From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.229.133 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794601340; b=c7sCbAFG3CcmoDjZx8tkzIHLnAC8CXSUzN4nGmlHr3rSY6c85G31NbUQNxC6Pnxo8SQ0 9B4IaBtJtDOsYddrKlRI3MRmy1qA+OHWzzA0PwcLy2LF3PFOGph0C9Gm5xWCp4SonB5ce JFfcJVPcoLfxzmtRk1r9xMgov6T3L02/fHPTBQ1owuX3MUL/MlT8LujZuVdWDZYiZexOk GEXMBjOBWQ/FdQMGlUol1MyMmNuuNv2x/N1O/T8Pob7yjOE0I1ijHleSWUmhPVNCEWB6r bjkSabHwCnkNZV2i0/SAWryqJPeyVVKVD6saq55GFPtEi/uekgv9UPt/rzUapiLPB9g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794601340; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; bh=HopEjVcKVy5WlPlbnxrcDQWkWX0L0xT3AvRN619hsz4=; b=Q5PuyUl3PjHHqZ4RoWsKDQXbv81tP9PBC3cs/LwYqGHQ6YY9ZGyz78M2fP1KHZQ0I1Re 12+rNcEfLQyDZZ4BRFooszAOMAHT5vkNxMf6Pc62rUvsdlSoMwnfxrNDd20y623zgN2a4 6N41Bq2bhJ+RCO7/qtpGquBeuu/snVA1sGhI8WD10C1C5jMz1pEqQgpErgGM20rNwA3IU +f9/h242e1tfPEAO7URxjtN4PQJvs0do8VhBaMxzTOTai/iBm8VUHaHsnl7fuX+/XvqnL OSNC24MogVp0cHCmiFt1uBJOP3w7eW3Ywz7gSZTLvt65JuFPk0CzhvlVvUgPAM/+ORw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=OpB7fYZ5; arc=none smtp.remote-ip=74.125.229.133 Received: from mail-dl2-f5.google.com (mail-dl2-f5.google.com [74.125.229.133]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C98D606A33E for ; Fri, 13 Nov 2026 20:22:19 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 8C98D606A33E Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=OpB7fYZ5 Received: by mail-dl2-f5.google.com with SMTP id a92af1059eb24-1ac216daf7dso450204c88.1 for ; Fri, 13 Nov 2026 12:22:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794601339; x=1795206139; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=HopEjVcKVy5WlPlbnxrcDQWkWX0L0xT3AvRN619hsz4=; b=OpB7fYZ5oudIYsb91KeZQgQ1i2+Yz+pWWPbfqpFJ0c/wuhFClNklZv6sc4wpmQeaDl mUOsbOVX7fX4RiViMDJs2bAsdSH/f7cYI4vJPbL3GaFQcLDk2FVjwuZryQqyXIUMjYIc cq8hIvkyFTHYgr64EYJprVhlJq+G0bix/FOaebLcvIFybOfqUcuDl9cx3LTbKx6THvar 0Sgko3b/NsmmejwxUdRbl7fx9witxeyO2B3kJMMwS2bWhIRQFd5P0Z5zAK4L+w0MZ7Nh IqN2OxnSyPaddB0xEhdEs0rSnMF0M6WyShKcYcMK8UgAo/+ut4VgCMY/0f6ljygrmQdK 5qsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794601339; x=1795206139; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=HopEjVcKVy5WlPlbnxrcDQWkWX0L0xT3AvRN619hsz4=; b=XxqbT3H5bQPHxBZq9RTOTitzU9H6CL4nVQvB95BpMWoeyHP9zfbTYBVpYUcOu6hr9z rnGDHgUo9oJUdBCBfzdt7bAiugDT0Uomu4Yt9v7EsxVjILHPdNw01GGKr5MhEIETWUhL fHph6TVMmRTJ9+ZSB3EddrbxDISbdn8cQDg/0jorrytekNGzDluVqWx/zq1P6hKmZsBs 0IjbVo4vgf6aERaNH1FiRLv4ZwGSCDlEfWSyDbz5xwVNRpXEy0eH4WB/QyXnHigwV0Gx HepBRf0bPa2UilVatAPc2wnCnGlrN7+QNOCPiR1Ibi5S3D0xL0z+8LbWAFVAzN5Nwx6P jQEQ== X-Forwarded-Encrypted: i=1; AL+hErHGihkmAVOMPVAQpJVC948BCRJTLo+OpNFXmxvPdYvQ/p4wJwMttIStk4tvYz3iXCVztm1kejjkkd7OH6s=@vger.kernel.org X-Gm-Message-State: APuU4Z/cfFt+kxuFTUoCOjI71s+tqIBSSm2/Dg0XBeKcWUvOHpWb1ljF tlC0LL1lssCFCbvVRiBciioWETFEThaEqFj7VX6BAqVKZHxa6Ih7G3ia X-Gm-Gg: AYBFou3wy1NKKLQ/rWbdZkCNYCJK/MyqVo99xoYpZREOT71ucnWuCbnImn7gEr0aN2e t4wHMZtw8m4tRAYDceDTCKEnuNRMpVFcqt17AalhorP2agM4JMD35C4QfqNg44MmIF4vSdLfwbQ JEqobwgRyeq5nPOGj+4jSgNnJysVZAL8MJ5xSYTO8DLA0r+zsLwsscWEt2h7BK17PhkXzMtRC3o ZSr+EzR5q0GcX+UDJPWRyT3tB7iDXRfFE5e2Cc8FH+hv0M7nV2spdIHP/yIOpR3VIk71xOhXa4g 17PXo4oHS/qnpG77ltmXskEORMpix/BD5YAxFjwlkchTtSdH113UVaVi7om/gbHjWe1IV+PODYd hy7JCsvcEysq8WPhljW6VdlrCGf/chkQTxOpE3fjCIg+oTgvT4N96BSX2/biwKcOglAExVDGUXE HMkMjZ39Ew9yylaN7srP2a0fdwRPV6jrz6OShEEgV37pTSZxKI8kppAxBt1849AHiQFfnGMsAOP 4yXdih1ZPTdguyMti6UtUndV2pUNqboIHd5EhztRK10fKT8L5MzHIFcIBXU2oXjX3q4jEZAIsq/ qq5Moia1+2ZpPa3gS1EEvUk= X-Received: by 2002:a05:701b:4587:b0:1b2:6844:25c9 with SMTP id a92af1059eb24-1b5030613dbmr3036601c88.3.1794601338374; Fri, 13 Nov 2026 12:22:18 -0800 (PST) Received: from localhost ([2a03:2880:9ff:67::]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b50316e195sm11098622c88.8.2026.11.13.12.22.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 13 Nov 2026 12:22:18 -0800 (PST) Date: Fri, 13 Nov 2026 12:21:59 -0800 From: Stanislav Fomichev To: Breno Leitao Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Kuniyuki Iwashima , Willem de Bruijn , Neal Cardwell , Daniel Borkmann , John Fastabend , Stanislav Fomichev , Martin KaFai Lau , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Shuah Khan , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-team@meta.com Subject: Re: [PATCH net-next 2/3] tcp: convert do_tcp_getsockopt() to sockopt_t Message-ID: References: <20261112-getsockopt_phase7-v1-0-1eb759dd0929@debian.org> <20261112-getsockopt_phase7-v1-2-1eb759dd0929@debian.org> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20261112-getsockopt_phase7-v1-2-1eb759dd0929@debian.org> On 11/12, Breno Leitao wrote: > Convert the SOL_TCP switch to sockopt_t. The TCP-AO helpers already > take one, so they get it directly and the tcp_ao_get_sockptr() bridge > goes away. > > The options that re-read optlen to get past the sizeof(int) clamp at > the top take it from sopt->optlen instead, so optlen is read once. > > Only a user buffer reaches TCP_ZEROCOPY_RECEIVE: BPF's sol_tcp_sockopt() > does not take it, and it maps pages into the caller's mm anyway. It > keeps checking the bytes past its struct with check_zeroed_user(), now > on iter_in.ubuf, and a kernel buffer gets -EINVAL. > > tcp_getsockopt() builds the sockopt_t with sockopt_init_user() once the > level is known to be SOL_TCP, and writes optlen back unconditionally, > because TCP_SAVED_SYN reports the length it needs and then fails with > -EINVAL. This mirrors ip_getsockopt(). > > Every SOL_TCP getsockopt() now writes optlen, including the ones that > did not before, such as TCP_REPAIR_WINDOW, TCP_ZEROCOPY_RECEIVE and the > error returns. An unwritable optlen word therefore turns them into > -EFAULT. > > The others stored optlen before optval, so an unwritable optlen word > stopped optval from being written. Now optval is written first. > > sol_tcp_sockopt() and sol_tcp_sockopt_congestion() reach > do_tcp_getsockopt() through sol_tcp_getsockopt(), which builds the > sockopt_t with sockptr_to_sockopt() and stores optlen back, as > sol_ip_sockopt() does. > > copy_to_iter() runs the hardened usercopy check on its source, which > copy_to_sockptr() skips for a kernel buffer. BPF programs call > bpf_getsockopt() from the receive softirq too. On the vmapped IRQ > stack, the check then takes the lock in find_vmap_area(), which is not > softirq safe, and lockdep reports an inconsistent lock state. > > sol_tcp_getsockopt() therefore calls do_tcp_getsockopt() with page > faults disabled, which makes check_heap_object() skip that lookup. > Commit d319f344561d ("mm: Fix copy_from_user_nofault().") added that > guard for BPF and kprobes. > > Signed-off-by: Breno Leitao Acked-by: Stanislav Fomichev