Hi Jiayuan, +Cc Kalpan, Paolo.
On 17/09/2026 10:11, Jiayuan Chen wrote: > A bpf prog can do this today: > > subflow = bpf_skc_lookup_tcp(...); > msk = bpf_skc_to_mptcp_sock(subflow); > bpf_sk_release(msk); > > bpf_skc_to_mptcp_sock() returns subflow->conn without taking any > reference, so bpf_sk_release() drops a refcount nobody took on the msk, > and the subflow reference is leaked: Thank you for looking at this! Note that Kalpan was looking at this [1], and Paolo suggested removing the helper [2] (but we failed to review the last version so far, sorry about that...) I don't know if there are progs already using it. If yes, I guess your approach is better (but I'm not comfortable reviewing verifier's code). @Kalpan, WDYT? [1] https://lore.kernel.org/[email protected] [2] https://lore.kernel.org/[email protected] Cheers, Matt -- Sponsored by the NGI0 Core fund.
