Commit decb84b8 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Martin KaFai Lau
Browse files

bpf: tcp: Fix type confusion in bpf_skc_to_tcp_sock(). 



bpf_skc_to_tcp_sock() only checks if sk->sk_protocol is
IPPROTO_TCP, but RAW socket can bypass it:

  socket(AF_INET, SOCK_RAW, IPPROTO_TCP)

Let's use sk_is_tcp().

Fixes: 478cfbdf ("bpf: Add bpf_skc_to_{tcp, tcp_timewait, tcp_request}_sock() helpers")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20260504210610.180150-5-kuniyu@google.com
parent 7995b216

net/core/filter.c

+1 −1
Original line number Diff line number Diff line
@@ -11963,7 +11963,7 @@ const struct bpf_func_proto bpf_skc_to_tcp6_sock_proto = { 


BPF_CALL_1(bpf_skc_to_tcp_sock, struct sock *, sk)

{

	if (sk && sk_fullsock(sk) && sk->sk_protocol == IPPROTO_TCP)

	if (sk && sk_fullsock(sk) && sk_is_tcp(sk))

		return (unsigned long)sk;



	return (unsigned long)NULL;