From: Luxiao Xu bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket. When a BPF program passes a mini-socket (such as struct request_sock or struct inet_timewait_sock obtained via bpf_skc_lookup_tcp), sk_protocol is located beyond the memory boundary allocated for mini-sockets. Directly dereferencing sk->sk_protocol leads to a slab-out-of-bounds kernel read. Fix this issue by adding a sk_fullsock(sk) check at the start of both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie before inspecting fullsock-specific fields. Fixes: c0df236e1394 ("bpf: Change bpf_tcp_*_syncookie to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: Codex:gpt-5.4 Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei --- net/core/filter.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/core/filter.c b/net/core/filter.c index b446aa8be5c3..afdcfdf41489 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7678,6 +7678,9 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len if (unlikely(!sk || th_len < sizeof(*th))) return -EINVAL; + if (!sk_fullsock(sk)) + return -EINVAL; + /* sk_listener() allows TCP_NEW_SYN_RECV, which makes no sense here. */ if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN) return -EINVAL; @@ -7752,6 +7755,9 @@ BPF_CALL_5(bpf_tcp_gen_syncookie, struct sock *, sk, void *, iph, u32, iph_len, if (unlikely(!sk || th_len < sizeof(*th) || th_len != th->doff * 4)) return -EINVAL; + if (!sk_fullsock(sk)) + return -EINVAL; + if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN) return -EINVAL; -- 2.43.0