linux-kernel - Re: [PATCH bpf-next] bpf: Allow bpf_tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <DG75D8PWP35E.2MD9TYHOCQO9V@cloudflare.com>
Date: Thu, 05 Feb 2026 16:52:27 +0100
From: "Arthur Fabre" <afabre@...udflare.com>
To: "Martin KaFai Lau" <martin.lau@...ux.dev>
Cc: <daniel@...earbox.net>, <john.fastabend@...il.com>, <sdf@...ichev.me>,
 <ast@...nel.org>, <andrii@...nel.org>, <eddyz87@...il.com>,
 <song@...nel.org>, <yonghong.song@...ux.dev>, <kpsingh@...nel.org>,
 <haoluo@...gle.com>, <jolsa@...nel.org>, <davem@...emloft.net>,
 <edumazet@...gle.com>, <kuba@...nel.org>, <pabeni@...hat.com>,
 <horms@...nel.org>, <bpf@...r.kernel.org>, <netdev@...r.kernel.org>,
 <linux-kernel@...r.kernel.org>, <kernel-team@...udflare.com>,
 <wferguson@...udflare.com>, <martin.lau@...nel.org>, <clm@...a.com>,
 <ihor.solodrai@...ux.dev>, <bot+bpf-ci@...nel.org>
Subject: Re: [PATCH bpf-next] bpf: Allow bpf_tcp_sock() helper in XDP

On Wed Feb 4, 2026 at 11:27 PM CET, Martin KaFai Lau wrote:
>
>
> On 2/4/26 5:04 AM, bot+bpf-ci@...nel.org wrote:
> >>      But the TCP TIME-WAIT state needs special handling for this: packets
> >>      received for a TIME-WAIT socket can either belong to the current
> >>      incarnation of the connection, or a new incarnation. The only way to
> >>      determine this is to compare the sequence numbers.
> >>
> >>      Add the bpf_tcp_sock() helper in XDP to allow the socket sequence
> >>      numbers to be read.
> > 
> > Can this approach work for TIME-WAIT sockets? Looking at bpf_tcp_sock() in
> > net/core/filter.c:
> > 
> >      if (sk_fullsock(sk) && sk->sk_protocol == IPPROTO_TCP)
> >          return (unsigned long)sk;
> >      return (unsigned long)NULL;
> > 
> > And sk_fullsock() in include/net/sock.h:
> > 
> >      static inline bool sk_fullsock(const struct sock *sk)
> >      {
> >          return (1 << sk->sk_state) & ~(TCPF_TIME_WAIT | TCPF_NEW_SYN_RECV);
> >      }
> > 
> > TIME-WAIT sockets are explicitly excluded by sk_fullsock(), so bpf_tcp_sock()
> > returns NULL for them. The sequence numbers stored in TIME-WAIT sockets
> > (skc_tw_rcv_nxt and skc_tw_snd_nxt in sock_common) would not be accessible
> > through this helper.
> > 
> > The change itself is useful for accessing tcp_sock fields from established
> > connections in XDP, but the commit message implies this solves the TIME-WAIT
> > sequence number problem described, which doesn't appear to be the case.
>
> or use "tp = bpf_core_cast(sk, struct tcp_sock /* or tcp_timewait_sock 
> */);". The bpf prog can also read all members of the kernel struct 
> instead of a subset defined in bpf_tcp_sock.

Brilliant, that works! Thanks Martin.

>
> pw-bot: cr
>
> > 
> > 
> > ---
> > AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> > See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> > 
> > CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21671977729
> > 
> > AI-authorship-score: low
> > AI-authorship-explanation: The commit message style is consistent with human-written kernel patches, with natural technical language and standard formatting; the technical error is more likely human oversight than AI hallucination.
> > issues-found: 1
> > issue-severity-score: low
> > issue-severity-explanation: The issue is a misleading commit message that claims the change enables TIME-WAIT socket sequence number reading, but the bpf_tcp_sock() helper explicitly returns NULL for TIME-WAIT sockets.