Thread (9 messages) 9 messages, 5 authors, 10d ago

Re: [PATCH bpf] bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

From: Daniel Borkmann <daniel@iogearbox.net>
Date: 2026-07-10 14:32:46
Also in: bpf, lkml

Hi Jose,

On 7/10/26 3:44 PM, Jose Fernandez (Anthropic) wrote:
Hi all,

Gentle ping. This has Reviewed-by from Jiayuan Chen and Emil Tsalapatis
and no outstanding objections since Jun 29. Is anything else needed for
bpf-fixes?

On the automated review's flag about the pre-existing double-put on the
bpf_iter_tcp_realloc_batch() failure path (cur_sk/end_sk not reset
before seq_stop, so cookies can be re-put as pointers): agreed it is
real, and it predates this change. As Jiayuan noted, it is a separate,
pre-existing issue best addressed on its own; I kept this patch minimal
for stable.
Given TCP, it would be good to still get an Ack from Kuniyuki or Eric and
then we can ship it. Are you planning to also follow-up with the other pre-
existing issue finding?

Thanks a lot,
Daniel
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help