From: KaFai Wan <kafai.wan@linux•dev>
To: edumazet@google•com, ncardwell@google•com, kuniyu@google•com,
davem@davemloft•net, dsahern@kernel•org, kuba@kernel•org,
pabeni@redhat•com, horms@kernel•org, ast@kernel•org,
daniel@iogearbox•net, andrii@kernel•org, martin.lau@linux•dev,
eddyz87@gmail•com, memxor@gmail•com, song@kernel•org,
yonghong.song@linux•dev, jolsa@kernel•org, shuah@kernel•org,
kafai.wan@linux•dev, sdf@fomichev•me, netdev@vger•kernel.org,
linux-kernel@vger•kernel.org, bpf@vger•kernel.org,
linux-kselftest@vger•kernel.org
Cc: Quan Sun <2022090917019@std•uestc.edu.cn>,
Yinhao Hu <dddddd@hust•edu.cn>,
Kaiyan Mei <M202472210@hust•edu.cn>
Subject: [PATCH bpf-next 1/2] bpf: tcp: Reject TCP_NODELAY from BPF hdr opt callbacks
Date: Tue, 14 Apr 2026 19:23:09 +0800 [thread overview]
Message-ID: <20260414112310.1285783-2-kafai.wan@linux.dev> (raw)
In-Reply-To: <20260414112310.1285783-1-kafai.wan@linux.dev>
A BPF_SOCK_OPS program can enable
BPF_SOCK_OPS_WRITE_HDR_OPT_CB_FLAG and then call
bpf_setsockopt(TCP_NODELAY) from BPF_SOCK_OPS_HDR_OPT_LEN_CB.
That reaches __tcp_sock_set_nodelay(), which may call
tcp_push_pending_frames(). The transmit path then computes TCP
options again, re-enters bpf_skops_hdr_opt_len(), and invokes the
same BPF callback recursively. This can loop until the kernel
stack overflows.
TCP_NODELAY is not safe from the header option callback context.
Reject it with -EOPNOTSUPP when TCP header option callbacks are
enabled on the socket, so the callback cannot recurse back into
tcp_push_pending_frames() through do_tcp_setsockopt().
Reported-by: Quan Sun <2022090917019@std•uestc.edu.cn>
Reported-by: Yinhao Hu <dddddd@hust•edu.cn>
Reported-by: Kaiyan Mei <M202472210@hust•edu.cn>
Closes: https://lore.kernel.org/bpf/d1d523c9-6901-4454-a183-94462b8f3e4e@std.uestc.edu.cn/
Fixes: 7e41df5dbba2 ("bpf: Add a few optnames to bpf_setsockopt")
Signed-off-by: KaFai Wan <kafai.wan@linux•dev>
---
net/ipv4/tcp.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 202a4e57a218..7ac4c98be19d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -4004,7 +4004,10 @@ int do_tcp_setsockopt(struct sock *sk, int level, int optname,
switch (optname) {
case TCP_NODELAY:
- __tcp_sock_set_nodelay(sk, val);
+ if (val && BPF_SOCK_OPS_TEST_FLAG(tp, BPF_SOCK_OPS_WRITE_HDR_OPT_CB_FLAG))
+ err = -EOPNOTSUPP;
+ else
+ __tcp_sock_set_nodelay(sk, val);
break;
case TCP_THIN_LINEAR_TIMEOUTS:
--
2.43.0
next prev parent reply other threads:[~2026-04-14 11:24 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-14 11:23 [PATCH bpf-next 0/2] bpf: tcp: Reject TCP_NODELAY from BPF hdr opt callbacks KaFai Wan
2026-04-14 11:23 ` KaFai Wan [this message]
2026-04-14 13:56 ` [PATCH bpf-next 1/2] " KaFai Wan
2026-04-15 17:31 ` Martin KaFai Lau
2026-04-14 11:23 ` [PATCH bpf-next 2/2] selftests/bpf: Cover TCP_NODELAY in hdr opt callback KaFai Wan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260414112310.1285783-2-kafai.wan@linux.dev \
--to=kafai.wan@linux$(echo .)dev \
--cc=2022090917019@std$(echo .)uestc.edu.cn \
--cc=M202472210@hust$(echo .)edu.cn \
--cc=andrii@kernel$(echo .)org \
--cc=ast@kernel$(echo .)org \
--cc=bpf@vger$(echo .)kernel.org \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=dddddd@hust$(echo .)edu.cn \
--cc=dsahern@kernel$(echo .)org \
--cc=eddyz87@gmail$(echo .)com \
--cc=edumazet@google$(echo .)com \
--cc=horms@kernel$(echo .)org \
--cc=jolsa@kernel$(echo .)org \
--cc=kuba@kernel$(echo .)org \
--cc=kuniyu@google$(echo .)com \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-kselftest@vger$(echo .)kernel.org \
--cc=martin.lau@linux$(echo .)dev \
--cc=memxor@gmail$(echo .)com \
--cc=ncardwell@google$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=sdf@fomichev$(echo .)me \
--cc=shuah@kernel$(echo .)org \
--cc=song@kernel$(echo .)org \
--cc=yonghong.song@linux$(echo .)dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox