github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bpf: Fix ksock build with BPF_LSM=y and SECURITY_NETWORK=n

Browse Source 
bpf_ksock.c references bpf_lsm_socket_sendmsg() whenever
CONFIG_BPF_LSM=y, but the socket LSM hooks, and with them the BPF LSM
socket_sendmsg hook, only exist with CONFIG_SECURITY_NETWORK=y. Without
it resolve_btfids warns:

  WARN: resolve_btfids: unresolved symbol bpf_lsm_socket_sendmsg

and since commit 201a454df9 ("resolve_btfids: Fix the --fatal_warnings
exit status") that fails the build with CONFIG_WERROR=y.

Only reference the hook with CONFIG_SECURITY_NETWORK=y, and use
BTF_ID_UNUSED otherwise. The ID stays zero, as it was when unresolved,
so bpf_ksock_kfunc_filter() keeps allowing LSM programs: none can be
attached to socket_sendmsg without CONFIG_SECURITY_NETWORK.

Fixes: 7ae4eb14c5 ("bpf: Add ksock kfuncs")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Mahe Tardy <mahe.tardy@gmail.com>
Link: https://patch.msgid.link/20261019211006.2574350-4-sashal@kernel.org
This commit is contained in:
Sasha Levin 2026-10-19 17:10:06 -04:00 committed by Alexei Starovoitov
parent ced6a0993e
commit a81bd9262c
No known key found for this signature in database
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/core/bpf_ksock.c
View File

@ -258,7 +258,12 @@ BTF_ID_FLAGS(func, bpf_ksock_send, KF_SLEEPABLE)
BTF_KFUNCS_END(ksock_kfunc_btf_ids)
#ifdef CONFIG_BPF_LSM
BTF_ID_LIST_SINGLE(bpf_lsm_socket_sendmsg_id, func, bpf_lsm_socket_sendmsg)
BTF_ID_LIST(bpf_lsm_socket_sendmsg_id)
#ifdef CONFIG_SECURITY_NETWORK
BTF_ID(func, bpf_lsm_socket_sendmsg)
#else
BTF_ID_UNUSED
#endif
#endif
static int bpf_ksock_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)