[PATCH bpf v3 0/2] bpf: Fix socket leaks around connect(AF_UNSPEC)+listen() · Michal Luczaj <hidden> · 2026-09-02
[PATCH bpf v3 1/2] bpf: Unconditionally take socket references in lookup helpers · Michal Luczaj <hidden> · 2026-09-02
[PATCH bpf v3 2/2] bpf: Fix reference leak in bpf_sk_assign() · Michal Luczaj <hidden> · 2026-09-02
Re: [PATCH bpf v3 0/2] bpf: Fix socket leaks around connect(AF_UNSPEC)+listen() · Kuniyuki Iwashima <kuniyu@google.com> · 2026-09-02
Re: [PATCH bpf v3 0/2] bpf: Fix socket leaks around connect(AF_UNSPEC)+listen() · Jakub Kicinski <kuba@kernel.org> · 2026-09-02
Re: [PATCH bpf v3 0/2] bpf: Fix socket leaks around connect(AF_UNSPEC)+listen() · Kuniyuki Iwashima <kuniyu@google.com> · 2026-09-02
Re: [PATCH bpf v3 0/2] bpf: Fix socket leaks around connect(AF_UNSPEC)+listen() · Kuniyuki Iwashima <kuniyu@google.com> · 2026-09-02
Re: [PATCH bpf v3 0/2] bpf: Fix socket leaks around connect(AF_UNSPEC)+listen() · Alexei Starovoitov <hidden> · 2026-09-05

Re: [PATCH bpf v3 0/2] bpf: Fix socket leaks around connect(AF_UNSPEC)+listen()

From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-09-02 22:52:23
Also in: bpf, lkml, netfilter-devel

On Wed, 2 Sep 2026 11:58:49 -0700 Kuniyuki Iwashima wrote:

quoted

Several BPF socket helpers acquire a socket reference only when
sk_is_refcounted() == true, and release it, independently, by
re-evaluating sk_is_refcounted() again at the time the release runs. TCP
connect(AF_UNSPEC)+listen() sets SOCK_RCU_FREE on an established socket.

Due to several bug reports, we are now inclined to forbid the
buggy transformation.
https://lore.kernel.org/netdev/CANn89i+px52TtJy3S9=uHxGj3s-WueguRo1Z_4FxO=02KLmwmQ@mail.gmail.com/ (local)

Kuniyuki, would you be willing to send a patch to do that?
Not sure if anyone else is planning to, I wasn't..

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help