From: Mahe Tardy <mahe.tardy@gmail.com>
To: Sasha Levin <sashal@kernel.org>
Cc: bpf@vger.kernel.org, Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
John Fastabend <john.fastabend@gmail.com>,
Andrii Nakryiko <andrii@kernel.org>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>,
Emil Tsalapatis <emil@etsalapatis.com>,
Ihor Solodrai <ihor.solodrai@linux.dev>,
Eric Dumazet <edumazet@kernel.org>,
Kuniyuki Iwashima <kuniyu@google.com>,
Paolo Abeni <pabeni@redhat.com>,
Willem de Bruijn <willemb@google.com>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>, Simon Horman <horms@kernel.org>,
Amery Hung <ameryhung@gmail.com>,
Puranjay Mohan <puranjay@kernel.org>,
Stanislav Fomichev <sdf@fomichev.me>,
Jiayuan Chen <jiayuan.chen@linux.dev>,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
Petr Pavlu <petr.pavlu@suse.com>,
Leon Hwang <leon.hwang@linux.dev>
Subject: Re: [PATCH bpf-next 3/3] bpf: Fix ksock build with BPF_LSM=y and SECURITY_NETWORK=n
Date: Tue, 20 Oct 2026 01:16:39 +0200 [thread overview]
Message-ID: <atak1wakfuKz3ZYi@gmail.com> (raw)
In-Reply-To: <20261019211006.2574350-4-sashal@kernel.org>
On Mon, Oct 19, 2026 at 05:10:06PM -0400, Sasha Levin wrote:
> bpf_ksock.c references bpf_lsm_socket_sendmsg() whenever
> CONFIG_BPF_LSM=y, but the socket LSM hooks, and with them the BPF LSM
> socket_sendmsg hook, only exist with CONFIG_SECURITY_NETWORK=y. Without
> it resolve_btfids warns:
>
> WARN: resolve_btfids: unresolved symbol bpf_lsm_socket_sendmsg
>
> and since commit 201a454df948 ("resolve_btfids: Fix the --fatal_warnings
> exit status") that fails the build with CONFIG_WERROR=y.
>
> Only reference the hook with CONFIG_SECURITY_NETWORK=y, and use
> BTF_ID_UNUSED otherwise. The ID stays zero, as it was when unresolved,
> so bpf_ksock_kfunc_filter() keeps allowing LSM programs: none can be
> attached to socket_sendmsg without CONFIG_SECURITY_NETWORK.
>
> Fixes: 7ae4eb14c5f9 ("bpf: Add ksock kfuncs")
> Assisted-by: LLM
> Signed-off-by: Sasha Levin <sashal@kernel.org>
Acked-by: Mahe Tardy <mahe.tardy@gmail.com>
Makes sense, thanks for fixing this warning.
> ---
> net/core/bpf_ksock.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/net/core/bpf_ksock.c b/net/core/bpf_ksock.c
> index 7bf796193ab61..48a2e2327acef 100644
> --- a/net/core/bpf_ksock.c
> +++ b/net/core/bpf_ksock.c
> @@ -258,7 +258,12 @@ BTF_ID_FLAGS(func, bpf_ksock_send, KF_SLEEPABLE)
> BTF_KFUNCS_END(ksock_kfunc_btf_ids)
>
> #ifdef CONFIG_BPF_LSM
> -BTF_ID_LIST_SINGLE(bpf_lsm_socket_sendmsg_id, func, bpf_lsm_socket_sendmsg)
> +BTF_ID_LIST(bpf_lsm_socket_sendmsg_id)
> +#ifdef CONFIG_SECURITY_NETWORK
> +BTF_ID(func, bpf_lsm_socket_sendmsg)
> +#else
> +BTF_ID_UNUSED
> +#endif
> #endif
>
> static int bpf_ksock_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)
> --
> 2.53.0
>
next prev parent reply other threads:[~2026-10-19 23:16 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-19 21:10 [PATCH bpf-next 0/3] bpf: Fix builds broken by fatal resolve_btfids warnings Sasha Levin
2026-10-19 21:10 ` [PATCH bpf-next 1/3] bpf: Drop unused entries from special_kfunc_list again Sasha Levin
2026-10-19 21:10 ` [PATCH bpf-next 2/3] bpf: Don't reference arena kfuncs when arena isn't built Sasha Levin
2026-10-19 21:10 ` [PATCH bpf-next 3/3] bpf: Fix ksock build with BPF_LSM=y and SECURITY_NETWORK=n Sasha Levin
2026-10-19 23:16 ` Mahe Tardy [this message]
2026-10-20 0:20 ` [PATCH bpf-next 0/3] bpf: Fix builds broken by fatal resolve_btfids warnings patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=atak1wakfuKz3ZYi@gmail.com \
--to=mahe.tardy@gmail.com \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=edumazet@kernel.org \
--cc=emil@etsalapatis.com \
--cc=horms@kernel.org \
--cc=ihor.solodrai@linux.dev \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kuba@kernel.org \
--cc=kuniyu@google.com \
--cc=leon.hwang@linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=petr.pavlu@suse.com \
--cc=puranjay@kernel.org \
--cc=sashal@kernel.org \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=willemb@google.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.