* [PATCH bpf-next v3 1/8] selftests/bpf: Remove sockmap update from bpf_iter_unix
2026-11-07 17:58 [PATCH bpf-next v3 0/8] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
@ 2026-11-07 17:58 ` Michal Luczaj
2026-11-09 2:14 ` Jiayuan Chen
2026-11-07 17:58 ` [PATCH bpf-next v3 2/8] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap Michal Luczaj
` (6 subsequent siblings)
7 siblings, 1 reply; 11+ messages in thread
From: Michal Luczaj @ 2026-11-07 17:58 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, Jakub Sitnicki,
Jiayuan Chen, David S. Miller, Jakub Kicinski, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap, Stanislav Fomichev
Cc: Michal Luczaj, bpf, linux-kselftest, linux-kernel, netdev, linux-doc
BPF iterator programs that can update sockmaps will be limited to
iter/sockmap. Remove the update from the unix selftest.
This reverts commit 997b8483d44c ("selftests/bpf: Extend bpf_iter_unix to
attempt deadlocking").
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
tools/testing/selftests/bpf/progs/bpf_iter_unix.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_unix.c b/tools/testing/selftests/bpf/progs/bpf_iter_unix.c
index 3061b148f338..90beada0386d 100644
--- a/tools/testing/selftests/bpf/progs/bpf_iter_unix.c
+++ b/tools/testing/selftests/bpf/progs/bpf_iter_unix.c
@@ -7,13 +7,6 @@
char _license[] SEC("license") = "GPL";
-SEC(".maps") struct {
- __uint(type, BPF_MAP_TYPE_SOCKMAP);
- __uint(max_entries, 1);
- __type(key, __u32);
- __type(value, __u64);
-} sockmap;
-
static long sock_i_ino(const struct sock *sk)
{
const struct socket *sk_socket = sk->sk_socket;
@@ -82,8 +75,5 @@ int dump_unix(struct bpf_iter__unix *ctx)
BPF_SEQ_PRINTF(seq, "\n");
- /* Test for deadlock. */
- bpf_map_update_elem(&sockmap, &(int){0}, sk, 0);
-
return 0;
}
--
2.56.0
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH bpf-next v3 1/8] selftests/bpf: Remove sockmap update from bpf_iter_unix
2026-11-07 17:58 ` [PATCH bpf-next v3 1/8] selftests/bpf: Remove sockmap update from bpf_iter_unix Michal Luczaj
@ 2026-11-09 2:14 ` Jiayuan Chen
0 siblings, 0 replies; 11+ messages in thread
From: Jiayuan Chen @ 2026-11-09 2:14 UTC (permalink / raw)
To: Michal Luczaj, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi,
Martin KaFai Lau, Song Liu, Yonghong Song, Jiri Olsa,
Emil Tsalapatis, Ihor Solodrai, Shuah Khan, John Fastabend,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
Jakub Sitnicki, Jiayuan Chen, David S. Miller, Jakub Kicinski,
Simon Horman, Jonathan Corbet, Shuah Khan, Randy Dunlap,
Stanislav Fomichev
Cc: bpf, linux-kselftest, linux-kernel, netdev, linux-doc
On 11/8/26 1:58 AM, Michal Luczaj wrote:
> BPF iterator programs that can update sockmaps will be limited to
> iter/sockmap. Remove the update from the unix selftest.
>
> This reverts commit 997b8483d44c ("selftests/bpf: Extend bpf_iter_unix to
> attempt deadlocking").
>
> Signed-off-by: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
> tools/testing/selftests/bpf/progs/bpf_iter_unix.c | 10 ----------
> 1 file changed, 10 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_unix.c b/tools/testing/selftests/bpf/progs/bpf_iter_unix.c
> index 3061b148f338..90beada0386d 100644
> --- a/tools/testing/selftests/bpf/progs/bpf_iter_unix.c
> +++ b/tools/testing/selftests/bpf/progs/bpf_iter_unix.c
> @@ -7,13 +7,6 @@
>
> char _license[] SEC("license") = "GPL";
>
> -SEC(".maps") struct {
> - __uint(type, BPF_MAP_TYPE_SOCKMAP);
> - __uint(max_entries, 1);
> - __type(key, __u32);
> - __type(value, __u64);
> -} sockmap;
> -
> static long sock_i_ino(const struct sock *sk)
> {
> const struct socket *sk_socket = sk->sk_socket;
> @@ -82,8 +75,5 @@ int dump_unix(struct bpf_iter__unix *ctx)
>
> BPF_SEQ_PRINTF(seq, "\n");
>
> - /* Test for deadlock. */
> - bpf_map_update_elem(&sockmap, &(int){0}, sk, 0);
> -
> return 0;
> }
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH bpf-next v3 2/8] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap
2026-11-07 17:58 [PATCH bpf-next v3 0/8] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
2026-11-07 17:58 ` [PATCH bpf-next v3 1/8] selftests/bpf: Remove sockmap update from bpf_iter_unix Michal Luczaj
@ 2026-11-07 17:58 ` Michal Luczaj
2026-11-09 2:15 ` Jiayuan Chen
2026-11-07 17:58 ` [PATCH bpf-next v3 3/8] selftests/bpf: Add negative test for sockmap update from non-sockmap iter Michal Luczaj
` (5 subsequent siblings)
7 siblings, 1 reply; 11+ messages in thread
From: Michal Luczaj @ 2026-11-07 17:58 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, Jakub Sitnicki,
Jiayuan Chen, David S. Miller, Jakub Kicinski, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap, Stanislav Fomichev
Cc: Michal Luczaj, bpf, linux-kselftest, linux-kernel, netdev,
linux-doc, Sashiko
Among tracing progs, allow only iter/sockmap to update sockmaps and
sockhashes. Previously, any BPF_TRACE_ITER program could perform these
updates, which caused locking issues in specific scenarios [1][2][3]. This
tightening is part of the broader effort to lock down the BPF API [4].
[1]: commit 4d328dd69538 ("bpf, sockmap: Fix af_unix iter deadlock")
[2]: commit 64c2f93fc325 ("bpf, sockmap: Take state lock for af_unix iter")
[3]: https://msgid.link/87echn2fhd.fsf@cloudflare.com
[4]: https://msgid.link/akRZ_e7DJh2aP-2i@john-p8
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://msgid.link/20260626205814.BAC3C1F000E9@smtp.kernel.org
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
I was tempted to define BTF_ID_LIST_SINGLE(bpf_iter_sockmap_id, func,
bpf_iter_sockmap) and just compare against env->prog->aux->attach_btf_id,
but a single line BTF_ID_LIST_SINGLE quickly turned into a 6-line
ifdef-CONFIG_NET-fery, so I've sticked with strcmp().
---
kernel/bpf/verifier.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 09a44723bb2e..e784e4a1e5f2 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10543,6 +10543,7 @@ static bool may_update_sockmap(struct bpf_verifier_env *env, int func_id)
{
enum bpf_attach_type eatype = env->prog->expected_attach_type;
enum bpf_prog_type type = resolve_prog_type(env->prog);
+ const char *afname = env->prog->aux->attach_func_name;
if (func_id != BPF_FUNC_map_update_elem &&
func_id != BPF_FUNC_map_delete_elem)
@@ -10553,7 +10554,8 @@ static bool may_update_sockmap(struct bpf_verifier_env *env, int func_id)
*/
switch (type) {
case BPF_PROG_TYPE_TRACING:
- if (eatype == BPF_TRACE_ITER)
+ if (eatype == BPF_TRACE_ITER &&
+ !strcmp(afname + strlen(BPF_ITER_FUNC_PREFIX), "sockmap"))
return true;
break;
case BPF_PROG_TYPE_SOCK_OPS:
--
2.56.0
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH bpf-next v3 2/8] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap
2026-11-07 17:58 ` [PATCH bpf-next v3 2/8] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap Michal Luczaj
@ 2026-11-09 2:15 ` Jiayuan Chen
0 siblings, 0 replies; 11+ messages in thread
From: Jiayuan Chen @ 2026-11-09 2:15 UTC (permalink / raw)
To: Michal Luczaj, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi,
Martin KaFai Lau, Song Liu, Yonghong Song, Jiri Olsa,
Emil Tsalapatis, Ihor Solodrai, Shuah Khan, John Fastabend,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
Jakub Sitnicki, Jiayuan Chen, David S. Miller, Jakub Kicinski,
Simon Horman, Jonathan Corbet, Shuah Khan, Randy Dunlap,
Stanislav Fomichev
Cc: bpf, linux-kselftest, linux-kernel, netdev, linux-doc, Sashiko
On 11/8/26 1:58 AM, Michal Luczaj wrote:
> Among tracing progs, allow only iter/sockmap to update sockmaps and
> sockhashes. Previously, any BPF_TRACE_ITER program could perform these
> updates, which caused locking issues in specific scenarios [1][2][3]. This
> tightening is part of the broader effort to lock down the BPF API [4].
>
> [1]: commit 4d328dd69538 ("bpf, sockmap: Fix af_unix iter deadlock")
> [2]: commit 64c2f93fc325 ("bpf, sockmap: Take state lock for af_unix iter")
> [3]: https://msgid.link/87echn2fhd.fsf@cloudflare.com
> [4]: https://msgid.link/akRZ_e7DJh2aP-2i@john-p8
>
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://msgid.link/20260626205814.BAC3C1F000E9@smtp.kernel.org
> Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
> Signed-off-by: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH bpf-next v3 3/8] selftests/bpf: Add negative test for sockmap update from non-sockmap iter
2026-11-07 17:58 [PATCH bpf-next v3 0/8] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
2026-11-07 17:58 ` [PATCH bpf-next v3 1/8] selftests/bpf: Remove sockmap update from bpf_iter_unix Michal Luczaj
2026-11-07 17:58 ` [PATCH bpf-next v3 2/8] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap Michal Luczaj
@ 2026-11-07 17:58 ` Michal Luczaj
2026-11-07 17:58 ` [PATCH bpf-next v3 4/8] bpf, docs: Document BPF_ITER_NOSLEEP Michal Luczaj
` (4 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Michal Luczaj @ 2026-11-07 17:58 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, Jakub Sitnicki,
Jiayuan Chen, David S. Miller, Jakub Kicinski, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap, Stanislav Fomichev
Cc: Michal Luczaj, bpf, linux-kselftest, linux-kernel, netdev, linux-doc
Iterator-context sockmap updates are now restricted to iter/sockmap. Add a
test that attempts an update from iter/unix and expects it to fail.
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
.../testing/selftests/bpf/progs/verifier_sockmap_mutate.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_sockmap_mutate.c b/tools/testing/selftests/bpf/progs/verifier_sockmap_mutate.c
index 20332a731d4e..1516fe1524bb 100644
--- a/tools/testing/selftests/bpf/progs/verifier_sockmap_mutate.c
+++ b/tools/testing/selftests/bpf/progs/verifier_sockmap_mutate.c
@@ -19,6 +19,12 @@ struct bpf_iter__sockmap {
};
} __attribute__((preserve_access_index));
+struct bpf_iter__unix {
+ union {
+ struct sock *unix_sk;
+ };
+} __attribute__((preserve_access_index));
+
struct {
__uint(type, BPF_MAP_TYPE_SOCKHASH);
__uint(max_entries, 1);
@@ -113,6 +119,14 @@ int test_trace_iter(struct bpf_iter__sockmap *ctx)
return 0;
}
+SEC("iter/unix")
+__failure __msg("cannot update sockmap in this context")
+int test_trace_iter_unix(struct bpf_iter__unix *ctx)
+{
+ test_sockmap_mutate(ctx->unix_sk);
+ return 0;
+}
+
SEC("raw_tp/kfree")
__failure __msg("cannot update sockmap in this context")
int test_raw_tp_delete(const void *ctx __always_unused)
--
2.56.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH bpf-next v3 4/8] bpf, docs: Document BPF_ITER_NOSLEEP
2026-11-07 17:58 [PATCH bpf-next v3 0/8] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
` (2 preceding siblings ...)
2026-11-07 17:58 ` [PATCH bpf-next v3 3/8] selftests/bpf: Add negative test for sockmap update from non-sockmap iter Michal Luczaj
@ 2026-11-07 17:58 ` Michal Luczaj
2026-11-07 17:58 ` [PATCH bpf-next v3 5/8] bpf: Restrict bpf_sock_destroy() to iter/{tcp,udp} Michal Luczaj
` (3 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Michal Luczaj @ 2026-11-07 17:58 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, Jakub Sitnicki,
Jiayuan Chen, David S. Miller, Jakub Kicinski, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap, Stanislav Fomichev
Cc: Michal Luczaj, bpf, linux-kselftest, linux-kernel, netdev, linux-doc
Commit dfcd17659112 ("bpf: Reject sleepable programs for task_vma
iterator") introduced BPF_ITER_NOSLEEP, but did not update the docs.
Mention the flag in bpf_iterators.rst.
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
Documentation/bpf/bpf_iterators.rst | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/Documentation/bpf/bpf_iterators.rst b/Documentation/bpf/bpf_iterators.rst
index 72435e32ffa1..c534215f05de 100644
--- a/Documentation/bpf/bpf_iterators.rst
+++ b/Documentation/bpf/bpf_iterators.rst
@@ -351,9 +351,15 @@ The following is the breakdown for each field in struct ``bpf_iter_reg``.
the bpf iterator.
* - feature
- Specifies certain action requests in the kernel BPF iterator
- infrastructure. Currently, only BPF_ITER_RESCHED is supported. This means
- that the kernel function cond_resched() is called to avoid other kernel
- subsystem (e.g., rcu) misbehaving.
+ infrastructure.
+
+ BPF_ITER_RESCHED
+ the kernel function cond_resched() is called to avoid other kernel
+ subsystem (e.g., rcu) misbehaving
+
+ BPF_ITER_NOSLEEP
+ ``seq_operations::show()`` cannot run sleepable programs
+
* - seq_info
- Specifies the set of seq operations for the BPF iterator and helpers to
initialize/free the private data for the corresponding ``seq_file``.
--
2.56.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH bpf-next v3 5/8] bpf: Restrict bpf_sock_destroy() to iter/{tcp,udp}
2026-11-07 17:58 [PATCH bpf-next v3 0/8] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
` (3 preceding siblings ...)
2026-11-07 17:58 ` [PATCH bpf-next v3 4/8] bpf, docs: Document BPF_ITER_NOSLEEP Michal Luczaj
@ 2026-11-07 17:58 ` Michal Luczaj
2026-11-07 17:58 ` [PATCH bpf-next v3 6/8] bpf: Mark bpf_iter__sockmap::sk as PTR_TRUSTED Michal Luczaj
` (2 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Michal Luczaj @ 2026-11-07 17:58 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, Jakub Sitnicki,
Jiayuan Chen, David S. Miller, Jakub Kicinski, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap, Stanislav Fomichev
Cc: Michal Luczaj, bpf, linux-kselftest, linux-kernel, netdev, linux-doc
A subsequent patch will mark bpf_iter__sockmap::sk as PTR_TRUSTED, making
bpf_sock_destroy() callable from the iter/sockmap. Unlike iter/{tcp,udp},
the sockmap iterator does not run progs with the socket lock held, so
destroying a socket from that context is unsafe. Restrict the allowed
callers of bpf_sock_destroy() to iter/{tcp,udp}.
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
net/core/filter.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 9245009d9f1e..6a67bc2a0c4b 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -13072,11 +13072,20 @@ BTF_KFUNCS_START(bpf_sk_iter_kfunc_ids)
BTF_ID_FLAGS(func, bpf_sock_destroy)
BTF_KFUNCS_END(bpf_sk_iter_kfunc_ids)
+BTF_SET_START(bpf_sk_iter_locked_ids)
+#if defined(CONFIG_INET) && defined(CONFIG_PROC_FS)
+BTF_ID(func, bpf_iter_tcp)
+BTF_ID(func, bpf_iter_udp)
+#endif
+BTF_SET_END(bpf_sk_iter_locked_ids)
+
static int tracing_iter_filter(const struct bpf_prog *prog, u32 kfunc_id)
{
if (btf_id_set8_contains(&bpf_sk_iter_kfunc_ids, kfunc_id) &&
- prog->expected_attach_type != BPF_TRACE_ITER)
+ (prog->expected_attach_type != BPF_TRACE_ITER ||
+ !btf_id_set_contains(&bpf_sk_iter_locked_ids, prog->aux->attach_btf_id)))
return -EACCES;
+
return 0;
}
--
2.56.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH bpf-next v3 6/8] bpf: Mark bpf_iter__sockmap::sk as PTR_TRUSTED
2026-11-07 17:58 [PATCH bpf-next v3 0/8] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
` (4 preceding siblings ...)
2026-11-07 17:58 ` [PATCH bpf-next v3 5/8] bpf: Restrict bpf_sock_destroy() to iter/{tcp,udp} Michal Luczaj
@ 2026-11-07 17:58 ` Michal Luczaj
2026-11-07 17:58 ` [PATCH bpf-next v3 7/8] selftests/bpf: Add iter/sockmap bpf_sock_destroy() negative test Michal Luczaj
2026-11-07 17:58 ` [PATCH bpf-next v3 8/8] bpf: Fix "unresolved symbol tcp_request_sock" build error Michal Luczaj
7 siblings, 0 replies; 11+ messages in thread
From: Michal Luczaj @ 2026-11-07 17:58 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, Jakub Sitnicki,
Jiayuan Chen, David S. Miller, Jakub Kicinski, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap, Stanislav Fomichev
Cc: Michal Luczaj, bpf, linux-kselftest, linux-kernel, netdev, linux-doc
In preparation for plain-PTR_TO_BTF_ID removal: allow calling bpf helpers
with sk provided by iter/sockmap.
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Link: https://msgid.link/DM92JCFA4X4U.30MTDH0KCPTJ@gmail.com
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
net/core/sock_map.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index efe49551caba..1a8478b03c24 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -1993,7 +1993,7 @@ static struct bpf_iter_reg sock_map_iter_reg = {
{ offsetof(struct bpf_iter__sockmap, key),
PTR_TO_BUF | PTR_MAYBE_NULL | MEM_RDONLY },
{ offsetof(struct bpf_iter__sockmap, sk),
- PTR_TO_BTF_ID_OR_NULL },
+ PTR_TO_BTF_ID_OR_NULL | PTR_TRUSTED },
},
};
--
2.56.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH bpf-next v3 7/8] selftests/bpf: Add iter/sockmap bpf_sock_destroy() negative test
2026-11-07 17:58 [PATCH bpf-next v3 0/8] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
` (5 preceding siblings ...)
2026-11-07 17:58 ` [PATCH bpf-next v3 6/8] bpf: Mark bpf_iter__sockmap::sk as PTR_TRUSTED Michal Luczaj
@ 2026-11-07 17:58 ` Michal Luczaj
2026-11-07 17:58 ` [PATCH bpf-next v3 8/8] bpf: Fix "unresolved symbol tcp_request_sock" build error Michal Luczaj
7 siblings, 0 replies; 11+ messages in thread
From: Michal Luczaj @ 2026-11-07 17:58 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, Jakub Sitnicki,
Jiayuan Chen, David S. Miller, Jakub Kicinski, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap, Stanislav Fomichev
Cc: Michal Luczaj, bpf, linux-kselftest, linux-kernel, netdev, linux-doc
bpf_sock_destroy() is restricted to socket-locked iters, TCP and UDP.
Fail attempting it from iter/sockmap.
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
tools/testing/selftests/bpf/progs/sock_destroy_prog_fail.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/sock_destroy_prog_fail.c b/tools/testing/selftests/bpf/progs/sock_destroy_prog_fail.c
index dd6850b58e25..7b9f5779a184 100644
--- a/tools/testing/selftests/bpf/progs/sock_destroy_prog_fail.c
+++ b/tools/testing/selftests/bpf/progs/sock_destroy_prog_fail.c
@@ -20,3 +20,14 @@ int BPF_PROG(trace_tcp_destroy_sock, struct sock *sk)
return 0;
}
+SEC("iter/sockmap")
+__failure __msg("calling kernel function bpf_sock_destroy is not allowed")
+int iter_sockmap_destroy(struct bpf_iter__sockmap *ctx)
+{
+ struct sock *sk = ctx->sk;
+
+ if (sk)
+ bpf_sock_destroy((struct sock_common *)sk);
+
+ return 0;
+}
--
2.56.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH bpf-next v3 8/8] bpf: Fix "unresolved symbol tcp_request_sock" build error
2026-11-07 17:58 [PATCH bpf-next v3 0/8] bpf, sockmap: Restrict iter-context sockmap updates to sockmap iterators Michal Luczaj
` (6 preceding siblings ...)
2026-11-07 17:58 ` [PATCH bpf-next v3 7/8] selftests/bpf: Add iter/sockmap bpf_sock_destroy() negative test Michal Luczaj
@ 2026-11-07 17:58 ` Michal Luczaj
7 siblings, 0 replies; 11+ messages in thread
From: Michal Luczaj @ 2026-11-07 17:58 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
Ihor Solodrai, Shuah Khan, John Fastabend, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, Jakub Sitnicki,
Jiayuan Chen, David S. Miller, Jakub Kicinski, Simon Horman,
Jonathan Corbet, Shuah Khan, Randy Dunlap, Stanislav Fomichev
Cc: Michal Luczaj, bpf, linux-kselftest, linux-kernel, netdev, linux-doc
CONFIG_WERROR=y CONFIG_NET=y CONFIG_INET=n build fails:
WARN: resolve_btfids: unresolved symbol tcp_request_sock
Failed to generate BTF for vmlinux
Try to disable CONFIG_DEBUG_INFO_BTF
make[2]: *** [scripts/Makefile.vmlinux:72: vmlinux.unstripped] Error 1
make[1]: *** [.../Makefile:1379: vmlinux] Error 2
make: *** [Makefile:248: __sub-make] Error 2
Handle it in the style of commit d82a532a6115 ("bpf: Fix "unresolved
symbol" build error with resolve_btfids"): force BTF generation.
Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
Technically, since tcp_request_sock embedds inet_request_sock there's no
need to explicitly emit for inet_.
---
net/core/filter.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index 6a67bc2a0c4b..b86529dead65 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -12391,6 +12391,10 @@ const struct bpf_func_proto bpf_skc_to_tcp_timewait_sock_proto = {
BPF_CALL_1(bpf_skc_to_tcp_request_sock, struct sock *, sk)
{
+ /* Ensure BTF for the structs exists even with CONFIG_INET=n. */
+ BTF_TYPE_EMIT(struct inet_request_sock);
+ BTF_TYPE_EMIT(struct tcp_request_sock);
+
#ifdef CONFIG_INET
if (sk && sk->sk_prot == &tcp_prot && sk->sk_state == TCP_NEW_SYN_RECV)
return (unsigned long)sk;
--
2.56.0
^ permalink raw reply [flat|nested] 11+ messages in thread