Re: [PATCH bpf 3/3] bpf: Unconditionally take socket references in lookup helpers

[Michal Luczaj <mhal@rbox.co>]

On 8/1/26 18:29, Kumar Kartikeya Dwivedi wrote:
> On Thu Jul 30, 2026 at 1:55 PM CEST, Michal Luczaj wrote:
>> On 7/29/26 22:32, Emil Tsalapatis wrote:
>>> On Thu Jul 23, 2026 at 7:33 AM EDT, Michal Luczaj wrote:
>>>> Lookup helpers gate whether to acquire a socket reference on
>>>> sk_is_refcounted(), a check re-evaluated at release. An established socket
>>>> refcounted at acquire time can gain SOCK_RCU_FREE via
>>>> connect(AF_UNSPEC)+listen() before release runs; the release-side re-check
>>>> then reads sk_is_refcounted() == false and skips the put. The reference
>>>> leaks.
>>>>
>>>> Make acquire and release unconditional and symmetric: always take a
>>>> reference, always put it. Adapt sk_select_reuseport().
>>>
>>> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
>>
>> Thanks!
>>
>>> The bot's concern about the comment style is obviously invalid here.
>>
>> Are the prompts incorrect?
>> https://github.com/masoncl/review-prompts/blob/59469708305eca305cbd9eb94e5aa0ee3627529c/kernel/subsystem/bpf.md#bpf-comment-style
>>
> 
> The prompt is correct, but we don't bother for existing comments, if you add a
> new one, you can use the new style.
> 
> Overall, looks like the set is pretty close. You can respin targeting bpf-next
> as John suggested (and we can wait for his ack before landing) so it can go
> through CI again.

Sure, here's v2 with patch 1 dropped (I'll repost it targeting bpf-next
later):
https://lore.kernel.org/bpf/20260803-sockmap-lookup-tcp-leak-2-0-306e025bfe66@rbox.co/

thanks,
Michal