Re: [PATCH bpf-next v3 2/5] bpf: Add ksock kfuncs

On Thu, Aug 6, 2026 at 10:21 AM Mahe Tardy [off-list ref] wrote:

On Tue, Aug 04, 2026 at 09:55:44PM -0700, Song Liu wrote:

quoted

On Tue, Aug 4, 2026 at 9:47 AM Mahe Tardy [off-list ref] wrote:
[...]

quoted

+__bpf_kfunc int bpf_ksock_send(struct bpf_ksock *ks, const void *data,
+                              u32 data__sz)
+{
+       struct msghdr msg = {
+               .msg_flags = MSG_DONTWAIT,
+       };
+       struct kvec iov = {
+               .iov_base = (void *)data,
+               .iov_len = data__sz,
+       };
+       int ret;
+
+       if (!bpf_ksock_has_user_task_context())
+               return -EOPNOTSUPP;
+
+       /* Early check for UDP. Exact limits enforced by kernel_sendmsg(). */
+       if (data__sz > IP_MAX_MTU)
+               return -EMSGSIZE;
+
+       if (current->in_bpf_ksock_send)
+               return -EBUSY;

Returning EBUSY is not ideal. Can we avoid recursion by disallowing
calling bpf_ksock_send from certain hooks? You can find examples
check_kfunc_call() or check_special_kfunc(). This probably means
we need to grow special_kfunc_list, which is not ideal.

This is actually a really nice feedback. I didn't know we could add a
filter per attach BTF ID. This resolves the issue that the send kfunc
calls security_socket_sendmsg so we can remove all the recursion
protection and struggles, it's rejected at verifier time.

The filter now looks like this, I'd send this in the next version:

BTF_ID_LIST_SINGLE(bpf_lsm_socket_sendmsg_id, func, bpf_lsm_socket_sendmsg)

static int bpf_ksock_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)
{
        if (!btf_id_set8_contains(&ksock_kfunc_btf_ids, kfunc_id))
                return 0;

        if (prog->type == BPF_PROG_TYPE_SYSCALL)
                return 0;

        if (prog->type == BPF_PROG_TYPE_LSM &&
            prog->aux->attach_btf_id != bpf_lsm_socket_sendmsg_id[0])
                return 0;

        return -EACCES;
}

I don't think I need to touch anything else. I'll adjust the tests
according to this. Thanks Song.

Ah, right, filter is enough for this case.

Thanks for digging deep into this.
Song