[PATCH] io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()

[PATCH] io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()

[Dominik Maier]

When an IORING_OP_SOCKET request is prepared in io_socket_prep(),
sock->type retains creation flags such as SOCK_CLOEXEC and SOCK_NONBLOCK
until __sys_socket_file() masks them off with SOCK_TYPE_MASK during
execution.

However, io_socket_bpf_populate() copies sock->type into
bctx->socket.type without masking off ~SOCK_TYPE_MASK. As a result, a
cBPF filter inspecting bctx->socket.type against socket types such as
SOCK_DGRAM or SOCK_STREAM can be bypassed by ORing SOCK_CLOEXEC or
SOCK_NONBLOCK into the socket type.

Mask sock->type with SOCK_TYPE_MASK when populating bctx->socket.type.

Fixes: cff1c26b4223 ("io_uring/net: allow filtering on IORING_OP_SOCKET data")
Assisted-by: ARTIST LLM
Signed-off-by: Dominik Maier <dmnk@google.com>
---
 io_uring/net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index f5f4f3ce6ef3..5ead8a83a89f 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1711,7 +1711,7 @@ void io_socket_bpf_populate(struct io_uring_bpf_ctx *bctx, struct io_kiocb *req)
 	struct io_socket *sock = io_kiocb_to_cmd(req, struct io_socket);
 
 	bctx->socket.family = sock->domain;
-	bctx->socket.type = sock->type;
+	bctx->socket.type = sock->type & SOCK_TYPE_MASK;
 	bctx->socket.protocol = sock->protocol;
 }
 
-- 
2.56.0.257.gf7497c7d27-goog

Re: [PATCH] io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()

[Jens Axboe]

On Fri, 23 Oct 2026 01:21:20 +0200, Dominik Maier wrote:
> When an IORING_OP_SOCKET request is prepared in io_socket_prep(),
> sock->type retains creation flags such as SOCK_CLOEXEC and SOCK_NONBLOCK
> until __sys_socket_file() masks them off with SOCK_TYPE_MASK during
> execution.
> 
> However, io_socket_bpf_populate() copies sock->type into
> bctx->socket.type without masking off ~SOCK_TYPE_MASK. As a result, a
> cBPF filter inspecting bctx->socket.type against socket types such as
> SOCK_DGRAM or SOCK_STREAM can be bypassed by ORing SOCK_CLOEXEC or
> SOCK_NONBLOCK into the socket type.
> 
> [...]

Applied, thanks!

[1/1] io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()
      commit: e66907c3ba229399ecfb4ef032b95a4a071c894e

Best regards,
-- 
Jens Axboe