[PATCH iproute2 v2] ss: drop the /proc parsers for packet and netlink sockets

[PATCH iproute2 v2] ss: drop the /proc parsers for packet and netlink sockets

[Prabhakar Pujeri]

packet_show() and netlink_show() fall back to parsing
/proc/net/packet and /proc/net/netlink only when the sock_diag
netlink dump fails.  That fallback exists for kernels without
sock_diag support and parses each record with sscanf() without
checking the conversion count, so truncated or malformed lines
leave fields used by filtering and printing uninitialized.

Remove both sscanf() based parsers instead of trying to validate
them; kernels new enough to matter answer the sock_diag request.
packet_show_line() and the PROC_NET_PACKET/PROC_NET_NETLINK hooks
have no other users.

Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
---
Changes in v2:
- Replace the sscanf() validation series: per Stephen's review of v1, remove
  the /proc fallback parsing for packet and netlink sockets instead of
  hardening it, so the unchecked conversions are gone with the code.
v1: https://lore.kernel.org/netdev/20260831104116.2190-1-prabhakar.pujeri@dell.com/

 misc/ss.c | 79 ++-----------------------------------------------------
 1 file changed, 2 insertions(+), 77 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c
index 26520cee..6ca6d406 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -480,10 +480,6 @@ static void filter_merge_defaults(struct filter *f)
 #define net_raw_open()		generic_proc_open("PROC_NET_RAW", "net/raw")
 #define net_raw6_open()		generic_proc_open("PROC_NET_RAW6", "net/raw6")
 #define net_unix_open()		generic_proc_open("PROC_NET_UNIX", "net/unix")
-#define net_packet_open()	generic_proc_open("PROC_NET_PACKET", \
-							"net/packet")
-#define net_netlink_open()	generic_proc_open("PROC_NET_NETLINK", \
-							"net/netlink")
 #define net_sockstat_open()	generic_proc_open("PROC_NET_SOCKSTAT", \
 							"net/sockstat")
 #define net_sockstat6_open()	generic_proc_open("PROC_NET_SOCKSTAT6", \
@@ -4916,56 +4912,12 @@ static int packet_show_netlink(struct filter *f)
 	return handle_netlink_request(f, &req.nlh, sizeof(req), packet_show_sock);
 }
 
-static int packet_show_line(char *buf, const struct filter *f, int fam)
-{
-	unsigned long long sk;
-	struct sockstat stat = {};
-	int type, prot, iface, state, rq, uid, ino;
-
-	sscanf(buf, "%llx %*d %d %x %d %d %u %u %u",
-			&sk,
-			&type, &prot, &iface, &state,
-			&rq, &uid, &ino);
-
-	if (type == SOCK_RAW && !(f->dbs & (1<<PACKET_R_DB)))
-		return 0;
-	if (type == SOCK_DGRAM && !(f->dbs & (1<<PACKET_DG_DB)))
-		return 0;
-
-	stat.type  = type;
-	stat.prot  = prot;
-	stat.lport = stat.iface = iface;
-	stat.state = state;
-	stat.rq    = rq;
-	stat.uid   = uid;
-	stat.ino   = ino;
-	stat.state = SS_CLOSE;
-
-	if (packet_stats_print(&stat, f))
-		return 0;
-
-	return 0;
-}
-
 static int packet_show(struct filter *f)
 {
-	FILE *fp;
-	int rc = 0;
-
 	if (!filter_af_get(f, AF_PACKET) || !(f->states & (1 << SS_CLOSE)))
 		return 0;
 
-	if (!getenv("PROC_NET_PACKET") && !getenv("PROC_ROOT") &&
-			packet_show_netlink(f) == 0)
-		return 0;
-
-	if ((fp = net_packet_open()) == NULL)
-		return -1;
-	if (generic_record_read(fp, packet_show_line, f, AF_PACKET))
-		rc = -1;
-
-	fclose(fp);
-	return rc;
+	return packet_show_netlink(f);
 }
 
 static int xdp_stats_print(struct sockstat *s, const struct filter *f)
@@ -5276,37 +5228,10 @@ static int netlink_show_netlink(struct filter *f)
 
 static int netlink_show(struct filter *f)
 {
-	FILE *fp;
-	char buf[256];
-	int prot, pid;
-	unsigned int groups;
-	int rq, wq, rc;
-	unsigned long long sk, cb;
-
 	if (!filter_af_get(f, AF_NETLINK) || !(f->states & (1 << SS_CLOSE)))
 		return 0;
 
-	if (!getenv("PROC_NET_NETLINK") && !getenv("PROC_ROOT") &&
-		netlink_show_netlink(f) == 0)
-		return 0;
-
-	if ((fp = net_netlink_open()) == NULL)
-		return -1;
-	if (!fgets(buf, sizeof(buf), fp)) {
-		fclose(fp);
-		return -1;
-	}
-
-	while (fgets(buf, sizeof(buf), fp)) {
-		sscanf(buf, "%llx %d %d %x %d %d %llx %d",
-		       &sk,
-		       &prot, &pid, &groups, &rq, &wq, &cb, &rc);
-
-		netlink_show_one(f, prot, pid, groups, 0, 0, 0, rq, wq, sk, cb);
-	}
-
-	fclose(fp);
-	return 0;
+	return netlink_show_netlink(f);
 }
 
 static bool vsock_type_skip(struct sockstat *s, struct filter *f)
-- 
2.55.0

Re: [PATCH iproute2 v2] ss: drop the /proc parsers for packet and netlink sockets

[Stephen Hemminger]

On Wed,  2 Sep 2026 03:56:33 +0000
Prabhakar Pujeri <prabhakar.pujeri@dell.com> wrote:

> packet_show() and netlink_show() fall back to parsing
> /proc/net/packet and /proc/net/netlink only when the sock_diag
> netlink dump fails.  That fallback exists for kernels without
> sock_diag support and parses each record with sscanf() without
> checking the conversion count, so truncated or malformed lines
> leave fields used by filtering and printing uninitialized.
> 
> Remove both sscanf() based parsers instead of trying to validate
> them; kernels new enough to matter answer the sock_diag request.
> packet_show_line() and the PROC_NET_PACKET/PROC_NET_NETLINK hooks
> have no other users.
> 
> Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
> ---

This makes sense and looks good to me, but AI review spotted some nits:

Subject: Re: [PATCH iproute2] ss: drop the /proc parsers for packet and netlink sockets

On Wed, Sep 2 2026, Prabhakar Pujeri wrote:
> packet_show() and netlink_show() fall back to parsing
> /proc/net/packet and /proc/net/netlink only when the sock_diag
> netlink dump fails.  That fallback exists for kernels without
> sock_diag support and parses each record with sscanf() without
> checking the conversion count, so truncated or malformed lines
> leave fields used by filtering and printing uninitialized.

The direction is right and the diff is mostly mechanical, but the patch
stops one hunk short: it removes the fallback without removing the code
that exists only to *trigger* the fallback.  That leaves a real behaviour
regression.  Details below, plus two pre-existing issues the removal
makes user-visible.

1. packet_show_sock() still bails out to a fallback that no longer exists
---------------------------------------------------------------------

misc/ss.c:4776

	/* use /proc/net/packet if all info are not available */
	if (!tb[PACKET_DIAG_MEMINFO])
		return -1;

This is the last remaining reference to /proc/net/packet in the tree, and
it is not just a stale comment.  That `return -1` was the mechanism for
requesting the fallback: it propagated up so packet_show() would retry
via net_packet_open().  With the fallback gone, the -1 is returned from
an rtnl_dump_filter() callback, which aborts the entire dump.

So on any kernel that answers the sock_diag request but omits
PACKET_DIAG_MEMINFO for a socket, the old code printed that socket from
/proc.  The new code silently truncates the listing at that socket:
everything already dumped before it has been printed, that socket and
every socket after it are dropped, and the exit status is still 0.  If
the very first socket is the one missing MEMINFO, the output is empty.
Before, missing MEMINFO degraded to a less detailed listing; now it
degrades to silently incomplete output with no error.

Note MEMINFO is only requested because packet_show_netlink() sets
PACKET_SHOW_MEMINFO unconditionally (misc/ss.c:4909) -- it is not
something the user asked for, so aborting the dump over it is the wrong
trade even ignoring the dead-fallback issue.

Suggested fix -- drop the check with the parser, and let the existing
`if (tb[PACKET_DIAG_MEMINFO])` guard below at misc/ss.c:4786 do its job
(it is already written to tolerate the attribute being absent):

	-	/* use /proc/net/packet if all info are not available */
	-	if (!tb[PACKET_DIAG_MEMINFO])
	-		return -1;
	-
		stat.type   = r->pdiag_type;

stat.rq simply stays 0 in that case, which is the same thing the netlink
path already does for every other optional attribute.

2. No diagnostic when sock_diag is unavailable
----------------------------------------------

packet_show() and netlink_show() now return the netlink result directly,
and main() (misc/ss.c:6183-6186) ignores the return value:

	if (current_filter.dbs & (1<<NETLINK_DB))
		netlink_show(&current_filter);
	if (current_filter.dbs & PACKET_DBM)
		packet_show(&current_filter);

On a kernel without CONFIG_PACKET_DIAG / CONFIG_NETLINK_DIAG (these are
separate config symbols and are genuinely off in some minimal builds,
independent of kernel age), `ss -0` and `ss -A netlink` now print a
header and nothing else, exit 0, with no indication that anything
failed.  The commit message argues such kernels do not matter, which is
defensible for the fallback itself -- but silently succeeding is not the
same as not supporting it.

This is consistent with how vsock/tipc/xdp already behave, so I would not
block on it.  Still, a one-line stderr hint when the dump fails would
save users a lot of confusion, and it is cheap to add.

3. packet_raw / packet_dgram filtering is now dead in all cases
---------------------------------------------------------------

To be clear up front: this patch did not introduce this bug.  But it
removes the last environment in which the filter ever worked, so it is
worth calling out in the commit message at minimum.

The removed packet_show_line() carried the only type filtering that ever
existed:

> -	if (type == SOCK_RAW && !(f->dbs & (1<<PACKET_R_DB)))
> -		return 0;
> -	if (type == SOCK_DGRAM && !(f->dbs & (1<<PACKET_DG_DB)))
> -		return 0;

There is no equivalent in the netlink path.  packet_show_sock() reads the
type at misc/ss.c:4780:

	stat.type   = r->pdiag_type;

but neither it nor packet_stats_print() ever tests f->dbs, and
run_ssfilter() does not look at s->type.  Since the dispatcher gates on
PACKET_DBM (misc/ss.c:6185), which is the OR of both bits, selecting
either `packet_raw` or `packet_dgram` runs an unfiltered dump and
displays all AF_PACKET sockets.

Because packet_show() already preferred the netlink path before this
patch, `ss --packet_raw` was already returning dgram sockets too on any
kernel with packet_diag.  After this patch it is unconditional.  The
option is still documented (man/man8/ss.8:411) and still accepted by
filter_db_parse() (misc/ss.c:403-407), so users get a silently wrong
answer rather than an error.

The fix is a packet_type_skip() mirroring the existing unix_type_skip()
(misc/ss.c:4443) and vsock_type_skip() (misc/ss.c:5237), called from
packet_show_sock() once stat.type is populated.  That is arguably a
separate patch -- but please either include it here or note the known
gap in the commit message, so it is not mistaken for collateral damage
from this removal.

Minor notes
-----------

- unix_show() keeps its /proc fallback (misc/ss.c:4597).  If the argument
  is "kernels new enough to matter answer sock_diag", it applies equally
  to AF_UNIX.  Worth a sentence in the commit message on why packet and
  netlink were chosen and unix left alone, so the asymmetry reads as
  deliberate.

- The PROC_NET_PACKET / PROC_NET_NETLINK env overrides went away with the
  macros.  I grepped the tree: nothing in man/, README*, or testsuite/
  references them, so there is no doc or test fallout.  Confirming for
  the record, not asking for a change.

- netlink_show_one()'s getenv("PROC_ROOT") at misc/ss.c:5127 is unrelated
  (it resolves a peer PID's name from /proc/<pid>/stat) and correctly
  left alone.

- Builds clean -- no unused-function warnings.  packet_stats_print(),
  netlink_show_one() and generic_record_read() all still have callers on
  the netlink and tcp/udp/raw paths.

I will send its suggested changes

[RFC PATCH iproute2 0/3] ss: follow-ups to the packet/netlink /proc removal

[Stephen Hemminger]

This is the overly wordy AI suggestions:


Commit a2b31976 ("ss: drop the /proc parsers for packet and netlink
sockets") removed the sscanf() based /proc/net/packet and
/proc/net/netlink fallbacks.  Reviewing it turned up three loose ends,
one of which is a real regression from that commit.  Sending as RFC
because patch 3 changes user-visible filtering behaviour and I have
not been able to exercise it (see below).

Patch 1 is the regression fix and is the one that matters.  a2b31976
removed the fallback but left the code whose only purpose was to
request it:

	/* use /proc/net/packet if all info are not available */
	if (!tb[PACKET_DIAG_MEMINFO])
		return -1;

That -1 used to propagate up so packet_show() would retry via
net_packet_open().  With no fallback left it is returned from an
rtnl_dump_filter() callback, which aborts the dump.  A kernel that
omits PACKET_DIAG_MEMINFO for a socket now silently truncates the
listing at that socket rather than falling back.  The check is
redundant in any case: the code below already guards the attribute and
leaves stat.rq at 0 when it is absent.

Patch 2 adds a diagnostic.  Without the /proc fallback, "ss -0" on a
kernel lacking CONFIG_PACKET_DIAG prints a header and nothing else.
AF_PACKET sockets exist on essentially every system, so an empty
listing reads as "no sockets" rather than "ss could not ask" -- unlike
tipc or vsock, where an empty result is unremarkable.  rtnl_dump_error()
deliberately swallows ENOENT and EOPNOTSUPP for NETLINK_SOCK_DIAG
precisely because callers used to fall back to /proc, so those two are
reported at the call site.  Exit status is unchanged.

Patch 3 restores packet_raw/packet_dgram filtering.  This one is not a
regression from a2b31976, but that commit is what made it
unconditional.  The SOCK_RAW/SOCK_DGRAM check only ever lived in the
removed /proc parser; the sock_diag path never had it, and since
packet_show() already preferred sock_diag, "ss -A packet_raw" has been
returning dgram sockets on any kernel with packet_diag for a long time.

Open question, and the reason for the RFC tag: I could not get
"ss -A packet", "-A packet_raw" or "-A packet_dgram" to list anything
at all, on current HEAD or before this series, while "ss -0" works
fine.  filter_db_set() sets f->states and f->dbs but never
f->families, whereas -0 goes via filter_af_set(), which does set it;
packet_show() then gates on filter_af_get(f, AF_PACKET).  If that is
the cause then -A packet* has been a no-op independently of any of
this, and patch 3's filtering cannot be reached through -A until it is
fixed.  I have not confirmed this and deliberately have not touched it
here.  So patch 3 is verified only in that it compiles clean and does
not over-filter the default "ss -0" path; the case it exists for is
untested.  Review of that patch especially welcome.

Patches 1 and 2 were tested on a kernel with packet_diag, including a
simulated PACKET_DIAG failure to confirm the new message goes to
stderr and leaves stdout clean.

Stephen Hemminger (3):
  ss: drop the dead /proc fallback trigger in packet_show_sock()
  ss: warn when packet socket diag is unavailable
  ss: restore packet_raw/packet_dgram filtering

 misc/ss.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

--
2.53.0

Stephen Hemminger (3):
  ss: drop the dead /proc fallback trigger in packet_show_sock()
  ss: warn when packet socket diag is unavailable
  ss: restore packet_raw/packet_dgram filtering

 misc/ss.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

-- 
2.53.0

[RFC 1/3] ss: drop the dead /proc fallback trigger in packet_show_sock()

[Stephen Hemminger]

Commit a2b31976 ("ss: drop the /proc parsers for packet and netlink
sockets") removed the /proc/net/packet fallback but left behind the
code whose only purpose was to request it:

	/* use /proc/net/packet if all info are not available */
	if (!tb[PACKET_DIAG_MEMINFO])
		return -1;

That -1 used to propagate up so packet_show() would retry via
net_packet_open().  With no fallback left it is returned from an
rtnl_dump_filter() callback, which aborts the dump.  A kernel that
omits PACKET_DIAG_MEMINFO for a socket now silently truncates the
listing at that socket: everything after it is dropped and the exit
status is still 0.

The check is redundant anyway.  The code below already guards the
attribute with "if (tb[PACKET_DIAG_MEMINFO])" and simply leaves
stat.rq at 0 when it is absent, which is how the netlink path treats
every other optional attribute.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 misc/ss.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c
index 6ca6d406..0b7ba256 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -4773,10 +4773,6 @@ static int packet_show_sock(struct nlmsghdr *nlh, void *arg)
 	parse_rtattr(tb, PACKET_DIAG_MAX, (struct rtattr *)(r+1),
 		     nlh->nlmsg_len - NLMSG_LENGTH(sizeof(*r)));
 
-	/* use /proc/net/packet if all info are not available */
-	if (!tb[PACKET_DIAG_MEMINFO])
-		return -1;
-
 	stat.type   = r->pdiag_type;
 	stat.prot   = r->pdiag_num;
 	stat.ino    = r->pdiag_ino;
-- 
2.53.0

[RFC 2/3] ss: warn when packet socket diag is unavailable

[Stephen Hemminger]

Since the /proc/net/packet fallback went away, "ss -0" on a kernel
built without CONFIG_PACKET_DIAG prints a header and nothing else,
with no indication that anything went wrong.

AF_PACKET sockets are present on essentially every system, so an
empty listing reads as "no sockets" rather than "ss could not ask".
That is unlike tipc or vsock, where an empty result is unremarkable.

rtnl_dump_error() deliberately returns ENOENT and EOPNOTSUPP silently
for NETLINK_SOCK_DIAG, precisely because callers used to fall back to
/proc.  With no fallback left, report those two at the call site.
Every other netlink error already gets perror("RTNETLINK answers"),
and rtnl_open_byproto() reports its own failures, so this does not
double up.

Only the diagnostic on stderr is new; the exit status is unchanged.

netlink_show() is left alone: CONFIG_NETLINK_DIAG is genuinely
optional and "ss -A netlink" is rarely the only thing a user asked
for.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 misc/ss.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/misc/ss.c b/misc/ss.c
index 0b7ba256..7ec72c04 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -4913,7 +4913,17 @@ static int packet_show(struct filter *f)
 	if (!filter_af_get(f, AF_PACKET) || !(f->states & (1 << SS_CLOSE)))
 		return 0;
 
-	return packet_show_netlink(f);
+	if (packet_show_netlink(f)) {
+		/*
+		 * rtnl_dump_error() swallows these two silently for
+		 * NETLINK_SOCK_DIAG; anything else already perror'd.
+		 */
+		if (errno == ENOENT || errno == EOPNOTSUPP)
+			fprintf(stderr, "ss: no packet socket information available, kernel may lack CONFIG_PACKET_DIAG\n");
+		return -1;
+	}
+
+	return 0;
 }
 
 static int xdp_stats_print(struct sockstat *s, const struct filter *f)
-- 
2.53.0

[RFC 3/3] ss: restore packet_raw/packet_dgram filtering

[Stephen Hemminger]

The SOCK_RAW/SOCK_DGRAM type check only ever existed in the
/proc/net/packet parser, packet_show_line(), which commit a2b31976
("ss: drop the /proc parsers for packet and netlink sockets")
removed.  The sock_diag path never had it.

packet_show_sock() populates stat.type from pdiag_type but nothing
tested it, and the dispatcher gates on PACKET_DBM, which is the OR of
both bits.  So selecting either type ran an unfiltered dump and
displayed every AF_PACKET socket.  Since packet_show() already
preferred the netlink path, "ss -A packet_raw" has been returning
dgram sockets on any kernel with packet_diag for a long time; the
/proc removal just made it unconditional.

Add packet_type_skip(), mirroring the existing unix_type_skip() and
vsock_type_skip(), and call it from packet_show_sock() once the type
is known.  As before, a socket that is neither SOCK_RAW nor
SOCK_DGRAM falls through both tests and is still displayed.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 misc/ss.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/misc/ss.c b/misc/ss.c
index 7ec72c04..37ed73c4 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -4713,6 +4713,15 @@ static int unix_show(struct filter *f)
 	return 0;
 }
 
+static bool packet_type_skip(struct sockstat *s, const struct filter *f)
+{
+	if (s->type == SOCK_RAW && !(f->dbs & (1 << PACKET_R_DB)))
+		return true;
+	if (s->type == SOCK_DGRAM && !(f->dbs & (1 << PACKET_DG_DB)))
+		return true;
+	return false;
+}
+
 static int packet_stats_print(struct sockstat *s, const struct filter *f)
 {
 	const char *addr, *port;
@@ -4779,6 +4788,9 @@ static int packet_show_sock(struct nlmsghdr *nlh, void *arg)
 	stat.state  = SS_CLOSE;
 	stat.sk	    = cookie_sk_get(&r->pdiag_cookie[0]);
 
+	if (packet_type_skip(&stat, f))
+		return 0;
+
 	if (tb[PACKET_DIAG_MEMINFO]) {
 		__u32 *skmeminfo = RTA_DATA(tb[PACKET_DIAG_MEMINFO]);
 
-- 
2.53.0