diff options
| author | Luxiao Xu <rakukuip@gmail.com> | 2026-08-04 22:29:01 +0800 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2026-08-05 22:24:27 +0200 |
| commit | 31a420a822ff92e2090bd5d65efe8e34e2d6d9b8 (patch) | |
| tree | 4bef6ad94c127169006fee265d485e334c735f1f /Documentation/features/vm | |
| parent | 7cd8645d2b23e396228c78d83ef80a210154a1d9 (diff) | |
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer
'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access
sk->sk_protocol without validating whether 'sk' represents a full socket.
Fix this issue by checking sk->sk_state != TCP_LISTEN before inspecting
sk->sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie.
Since mini-sockets are never in the TCP_LISTEN state, the condition
short-circuits and prevents dereferencing fullsock-specific fields.
Fixes: 399040847084 ("bpf: add helper to check for a valid SYN cookie")
Fixes: 70d66244317e ("bpf: add bpf_tcp_gen_syncookie helper")
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://lore.kernel.org/bpf/6218aa3534d0d2d3f448fde70a8dc2769d7a8201.1785823138.git.rakukuip@gmail.com
Diffstat (limited to 'Documentation/features/vm')
0 files changed, 0 insertions, 0 deletions