Re: [PATCH bpf-next 2/6] bpf: Add ksock kfuncs

[Mahe Tardy <mahe.tardy@gmail.com>]

On Mon, Jul 06, 2026 at 10:01:41AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Missing rollback of pernet subsystem on initialization error paths in `bpf_ksock_kfunc_init`.
> --
> 
> commit c26355c87f06c9eb5cc9cceccb20cfce50aa1e1e
> Author: Mahe Tardy <mahe.tardy@gmail.com>
> 
> bpf: Add ksock kfuncs
> 
> This commit introduces BPF kfuncs to allow BPF LSM and SYSCALL programs to
> create and use sockets for sending data. It adds several lifecycle and usage
> kfuncs for kernel sockets, limits socket creation via a per-namespace sysctl,
> and registers the necessary BTF kfuncs.
> 
> > diff --git a/net/core/bpf_ksock.c b/net/core/bpf_ksock.c
> > new file mode 100644
> > index 0000000000000..8bde734bc917d
> > --- /dev/null
> > +++ b/net/core/bpf_ksock.c
> 
> [ ... ]
> 
> > +static int __init bpf_ksock_kfunc_init(void)
> > +{
> > +	int ret;
> > +	const struct btf_id_dtor_kfunc bpf_ksock_dtors[] = {
> > +		{
> > +			.btf_id = bpf_ksock_dtor_ids[0],
> > +			.kfunc_btf_id = bpf_ksock_dtor_ids[1],
> > +		},
> > +	};
> > +
> > +	ret = register_pernet_subsys(&bpf_ksock_net_ops);
> > +	if (ret)
> > +		return ret;
> > +
> > +	ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL,
> > +					&ksock_init_kfunc_set);
> > +	if (ret) {
> > +		unregister_pernet_subsys(&bpf_ksock_net_ops);
> > +		return ret;
> > +	}
> > +
> > +	ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL,
> > +					&ksock_kfunc_set);
> > +	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LSM,
> > +					       &ksock_kfunc_set);
> > +	return ret = ret ?: register_btf_id_dtor_kfuncs(bpf_ksock_dtors,
> > +						 ARRAY_SIZE(bpf_ksock_dtors),
> > +						 THIS_MODULE);
> 
> [Severity: Medium]
> If the later register_btf_kfunc_id_set() or register_btf_id_dtor_kfuncs()
> calls fail in bpf_ksock_kfunc_init(), does this leak the pernet operations
> registration?
> 
> The earlier error path for BPF_PROG_TYPE_SYSCALL registration properly
> calls unregister_pernet_subsys(&bpf_ksock_net_ops). If these subsequent
> registrations fail, the function returns the error directly without cleaning
> up the pernet subsystem.

Since there's no way of unregistering kfuncs for a certain prog type if
one step fails, I took the decision to unregister the per net ns count
if the first fails. Not sure how important this is and if there's a
cleaner way of doing this?

The last return line could be adjusted as mentioned in a separate thread
on the same message.

> 
> > +}
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260706093525.13030-1-mahe.tardy@gmail.com?part=2