[PATCH bpf v3 1/2] bpf: reject incompatible socket assignments
COOLING5d
From: Shihuang Liu <hidden>
Date: 2026-09-30 16:40:31
Also in:
bpf, lkml
Subsystem:
bpf [general] (safe dynamic programs and tools), bpf [networking] (tcx & tc bpf, sock_addr), networking [general], the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
bpf_sk_assign() permits TC ingress programs to associate an IPv6 packet
with an AF_INET socket. The receive path can then interpret IPv6 skb
control data as IPv4 metadata. When IP_RETOPTS is enabled, this can cause
__ip_options_echo() to copy beyond its stack buffer.
Reject incompatible packet and socket families before attaching the socket,
while preserving IPv4 assignments to dual-stack AF_INET6 sockets. Validate
request, mapped, and time-wait sockets using their effective family.
Use the packet's effective protocol for VLAN checks and share the same
predicate across bpf_sk_assign() and bpf_sk_assign_tcp_reqsk().
Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Assisted-by: LLM
Signed-off-by: Shihuang Liu <redacted>
---
Changes since v2:
- Use the effective packet protocol for VLAN-aware family validation.
- Handle IPv4-mapped AF_INET6 sockets, TCP children, and TIME_WAIT sockets.
- Share the protocol-based check with bpf_sk_assign_tcp_reqsk().
v2:
https://lore.kernel.org/netdev/20260911172313.64009-1-shlomojune6@gmail.com/ (local)
Changes since v1:
- Move family validation out of the IPv6 receive fast path and into
bpf_sk_assign() and bpf_sk_assign_tcp_reqsk().
- Preserve IPv4 assignments to dual-stack AF_INET6 sockets.
- Check request sockets using rsk_ops->family.
- Split the fix into two patches and target the BPF fixes tree.
v1:
https://lore.kernel.org/netdev/20260823101809.26802-1-shlomojune6@gmail.com/ (local)
---
include/uapi/linux/bpf.h | 4 +++
net/core/filter.c | 63 ++++++++++++++++++++++++++++++++++
tools/include/uapi/linux/bpf.h | 4 +++
3 files changed, 71 insertions(+)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 732b35cc08d1c..5d8f5e2c8db38 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h@@ -4568,6 +4568,10 @@ union bpf_attr { * **-EOPNOTSUPP** if the operation is not supported, for example * a call from outside of TC ingress. * + * **-EAFNOSUPPORT** if the socket family is not compatible with + * the network layer of the packet, for example an **AF_INET** + * socket and an IPv6 packet. + * * long bpf_sk_assign(struct bpf_sk_lookup *ctx, struct bpf_sock *sk, u64 flags) * Description * Helper is overloaded depending on BPF program type. This
diff --git a/net/core/filter.c b/net/core/filter.c
index 61940e7535523..5f64065523584 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c@@ -3491,6 +3491,64 @@ static int bpf_skb_proto_xlat(struct sk_buff *skb, __be16 to_proto) return -ENOTSUPP; } +static bool bpf_sk_assign_family_ok_proto(const struct sock *sk, __be16 proto) +{ + const struct inet_connection_sock_af_ops *af_ops; + unsigned short family; + + switch (proto) { + case htons(ETH_P_IP): + family = AF_INET; + break; + case htons(ETH_P_IPV6): + family = AF_INET6; + break; + default: + return true; + } + + /* Requests inherit the listener family, but have family-specific ops. */ + if (sk->sk_state == TCP_NEW_SYN_RECV) + return inet_reqsk(sk)->rsk_ops->family == family; + + /* A dual-stack listener accepts both packet families. */ + if (sk->sk_state == TCP_LISTEN && sk->sk_family == AF_INET6) + return family == AF_INET6 || !ipv6_only_sock(sk); + +#if IS_ENABLED(CONFIG_IPV6) + /* IPv4-mapped and pure IPv6 time-wait sockets retain AF_INET6. */ + if (sk->sk_state == TCP_TIME_WAIT && sk->sk_family == AF_INET6) { + const struct inet_timewait_sock *tw = inet_twsk(sk); + bool mapped; + + mapped = ipv6_addr_v4mapped(&tw->tw_v6_daddr) && + ipv6_addr_v4mapped(&tw->tw_v6_rcv_saddr); + return family == (mapped ? AF_INET : AF_INET6); + } +#endif + + /* IPv4-mapped and pure IPv6 TCP children keep AF_INET6 in sk_family. */ + if (sk_fullsock(sk) && sk->sk_family == AF_INET6 && sk_is_tcp(sk)) { + af_ops = READ_ONCE(inet_csk(sk)->icsk_af_ops); + if ((family == AF_INET6 && + af_ops->net_header_len == sizeof(struct iphdr)) || + (family == AF_INET && + af_ops->net_header_len == sizeof(struct ipv6hdr))) + return false; + } + + return sk->sk_family == family || + (family == AF_INET && + sk->sk_family == AF_INET6 && + !ipv6_only_sock(sk)); +} + +static bool bpf_sk_assign_family_ok(const struct sk_buff *skb, + const struct sock *sk) +{ + return bpf_sk_assign_family_ok_proto(sk, skb_protocol(skb, true)); +} + BPF_CALL_3(bpf_skb_change_proto, struct sk_buff *, skb, __be16, proto, u64, flags) {
@@ -7989,6 +8047,8 @@ BPF_CALL_3(bpf_sk_assign, struct sk_buff *, skb, struct sock *, sk, u64, flags) return -ENETUNREACH; if (sk_unhashed(sk)) return -EOPNOTSUPP; + if (!bpf_sk_assign_family_ok(skb, sk)) + return -EAFNOSUPPORT; if (sk_is_refcounted(sk) && unlikely(!refcount_inc_not_zero(&sk->sk_refcnt))) return -ENOENT;
@@ -12526,6 +12586,9 @@ __bpf_kfunc int bpf_sk_assign_tcp_reqsk(struct __sk_buff *s, struct sock *sk, if (net != sock_net(sk)) return -ENETUNREACH; + if (!bpf_sk_assign_family_ok(skb, sk)) + return -EAFNOSUPPORT; + switch (skb->protocol) { case htons(ETH_P_IP): ops = &tcp_request_sock_ops;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 732b35cc08d1c..5d8f5e2c8db38 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h@@ -4568,6 +4568,10 @@ union bpf_attr { * **-EOPNOTSUPP** if the operation is not supported, for example * a call from outside of TC ingress. * + * **-EAFNOSUPPORT** if the socket family is not compatible with + * the network layer of the packet, for example an **AF_INET** + * socket and an IPv6 packet. + * * long bpf_sk_assign(struct bpf_sk_lookup *ctx, struct bpf_sock *sk, u64 flags) * Description * Helper is overloaded depending on BPF program type. This
--
2.43.0