Hi Kuniyuki,

Thanks for the review!

On Sat, Jul 11, 2026 at 05:36:05AM -0700, Kuniyuki Iwashima wrote:

quoted

+               } else if (!*start_sk) {
+                       /* Remember where we left off. */
+                       *start_sk = sk;
                }
+               expected++;

This should be incremented just after seq_sk_match()
(see below)

Will do.

quoted

@@ -3167,6 +3168,10 @@ static struct sock *bpf_iter_tcp_batch(struct seq_file *seq)
        WARN_ON_ONCE(iter->end_sk != expected);

Let's say the batch array was smaller than the hash chain length
and we reallocate the array based on "expected" w/ the bucket lock.

What happens if refcount_set(..., 3) is called during reallocation ?
bpf_iter_fill_batch() will see the larger "expected", and WARN_ON_ONCE()
will be triggered.

Right. Moving expected++ up fixes the sizing. Since end_sk == expected
then no longer holds when a socket is skipped, I'll make the
batch-complete check and the WARN look for a leftover socket instead.

I'll send a v2 early next week.

Thanks,
Jose