linux-kernel - Re: [PATCH bpf-next] bpf: Allow bpf_tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <167a8f4235973cd42372884aa66182a10fd17e50c70626b1fa0e659933e82b4e@mail.kernel.org>
Date: Wed,  4 Feb 2026 13:04:55 +0000 (UTC)
From: bot+bpf-ci@...nel.org
To: afabre@...udflare.com,martin.lau@...ux.dev,daniel@...earbox.net,john.fastabend@...il.com,sdf@...ichev.me,ast@...nel.org,andrii@...nel.org,eddyz87@...il.com,song@...nel.org,yonghong.song@...ux.dev,kpsingh@...nel.org,haoluo@...gle.com,jolsa@...nel.org,davem@...emloft.net,edumazet@...gle.com,kuba@...nel.org,pabeni@...hat.com,horms@...nel.org
Cc: bpf@...r.kernel.org,netdev@...r.kernel.org,linux-kernel@...r.kernel.org,kernel-team@...udflare.com,wferguson@...udflare.com,afabre@...udflare.com,ast@...nel.org,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,eddyz87@...il.com,yonghong.song@...ux.dev,clm@...a.com,ihor.solodrai@...ux.dev
Subject: Re: [PATCH bpf-next] bpf: Allow bpf_tcp_sock() helper in XDP

>     But the TCP TIME-WAIT state needs special handling for this: packets
>     received for a TIME-WAIT socket can either belong to the current
>     incarnation of the connection, or a new incarnation. The only way to
>     determine this is to compare the sequence numbers.
>
>     Add the bpf_tcp_sock() helper in XDP to allow the socket sequence
>     numbers to be read.

Can this approach work for TIME-WAIT sockets? Looking at bpf_tcp_sock() in
net/core/filter.c:

    if (sk_fullsock(sk) && sk->sk_protocol == IPPROTO_TCP)
        return (unsigned long)sk;
    return (unsigned long)NULL;

And sk_fullsock() in include/net/sock.h:

    static inline bool sk_fullsock(const struct sock *sk)
    {
        return (1 << sk->sk_state) & ~(TCPF_TIME_WAIT | TCPF_NEW_SYN_RECV);
    }

TIME-WAIT sockets are explicitly excluded by sk_fullsock(), so bpf_tcp_sock()
returns NULL for them. The sequence numbers stored in TIME-WAIT sockets
(skc_tw_rcv_nxt and skc_tw_snd_nxt in sock_common) would not be accessible
through this helper.

The change itself is useful for accessing tcp_sock fields from established
connections in XDP, but the commit message implies this solves the TIME-WAIT
sequence number problem described, which doesn't appear to be the case.

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21671977729

AI-authorship-score: low
AI-authorship-explanation: The commit message style is consistent with human-written kernel patches, with natural technical language and standard formatting; the technical error is more likely human oversight than AI hallucination.
issues-found: 1
issue-severity-score: low
issue-severity-explanation: The issue is a misleading commit message that claims the change enables TIME-WAIT socket sequence number reading, but the bpf_tcp_sock() helper explicitly returns NULL for TIME-WAIT sockets.