[PATCH bpf v2 1/2] bpf: reject incompatible socket assignments

[PATCH bpf v2 1/2] bpf: reject incompatible socket assignments

[Shihuang Liu]

bpf_sk_assign() permits TC ingress programs to associate an IPv6 packet
with an AF_INET socket. The receive path can then interpret IPv6 skb
control data as IPv4 metadata. When IP_RETOPTS is enabled, this can cause
__ip_options_echo() to copy beyond its stack buffer.

Reject incompatible packet and socket families in bpf_sk_assign() and
bpf_sk_assign_tcp_reqsk(). Continue to allow IPv4 packets to use
dual-stack AF_INET6 sockets.

Check request sockets against rsk_ops->family, since their sk_family is
inherited from the listener and sk_ipv6only is not initialized.

Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Assisted-by: LLM
Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
---
Changes since v1:
- Move family validation out of the IPv6 receive fast path and into
  bpf_sk_assign() and bpf_sk_assign_tcp_reqsk().
- Preserve IPv4 assignments to dual-stack AF_INET6 sockets.
- Check request sockets using rsk_ops->family.
- Split the fix into two patches and target the BPF fixes tree.

v1:
https://lore.kernel.org/netdev/20260823101809.26802-1-shlomojune6@gmail.com/

 include/uapi/linux/bpf.h       |  4 ++++
 net/core/filter.c              | 31 +++++++++++++++++++++++++++++++
 tools/include/uapi/linux/bpf.h |  4 ++++
 3 files changed, 39 insertions(+)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 732b35cc08d1c..5d8f5e2c8db38 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -4568,6 +4568,10 @@ union bpf_attr {
  *		**-EOPNOTSUPP** if the operation is not supported, for example
  *		a call from outside of TC ingress.
  *
+ *		**-EAFNOSUPPORT** if the socket family is not compatible with
+ *		the network layer of the packet, for example an **AF_INET**
+ *		socket and an IPv6 packet.
+ *
  * long bpf_sk_assign(struct bpf_sk_lookup *ctx, struct bpf_sock *sk, u64 flags)
  *	Description
  *		Helper is overloaded depending on BPF program type. This
diff --git a/net/core/filter.c b/net/core/filter.c
index 61940e7535523..e9cc76b775c0c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3491,6 +3491,32 @@ static int bpf_skb_proto_xlat(struct sk_buff *skb, __be16 to_proto)
 	return -ENOTSUPP;
 }
 
+static bool bpf_sk_assign_family_ok(const struct sk_buff *skb,
+				    const struct sock *sk)
+{
+	unsigned short family;
+
+	switch (skb->protocol) {
+	case htons(ETH_P_IP):
+		family = AF_INET;
+		break;
+	case htons(ETH_P_IPV6):
+		family = AF_INET6;
+		break;
+	default:
+		return true;
+	}
+
+	/* Requests inherit the listener family, but have family-specific ops. */
+	if (sk->sk_state == TCP_NEW_SYN_RECV)
+		return inet_reqsk(sk)->rsk_ops->family == family;
+
+	return sk->sk_family == family ||
+	       (family == AF_INET &&
+		sk->sk_family == AF_INET6 &&
+		!ipv6_only_sock(sk));
+}
+
 BPF_CALL_3(bpf_skb_change_proto, struct sk_buff *, skb, __be16, proto,
 	   u64, flags)
 {
@@ -7989,6 +8015,8 @@ BPF_CALL_3(bpf_sk_assign, struct sk_buff *, skb, struct sock *, sk, u64, flags)
 		return -ENETUNREACH;
 	if (sk_unhashed(sk))
 		return -EOPNOTSUPP;
+	if (!bpf_sk_assign_family_ok(skb, sk))
+		return -EAFNOSUPPORT;
 	if (sk_is_refcounted(sk) &&
 	    unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
 		return -ENOENT;
@@ -12526,6 +12554,9 @@ __bpf_kfunc int bpf_sk_assign_tcp_reqsk(struct __sk_buff *s, struct sock *sk,
 	if (net != sock_net(sk))
 		return -ENETUNREACH;
 
+	if (!bpf_sk_assign_family_ok(skb, sk))
+		return -EAFNOSUPPORT;
+
 	switch (skb->protocol) {
 	case htons(ETH_P_IP):
 		ops = &tcp_request_sock_ops;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 732b35cc08d1c..5d8f5e2c8db38 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -4568,6 +4568,10 @@ union bpf_attr {
  *		**-EOPNOTSUPP** if the operation is not supported, for example
  *		a call from outside of TC ingress.
  *
+ *		**-EAFNOSUPPORT** if the socket family is not compatible with
+ *		the network layer of the packet, for example an **AF_INET**
+ *		socket and an IPv6 packet.
+ *
  * long bpf_sk_assign(struct bpf_sk_lookup *ctx, struct bpf_sock *sk, u64 flags)
  *	Description
  *		Helper is overloaded depending on BPF program type. This
-- 
2.43.0

[PATCH bpf v2 2/2] bpf: revalidate assigned sockets after protocol change

[Shihuang Liu]

An IPv4 packet can be assigned to an AF_INET socket and then translated
to IPv6 by bpf_skb_change_proto(). Since the translation preserves the
socket assignment, the IPv6 packet can still be delivered to the IPv4
socket, bypassing the family check in bpf_sk_assign().

After a successful protocol change, recheck any prefetched socket
against the new protocol and call skb_orphan() if its address family
is incompatible. This releases the assignment through the existing
skb destructor, allowing normal socket lookup or a new assignment
by the BPF program.

Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Assisted-by: LLM
Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
---
Changes since v1:
- Revalidate prefetched sockets after bpf_skb_change_proto() changes the
  packet protocol, closing a bypass of assignment-time validation.
- Preserve compatible dual-stack assignments and release incompatible
  assignments through their existing skb destructor.
- Split the fix into two patches and target the BPF fixes tree.

v1:
https://lore.kernel.org/netdev/20260823101809.26802-1-shlomojune6@gmail.com/

 include/uapi/linux/bpf.h       | 4 ++++
 net/core/filter.c              | 5 +++++
 tools/include/uapi/linux/bpf.h | 4 ++++
 3 files changed, 13 insertions(+)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 5d8f5e2c8db38..0de7967077a2e 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2659,6 +2659,10 @@ union bpf_attr {
  * 		checked and segments are recalculated by the GSO/GRO engine.
  * 		The size for GSO target is adapted as well.
  *
+ *		On success, an assigned socket is released if its address
+ *		family is incompatible with the new protocol. Assign a
+ *		compatible socket after translation if required.
+ *
  * 		All values for *flags* are reserved for future usage, and must
  * 		be left at zero.
  *
diff --git a/net/core/filter.c b/net/core/filter.c
index e9cc76b775c0c..79a0e484d9dd4 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3547,6 +3547,11 @@ BPF_CALL_3(bpf_skb_change_proto, struct sk_buff *, skb, __be16, proto,
 	if (ret)
 		return ret;
 
+	/* Protocol translation can invalidate an earlier socket assignment. */
+	if (skb_sk_is_prefetched(skb) &&
+	    !bpf_sk_assign_family_ok(skb, skb->sk))
+		skb_orphan(skb);
+
 	if (skb_valid_dst(skb))
 		skb_dst_drop(skb);
 
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 5d8f5e2c8db38..0de7967077a2e 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2659,6 +2659,10 @@ union bpf_attr {
  * 		checked and segments are recalculated by the GSO/GRO engine.
  * 		The size for GSO target is adapted as well.
  *
+ *		On success, an assigned socket is released if its address
+ *		family is incompatible with the new protocol. Assign a
+ *		compatible socket after translation if required.
+ *
  * 		All values for *flags* are reserved for future usage, and must
  * 		be left at zero.
  *
-- 
2.43.0

Re: [PATCH bpf v2 1/2] bpf: reject incompatible socket assignments

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The newly added bpf_sk_assign_family_ok() check fails to prevent assigning IPv6 packets to IPv4-mapped AF_INET6 sockets, allowing a bypass that triggers the original stack buffer overflow.
--

commit d0f229f5acd0292d1114ee92bd952f7af2a9e02f
Author: Shihuang Liu <shlomojune6@gmail.com>
Subject: bpf: reject incompatible socket assignments

This commit rejects incompatible packet and socket families in bpf_sk_assign()
and bpf_sk_assign_tcp_reqsk() to prevent a stack buffer overflow. It continues
to allow IPv4 packets to use dual-stack AF_INET6 sockets.

Link: https://lore.kernel.org/netdev/20260823101809.26802-1-shlomojune6@gmail.com/

> diff --git a/net/core/filter.c b/net/core/filter.c
> index cae43b9991627..b5452113f974a 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
[ ... ]
> @@ -3491,6 +3491,32 @@ static int bpf_skb_proto_xlat(struct sk_buff *skb, __be16 to_proto)
[ ... ]
> +static bool bpf_sk_assign_family_ok(const struct sk_buff *skb,
> +				    const struct sock *sk)
> +{
> +	unsigned short family;
> +
> +	switch (skb->protocol) {
> +	case htons(ETH_P_IP):
> +		family = AF_INET;
> +		break;
> +	case htons(ETH_P_IPV6):
> +		family = AF_INET6;
> +		break;
> +	default:
> +		return true;
> +	}
> +
> +	/* Requests inherit the listener family, but have family-specific ops. */
> +	if (sk->sk_state == TCP_NEW_SYN_RECV)
> +		return inet_reqsk(sk)->rsk_ops->family == family;
> +
> +	return sk->sk_family == family ||
> +	       (family == AF_INET &&
> +		sk->sk_family == AF_INET6 &&
> +		!ipv6_only_sock(sk));
> +}

[Severity: Critical]
This is a pre-existing issue, but does this logic still allow a bypass that
triggers the original stack buffer overflow when handling dual-stack AF_INET6
child sockets?

If a dual-stack AF_INET6 listening socket accepts an IPv4 connection, it
creates a child socket with sk_family = AF_INET6 and sk_backlog_rcv =
tcp_v4_do_rcv.

If a malicious IPv6 packet is assigned to this IPv4-mapped child socket using
a TC BPF program, bpf_sk_assign_family_ok() evaluates to true because both the
packet and the socket report AF_INET6, incorrectly allowing the assignment.

If the socket is locked by userspace, the packet gets queued to the backlog.
Upon unlock, release_sock() calls the socket's backlog handler,
tcp_v4_do_rcv(), to process the IPv6 packet.

If tcp_v4_do_rcv() rejects the packet (for example, due to out-of-order data
on a half-closed socket), it jumps to the reset label and calls
tcp_v4_send_reset(), which unconditionally passes the IPv4 options offset to
ip_send_unicast_reply() and __ip_options_echo().

Since the packet was originally processed as IPv6, the control block contains
h6 data instead of IPv4 options. Attacker-controlled IPv6 extension headers
can overlay the IPv4 option offsets, which causes __ip_options_echo() to
execute an out-of-bounds memcpy into a stack buffer.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911172313.64009-1-shlomojune6@gmail.com?part=1

Re: [PATCH bpf v2 2/2] bpf: revalidate assigned sockets after protocol change

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] bpf_skb_change_proto can synchronously free a socket via skb_orphan(), leading to a Use-After-Free if the BPF program holds a PTR_TO_SOCK_COMMON pointer to it.
--

commit ecfe32dc3cf3e047fa0e8a7841baab762512d237
Author: Shihuang Liu <shlomojune6@gmail.com>

bpf: revalidate assigned sockets after protocol change

This commit adds a check in bpf_skb_change_proto() to revalidate any
prefetched socket after a protocol change. If the socket's address family
is no longer compatible, it releases the assignment by calling skb_orphan().

Link: https://lore.kernel.org/netdev/20260823101809.26802-1-shlomojune6@gmail.com/

[ ... ]

> diff --git a/net/core/filter.c b/net/core/filter.c
> index b5452113f974a..9907e9d44c11f 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -3547,6 +3547,11 @@ BPF_CALL_3(bpf_skb_change_proto, struct sk_buff *, skb, __be16, proto,
>  	if (ret)
>  		return ret;
>  
> +	/* Protocol translation can invalidate an earlier socket assignment. */
> +	if (skb_sk_is_prefetched(skb) &&
> +	    !bpf_sk_assign_family_ok(skb, skb->sk))
> +		skb_orphan(skb);

[Severity: Critical]
Does this code introduce a use-after-free if the BPF program currently holds
a pointer to the socket?

If a BPF program, such as a TC hook, loads skb->sk and verifies it, the
verifier grants a valid PTR_TO_SOCK_COMMON register. When the program
subsequently calls bpf_skb_change_proto(), this newly added code calls
skb_orphan().

The skb_orphan() function synchronously drops the SKB's reference to the
socket via sock_pfree() and sock_gen_put(). If this was the last reference
to an established TCP socket (which do not use SOCK_RCU_FREE), the socket
is freed immediately.

While the verifier's clear_all_pkt_pointers() clears packet data pointers
after protocol changes, it does not invalidate PTR_TO_SOCK_COMMON registers.
Can the BPF program then access the freed socket structure via its dangling
pointer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911172313.64009-1-shlomojune6@gmail.com?part=2