[lkml]   [2018]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.18 064/197] tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach
4.18-stable review patch.  If anyone has any objections, please let me know.


From: Daniel Borkmann <>

[ Upstream commit 90545cdc3f2b2ea700e24335610cd181e73756da ]

I found that in BPF sockmap programs once we either delete a socket
from the map or we updated a map slot and the old socket was purged
from the map that these socket can never get reattached into a map
even though their related psock has been dropped entirely at that

Reason is that tcp_cleanup_ulp() leaves the old icsk->icsk_ulp_ops
intact, so that on the next tcp_set_ulp_id() the kernel returns an
-EEXIST thinking there is still some active ULP attached.

BPF sockmap is the only one that has this issue as the other user,
kTLS, only calls tcp_cleanup_ulp() from tcp_v4_destroy_sock() whereas
sockmap semantics allow dropping the socket from the map with all
related psock state being cleaned up.

Fixes: 1aa12bdf1bfb ("bpf: sockmap, add sock close() hook to remove socks")
Signed-off-by: Daniel Borkmann <>
Acked-by: John Fastabend <>
Acked-by: Song Liu <>
Signed-off-by: Alexei Starovoitov <>
Signed-off-by: Sasha Levin <>
Signed-off-by: Greg Kroah-Hartman <>
net/ipv4/tcp_ulp.c | 2 ++
1 file changed, 2 insertions(+)

--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -129,6 +129,8 @@ void tcp_cleanup_ulp(struct sock *sk)
if (icsk->icsk_ulp_ops->release)
+ icsk->icsk_ulp_ops = NULL;

/* Change upper layer protocol for socket */

 \ /
  Last update: 2018-09-13 15:55    [W:0.500 / U:0.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site