Re: [PATCH bpf-next 0/8] bpf: Expand ksock send-path support

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Tue, Oct 20, 2026 at 03:25 AM Mahe Tardy <mahe.tardy@gmail.com> wrote:
> * allow bpf_ksock_connect() to be called in the send path
> * add bpf_ksock_sendto() kfunc to complement to bpf_ksock_send()
>
> This is useful when using ksock to reply to differents peers while
> reusing the same UDP socket and generally works toward the goal of ksock
> to support the basic socket operations.

can we drop connect from LSM progs and patches 1-5 altogether ?
bpf_ksock_sendto() alone replies to different peers on one socket.

connect + send from LSM progs can't do that reliably. The socket is
shared through the kptr and sleepable progs run concurrently. Between
bpf_ksock_connect(A) and bpf_ksock_send() on one CPU, another CPU does
bpf_ksock_connect(B) and the datagram for A goes to B.

Without connect there, acquire/release in socket_sendmsg has no user:
nothing can be done with that reference. bpf_ksock_sendto() is in
ksock_kfunc_btf_ids, so the current filter rejects it in socket_sendmsg
already. Then no need for bpf_ksock_send_id, bpf_ksock_sendto_id,
bpf_ksock_connect_id, bpf_lsm_socket_connect_id and the cycle comment.

Selftests are left out below. Patch 8 stays as is, patch 7 stays
without the socket_connect hunk.

Something like this (compile tested only):

diff --git a/net/core/bpf_ksock.c b/net/core/bpf_ksock.c
index 48a2e23..48757dc 100644
--- a/net/core/bpf_ksock.c
+++ b/net/core/bpf_ksock.c
@@ -37,6 +37,25 @@ static void ksock_release_work_fn(struct work_struct *work)
 	kfree(ks);
 }

+static int bpf_ksock_addr_to_sockaddr(const union bpf_ksock_addr *addr,
+				      u32 addr_sz, struct sockaddr_storage *sa)
+{
+	if (!addr || addr_sz != sizeof(*addr))
+		return -EINVAL;
+
+	/* Kfunc memory arguments may be unaligned. */
+	memcpy(sa, addr, sizeof(*addr));
+
+	switch (sa->ss_family) {
+	case AF_INET:
+		return sizeof(struct sockaddr_in);
+	case AF_INET6:
+		return sizeof(struct sockaddr_in6);
+	default:
+		return -EAFNOSUPPORT;
+	}
+}
+
 __bpf_kfunc_start_defs();

 /**
@@ -155,22 +174,9 @@ __bpf_kfunc int bpf_ksock_connect(struct bpf_ksock *ks,
 	struct sockaddr_storage sa;
 	int addrlen;

-	if (!addr || addr__sz != sizeof(*addr))
-		return -EINVAL;
-
-	/* Kfunc memory arguments may be unaligned. */
-	memcpy(&sa, addr, sizeof(*addr));
-
-	switch (sa.ss_family) {
-	case AF_INET:
-		addrlen = sizeof(struct sockaddr_in);
-		break;
-	case AF_INET6:
-		addrlen = sizeof(struct sockaddr_in6);
-		break;
-	default:
-		return -EAFNOSUPPORT;
-	}
+	addrlen = bpf_ksock_addr_to_sockaddr(addr, addr__sz, &sa);
+	if (addrlen < 0)
+		return addrlen;

 	return connect_socket(ks->sock, &sa, addrlen, 0);
 }
@@ -212,19 +218,25 @@ __bpf_kfunc void bpf_ksock_release_dtor(void *ks)
 CFI_NOSEAL(bpf_ksock_release_dtor);

 /**
- * bpf_ksock_send() - Send data through a BPF kernel socket.
+ * bpf_ksock_sendto() - Send data through a BPF kernel socket to a remote address.
  * @ks:		The BPF kernel socket context. Must be an acquired reference.
  * @data:	Pointer to the data to send.
  * @data__sz:	Size of the data to send.
+ * @addr__nullable: Pointer to an IPv4 or IPv6 socket address, or NULL to use
+ *		   the connected destination.
+ * @addr__sz:	Size of the address union, ignored when the address is NULL.
  *
- * Sends data on a connected socket, best-effort and nonblocking. This may sleep
+ * Sends data to the specified address, or to the connected destination when
+ * the address is NULL, best-effort and nonblocking. This may sleep
  * (kernel_sendmsg), so it can only be called from sleepable BPF programs.
  *
  * Return: Number of bytes sent on success, negative errno on error.
  */
-__bpf_kfunc int bpf_ksock_send(struct bpf_ksock *ks, const void *data,
-			       u32 data__sz)
+__bpf_kfunc int bpf_ksock_sendto(struct bpf_ksock *ks, const void *data, u32 data__sz,
+				 const union bpf_ksock_addr *addr__nullable,
+				 u32 addr__sz)
 {
+	struct sockaddr_storage sa;
 	struct msghdr msg = {
 		.msg_flags = MSG_DONTWAIT,
 	};
@@ -232,11 +244,34 @@ __bpf_kfunc int bpf_ksock_send(struct bpf_ksock *ks, const void *data,
 		.iov_base = (void *)data,
 		.iov_len = data__sz,
 	};
-	int ret;
+	int addrlen;

-	ret = kernel_sendmsg(ks->sock, &msg, &iov, 1, data__sz);
+	if (addr__nullable) {
+		addrlen = bpf_ksock_addr_to_sockaddr(addr__nullable, addr__sz, &sa);
+		if (addrlen < 0)
+			return addrlen;
+		msg.msg_name = &sa;
+		msg.msg_namelen = addrlen;
+	}

-	return ret;
+	return kernel_sendmsg(ks->sock, &msg, &iov, 1, data__sz);
+}
+
+/**
+ * bpf_ksock_send() - Send data through a BPF kernel socket.
+ * @ks:		The BPF kernel socket context. Must be an acquired reference.
+ * @data:	Pointer to the data to send.
+ * @data__sz:	Size of the data to send.
+ *
+ * Sends data on a connected socket, best-effort and nonblocking. This may sleep
+ * (kernel_sendmsg), so it can only be called from sleepable BPF programs.
+ *
+ * Return: Number of bytes sent on success, negative errno on error.
+ */
+__bpf_kfunc int bpf_ksock_send(struct bpf_ksock *ks, const void *data,
+			       u32 data__sz)
+{
+	return bpf_ksock_sendto(ks, data, data__sz, NULL, 0);
 }

 __bpf_kfunc_end_defs();
@@ -255,6 +290,7 @@ BTF_KFUNCS_START(ksock_kfunc_btf_ids)
 BTF_ID_FLAGS(func, bpf_ksock_release, KF_RELEASE)
 BTF_ID_FLAGS(func, bpf_ksock_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
 BTF_ID_FLAGS(func, bpf_ksock_send, KF_SLEEPABLE)
+BTF_ID_FLAGS(func, bpf_ksock_sendto, KF_SLEEPABLE)
 BTF_KFUNCS_END(ksock_kfunc_btf_ids)

 #ifdef CONFIG_BPF_LSM

pw-bot: cr