Re: [PATCH 1/1] bpf: Check sk_fullsock() in bpf_tcp_*_syncookie

From: Ren Wei <[email protected]>
Date: Sat,  1 Aug 2026 21:59:39 +0800
> From: Luxiao Xu <[email protected]>
> 
> bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer
> 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access
> sk->sk_protocol without validating whether 'sk' represents a full socket.
> 
> When a BPF program passes a mini-socket (such as struct request_sock or
> struct inet_timewait_sock obtained via bpf_skc_lookup_tcp), sk_protocol
> is located beyond the memory boundary allocated for mini-sockets.
> Directly dereferencing sk->sk_protocol leads to a slab-out-of-bounds
> kernel read.
> 
> Fix this issue by adding a sk_fullsock(sk) check at the start of both
> bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie before inspecting
> fullsock-specific fields.
> 
> Fixes: c0df236e1394 ("bpf: Change bpf_tcp_*_syncookie to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON")
> Cc: [email protected]
> Reported-by: Vega <[email protected]>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Luxiao Xu <[email protected]>
> Signed-off-by: Ren Wei <[email protected]>
> ---
>  net/core/filter.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/net/core/filter.c b/net/core/filter.c
> index b446aa8be5c3..afdcfdf41489 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -7678,6 +7678,9 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len
>  	if (unlikely(!sk || th_len < sizeof(*th)))
>  		return -EINVAL;
>  
> +	if (!sk_fullsock(sk))
> +		return -EINVAL;
> +
>  	/* sk_listener() allows TCP_NEW_SYN_RECV, which makes no sense here. */
>  	if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN)

Simply swap the order of these, TCP_LISTEN implies full sock.


>  		return -EINVAL;
> @@ -7752,6 +7755,9 @@ BPF_CALL_5(bpf_tcp_gen_syncookie, struct sock *, sk, void *, iph, u32, iph_len,
>  	if (unlikely(!sk || th_len < sizeof(*th) || th_len != th->doff * 4))
>  		return -EINVAL;
>  
> +	if (!sk_fullsock(sk))
> +		return -EINVAL;
> +
>  	if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN)
>  		return -EINVAL;
>  
> -- 
> 2.43.0