* [PATCH RFC v2 1/4] selftests/bpf: Remove sockmap update from bpf_iter_unix
2026-11-02 1:15 [PATCH RFC v2 0/4] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
@ 2026-11-02 1:15 ` Michal Luczaj
2026-11-02 1:15 ` [PATCH RFC v2 2/4] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap Michal Luczaj
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Michal Luczaj @ 2026-11-02 1:15 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Lorenz Bauer,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
Jakub Sitnicki, Jiayuan Chen, David S. Miller, Jakub Kicinski,
Simon Horman
Cc: bpf, linux-kselftest, linux-kernel, Michal Luczaj, netdev
BPF iterator programs that can update sockmaps will be limited to
iter/sockmap. Remove the update from the unix selftest.
This reverts commit 997b8483d44c ("selftests/bpf: Extend bpf_iter_unix to
attempt deadlocking").
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
tools/testing/selftests/bpf/progs/bpf_iter_unix.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_unix.c b/tools/testing/selftests/bpf/progs/bpf_iter_unix.c
index 3061b148f338..90beada0386d 100644
--- a/tools/testing/selftests/bpf/progs/bpf_iter_unix.c
+++ b/tools/testing/selftests/bpf/progs/bpf_iter_unix.c
@@ -7,13 +7,6 @@
char _license[] SEC("license") = "GPL";
-SEC(".maps") struct {
- __uint(type, BPF_MAP_TYPE_SOCKMAP);
- __uint(max_entries, 1);
- __type(key, __u32);
- __type(value, __u64);
-} sockmap;
-
static long sock_i_ino(const struct sock *sk)
{
const struct socket *sk_socket = sk->sk_socket;
@@ -82,8 +75,5 @@ int dump_unix(struct bpf_iter__unix *ctx)
BPF_SEQ_PRINTF(seq, "\n");
- /* Test for deadlock. */
- bpf_map_update_elem(&sockmap, &(int){0}, sk, 0);
-
return 0;
}
--
2.56.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH RFC v2 2/4] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap
2026-11-02 1:15 [PATCH RFC v2 0/4] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
2026-11-02 1:15 ` [PATCH RFC v2 1/4] selftests/bpf: Remove sockmap update from bpf_iter_unix Michal Luczaj
@ 2026-11-02 1:15 ` Michal Luczaj
2026-11-02 1:54 ` bot+bpf-ci
2026-11-02 1:16 ` [PATCH RFC v2 3/4] selftests/bpf: Add negative test for sockmap update from non-sockmap iter Michal Luczaj
2026-11-02 1:16 ` [PATCH RFC v2 4/4] bpf: Mark bpf_iter__sockmap::sk as PTR_TRUSTED Michal Luczaj
3 siblings, 1 reply; 6+ messages in thread
From: Michal Luczaj @ 2026-11-02 1:15 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Lorenz Bauer,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
Jakub Sitnicki, Jiayuan Chen, David S. Miller, Jakub Kicinski,
Simon Horman
Cc: bpf, linux-kselftest, linux-kernel, Michal Luczaj, netdev, Sashiko
Among tracing progs, allow only iter/sockmap to update sockmaps and
sockhashes. Previously, any BPF_TRACE_ITER program could perform these
updates, which caused locking issues in specific scenarios [1][2][3]. This
tightening is part of the broader effort to lock down the BPF API [4].
[1]: commit 4d328dd69538 ("bpf, sockmap: Fix af_unix iter deadlock")
[2]: commit 64c2f93fc325 ("bpf, sockmap: Take state lock for af_unix iter")
[3]: https://msgid.link/87echn2fhd.fsf@cloudflare.com
[4]: https://msgid.link/akRZ_e7DJh2aP-2i@john-p8
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://msgid.link/20260626205814.BAC3C1F000E9@smtp.kernel.org
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
kernel/bpf/verifier.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1b6c0674ff6a..4dadfe9505a2 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10487,6 +10487,7 @@ static bool may_update_sockmap(struct bpf_verifier_env *env, int func_id)
{
enum bpf_attach_type eatype = env->prog->expected_attach_type;
enum bpf_prog_type type = resolve_prog_type(env->prog);
+ const char *afname = env->prog->aux->attach_func_name;
if (func_id != BPF_FUNC_map_update_elem &&
func_id != BPF_FUNC_map_delete_elem)
@@ -10497,7 +10498,8 @@ static bool may_update_sockmap(struct bpf_verifier_env *env, int func_id)
*/
switch (type) {
case BPF_PROG_TYPE_TRACING:
- if (eatype == BPF_TRACE_ITER)
+ if (eatype == BPF_TRACE_ITER &&
+ !strcmp(afname + strlen(BPF_ITER_FUNC_PREFIX), "sockmap"))
return true;
break;
case BPF_PROG_TYPE_SOCK_OPS:
--
2.56.0
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH RFC v2 2/4] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap
2026-11-02 1:15 ` [PATCH RFC v2 2/4] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap Michal Luczaj
@ 2026-11-02 1:54 ` bot+bpf-ci
0 siblings, 0 replies; 6+ messages in thread
From: bot+bpf-ci @ 2026-11-02 1:54 UTC (permalink / raw)
To: mhal, ast, daniel, andrii, eddyz87, memxor, martin.lau, song,
yonghong.song, jolsa, emil, ihor.solodrai, shuah, john.fastabend,
lmb, edumazet, kuniyu, pabeni, willemb, jakub, jiayuan.chen,
davem, kuba, horms
Cc: bpf, linux-kselftest, linux-kernel, mhal, netdev, sashiko-bot,
ast, andrii, daniel, martin.lau, eddyz87, yonghong.song, mason,
ihor.solodrai
[-- Attachment #1: Type: text/plain, Size: 2209 bytes --]
> bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap
TL;DR: Unresolved question: tracing_iter_filter() still allows
bpf_sock_destroy() from iter/sockmap, so tcp_abort() may run on a socket whose
lock isn't held. Should it be limited to iter/tcp and iter/udp?
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 1b6c0674ff6a..4dadfe9505a2 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
[ ... ]
> @@ -10497,7 +10498,8 @@ static bool may_update_sockmap(struct bpf_verifier_env *env, int func_id)
> */
> switch (type) {
> case BPF_PROG_TYPE_TRACING:
> - if (eatype == BPF_TRACE_ITER)
> + if (eatype == BPF_TRACE_ITER &&
> + !strcmp(afname + strlen(BPF_ITER_FUNC_PREFIX), "sockmap"))
> return true;
> break;
> case BPF_PROG_TYPE_SOCK_OPS:
Was the request to also restrict tracing_iter_filter() to iter/tcp and
iter/udp ever resolved?
In the v1 thread Alexei Starovoitov wrote:
Pls send the PTR_TRUSTED part in v2. I'd also limit tracing_iter_filter()
to iter/tcp and iter/udp.
The reply to that was that once bpf_iter__sockmap::sk is PTR_TRUSTED,
iter/sockmap could call bpf_sock_destroy() on an unlocked sk. The v2 series
adds the PTR_TRUSTED marking but does not touch tracing_iter_filter(), and I
could not find a follow-up on the v2 thread:
net/core/filter.c:tracing_iter_filter() {
if (btf_id_set8_contains(&bpf_sk_iter_kfunc_ids, kfunc_id) &&
prog->expected_attach_type != BPF_TRACE_ITER)
return -EACCES;
...
}
This still allows bpf_sock_destroy() from any BPF_TRACE_ITER program,
including iter/sockmap.
sock_map_seq_show() holds only the RCU read lock, and tcp_abort() skips
lock_sock() when called from a BPF context. Can an iter/sockmap program
now reach tcp_abort() through bpf_sock_destroy() on a socket whose lock is
not held?
If so, should tracing_iter_filter() be limited to iter/tcp and iter/udp as
requested, or is there a reason it can stay as it is?
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/41373332573
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH RFC v2 3/4] selftests/bpf: Add negative test for sockmap update from non-sockmap iter
2026-11-02 1:15 [PATCH RFC v2 0/4] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
2026-11-02 1:15 ` [PATCH RFC v2 1/4] selftests/bpf: Remove sockmap update from bpf_iter_unix Michal Luczaj
2026-11-02 1:15 ` [PATCH RFC v2 2/4] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap Michal Luczaj
@ 2026-11-02 1:16 ` Michal Luczaj
2026-11-02 1:16 ` [PATCH RFC v2 4/4] bpf: Mark bpf_iter__sockmap::sk as PTR_TRUSTED Michal Luczaj
3 siblings, 0 replies; 6+ messages in thread
From: Michal Luczaj @ 2026-11-02 1:16 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Lorenz Bauer,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
Jakub Sitnicki, Jiayuan Chen, David S. Miller, Jakub Kicinski,
Simon Horman
Cc: bpf, linux-kselftest, linux-kernel, Michal Luczaj, netdev
Iterator-context sockmap updates are now restricted to iter/sockmap. Add a
test that attempts an update from iter/unix and expects it to fail.
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
.../testing/selftests/bpf/progs/verifier_sockmap_mutate.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_sockmap_mutate.c b/tools/testing/selftests/bpf/progs/verifier_sockmap_mutate.c
index 20332a731d4e..1516fe1524bb 100644
--- a/tools/testing/selftests/bpf/progs/verifier_sockmap_mutate.c
+++ b/tools/testing/selftests/bpf/progs/verifier_sockmap_mutate.c
@@ -19,6 +19,12 @@ struct bpf_iter__sockmap {
};
} __attribute__((preserve_access_index));
+struct bpf_iter__unix {
+ union {
+ struct sock *unix_sk;
+ };
+} __attribute__((preserve_access_index));
+
struct {
__uint(type, BPF_MAP_TYPE_SOCKHASH);
__uint(max_entries, 1);
@@ -113,6 +119,14 @@ int test_trace_iter(struct bpf_iter__sockmap *ctx)
return 0;
}
+SEC("iter/unix")
+__failure __msg("cannot update sockmap in this context")
+int test_trace_iter_unix(struct bpf_iter__unix *ctx)
+{
+ test_sockmap_mutate(ctx->unix_sk);
+ return 0;
+}
+
SEC("raw_tp/kfree")
__failure __msg("cannot update sockmap in this context")
int test_raw_tp_delete(const void *ctx __always_unused)
--
2.56.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH RFC v2 4/4] bpf: Mark bpf_iter__sockmap::sk as PTR_TRUSTED
2026-11-02 1:15 [PATCH RFC v2 0/4] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
` (2 preceding siblings ...)
2026-11-02 1:16 ` [PATCH RFC v2 3/4] selftests/bpf: Add negative test for sockmap update from non-sockmap iter Michal Luczaj
@ 2026-11-02 1:16 ` Michal Luczaj
3 siblings, 0 replies; 6+ messages in thread
From: Michal Luczaj @ 2026-11-02 1:16 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Lorenz Bauer,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
Jakub Sitnicki, Jiayuan Chen, David S. Miller, Jakub Kicinski,
Simon Horman
Cc: bpf, linux-kselftest, linux-kernel, Michal Luczaj, netdev
In preparation for plain-PTR_TO_BTF_ID removal: allow calling bpf helpers
with sk provided by iter/sockmap.
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Link: https://msgid.link/DM92JCFA4X4U.30MTDH0KCPTJ@gmail.com
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
net/core/sock_map.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index 057e2f3c0265..2a2a07372818 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -1989,7 +1989,7 @@ static struct bpf_iter_reg sock_map_iter_reg = {
{ offsetof(struct bpf_iter__sockmap, key),
PTR_TO_BUF | PTR_MAYBE_NULL | MEM_RDONLY },
{ offsetof(struct bpf_iter__sockmap, sk),
- PTR_TO_BTF_ID_OR_NULL },
+ PTR_TO_BTF_ID_OR_NULL | PTR_TRUSTED },
},
};
--
2.56.0
^ permalink raw reply [flat|nested] 6+ messages in thread