Re: [PATCH bpf v1 1/2] mptcp, bpf: reject bpf_sk_release() on msk

[Matthieu Baerts]

Hi Jiayuan,

+Cc Kalpan, Paolo.

On 17/09/2026 10:11, Jiayuan Chen wrote:
> A bpf prog can do this today:
> 
> 	subflow = bpf_skc_lookup_tcp(...);
> 	msk = bpf_skc_to_mptcp_sock(subflow);
> 	bpf_sk_release(msk);
> 
> bpf_skc_to_mptcp_sock() returns subflow->conn without taking any
> reference, so bpf_sk_release() drops a refcount nobody took on the msk,
> and the subflow reference is leaked:
Thank you for looking at this!

Note that Kalpan was looking at this [1], and Paolo suggested removing
the helper [2] (but we failed to review the last version so far, sorry
about that...)

I don't know if there are progs already using it. If yes, I guess your
approach is better (but I'm not comfortable reviewing verifier's code).

@Kalpan, WDYT?

[1] https://lore.kernel.org/20260818120437.3949686-1-kalpan.jani@xxxxxxxxxxxxxxxxxx
[2] https://lore.kernel.org/e039e866-fe7e-41ef-ad41-92a76a123713@xxxxxxxxxx

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.