Re: [PATCH bpf] bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

[Kuniyuki Iwashima]

On Fri, Jul 10, 2026 at 7:32 AM Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote:
>
> Hi Jose,
>
> On 7/10/26 3:44 PM, Jose Fernandez (Anthropic) wrote:
> > Hi all,
> >
> > Gentle ping. This has Reviewed-by from Jiayuan Chen and Emil Tsalapatis
> > and no outstanding objections since Jun 29. Is anything else needed for
> > bpf-fixes?
> >
> > On the automated review's flag about the pre-existing double-put on the
> > bpf_iter_tcp_realloc_batch() failure path (cur_sk/end_sk not reset
> > before seq_stop, so cookies can be re-put as pointers): agreed it is
> > real, and it predates this change. As Jiayuan noted, it is a separate,
> > pre-existing issue best addressed on its own; I kept this patch minimal
> > for stable.
>
> Given TCP, it would be good to still get an Ack from Kuniyuki or Eric and
> then we can ship it. Are you planning to also follow-up with the other pre-
> existing issue finding?

Oh sorry, somehow I missed this patch.  Will look into it today.

Thanks !