From: Kuniyuki Iwashima Date: Thu, 9 Jul 2026 18:31:39 +0000 (+0000) Subject: soreuseport: Clear sk_reuseport_cb before failure in sk_clone(). X-Git-Tag: v7.2-rc5~27^2~92^2~1 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=98da8ce87dd561f08fbe44f75865edc5d9b2ba5f;p=thirdparty%2Flinux.git soreuseport: Clear sk_reuseport_cb before failure in sk_clone(). When sk_clone() fails, sk_destruct() is called for the new socket. If the parent socket has sk->sk_reuseport_cb, the child will call reuseport_detach_sock() for the reuseport group. Let's clear sk->sk_reuseport_cb before any failure path in sk_clone(). Note that this was not a problem before the cited commit because reuseport_detach_sock() did nothing if the socket was not found in the reuseport array. Fixes: 5dc4c4b7d4e8 ("bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260709032007.9E4D61F000E9@smtp.kernel.org/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Reviewed-by: Jason Xing Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260709183315.965751-2-kuniyu@google.com Signed-off-by: Jakub Kicinski --- diff --git a/net/core/sock.c b/net/core/sock.c index 8a59bfaa8096..fc3ff0552d68 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -2544,6 +2544,8 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority, cgroup_sk_clone(&newsk->sk_cgrp_data); + RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL); + rcu_read_lock(); filter = rcu_dereference(sk->sk_filter); if (filter != NULL) @@ -2566,8 +2568,6 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority, goto free; } - RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL); - if (bpf_sk_storage_clone(sk, newsk)) goto free;