooks were the primary concern,
could this be restricted via a prog->sleepable check instead of removing
the helper entirely?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1