[PATCH bpf v3 0/3] bpf,tcp: Fix bpf_sock_destroy() on TIME_WAIT and listener socks

[Jiayuan Chen <jiayuan.chen@linux.dev>]

Fix two bugs in bpf_sock_destroy(). One is an out-of-bounds read of
sk->sk_protocol on TIME_WAIT and NEW_SYN_RECV socks, since the field is
not in struct sock_common. The other is a might_sleep splat when
destroying a listener with children in its accept queue, the
cond_resched() in inet_csk_listen_stop() runs under the iterator's
rcu_read_lock(). Patch 3 adds a subtest for each.

v2 -> v3:
 - Patch 1: add Reviewed-by from Kuniyuki.
 - Patch 2: reword why cond_resched() has to go, it can reschedule or
   report a bogus quiescent state there.
 - Patch 2: keep the cond_resched() for the non-BPF path rather than
   removing it as Kuniyuki suggested. VOLUNTARY and NONE are still
   there on some arches, and on x86 in stable where this goes, so a
   big listener close() still relies on it. Can go once those modes
   are gone.
 - Selftest: don't leak the fd if accept() unexpectedly succeeds.
v2: https://lore.kernel.org/bpf/20260906074135.185212-1-jiayuan.chen@linux.dev/

v1 -> v2:
 - Patch 1: fix the return comment too.
 - Patch 2: new.
 - Selftest: server recv()s EOF before close so the FINs can't cross,
   comment style, keep the blank line before RUN_TESTS(), add the
   tcp_listen_pending subtest.
v1: https://lore.kernel.org/bpf/20260903125306.299943-1-jiayuan.chen@linux.dev/

Jiayuan Chen (3):
  bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
  tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
  selftests/bpf: Test bpf_sock_destroy() on TIME_WAIT and listener socks

 net/core/filter.c                             |  13 +-
 net/ipv4/inet_connection_sock.c               |   3 +-
 .../selftests/bpf/prog_tests/sock_destroy.c   | 121 ++++++++++++++++++
 .../selftests/bpf/progs/sock_destroy_prog.c   |  30 +++++
 4 files changed, 162 insertions(+), 5 deletions(-)

-- 
2.43.0