Re: [PATCH v2 bpf 1/6] bpf: tcp: Fix type confusion in bpf_tcp_sock().

On Mon, May 4, 2026 at 9:14 PM <[email protected]> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] The OpenVPN (ovpn) driver contains a critical type confusion vulnerability due to insufficient socket type checking, leading to out-of-bounds slab writes.
> --
>
> commit 3e93f247feecc891b15b8d713331586af9371dfd
> Author: Kuniyuki Iwashima <[email protected]>
>
> bpf: tcp: Fix type confusion in bpf_tcp_sock().
>
> This commit fixes an out-of-bounds slab access bug in BPF by using sk_is_tcp()
> instead of just checking sk_protocol for IPPROTO_TCP. This prevents raw sockets
> created with IPPROTO_TCP from bypassing the type check.
>
> > diff --git a/net/core/filter.c b/net/core/filter.c
> > index bc96c18df4e03..cd88633f8dc14 100644
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -7475,7 +7475,7 @@ u32 bpf_tcp_sock_convert_ctx_access(enum bpf_access_type type,
> >
> >  BPF_CALL_1(bpf_tcp_sock, struct sock *, sk)
> >  {
> > -     if (sk_fullsock(sk) && sk->sk_protocol == IPPROTO_TCP)
> > +     if (sk_fullsock(sk) && sk_is_tcp(sk))
>
> This correctly prevents a type confusion where a raw socket can bypass the
> protocol check. Does the OpenVPN (ovpn) driver need a similar fix for this
> exact same pattern?
>
> In drivers/net/ovpn/netlink.c, the driver accepts an arbitrary socket file
> descriptor from userspace and determines the socket type using only sk_protocol
> without verifying sk_type.

Not related to BPF.  The point sounds valid, but I'd let
ovpn folks follow up.