net/core/bpf_ksock.c - linux - Git at Google

 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2026 Isovalent */

 #include <linux/bpf.h>
 #include <linux/bpf_ksock.h>
 #include <linux/btf.h>
 #include <linux/btf_ids.h>
 #include <linux/in.h>
 #include <linux/in6.h>
 #include <linux/net.h>
 #include <linux/refcount.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/unaligned.h>
 #include <linux/workqueue.h>
 #include <net/sock.h>

 /**
  * struct bpf_ksock - refcounted BPF kernel socket context
  * @sock:	The underlying kernel socket.
  * @usage:	Reference counter.
  * @rwork:	RCU work for deferred cleanup (sock_release may sleep).
  */
 struct bpf_ksock {
 	struct socket *sock;
 	refcount_t usage;
 	struct rcu_work rwork;
 };

 static void ksock_release_work_fn(struct work_struct *work)
 {
 	struct bpf_ksock *ks;

 	ks = container_of(to_rcu_work(work), struct bpf_ksock, rwork);
 	sock_release(ks->sock);
 	kfree(ks);
 }

 static bool bpf_ksock_has_user_task_context(void)
 {
 	/*
 	 * Task work can run from do_exit() after exit_nsproxy_namespaces()
 	 * cleared current->nsproxy, while current is still not a kthread.
 	 */
 	return !(current->flags & PF_KTHREAD) && current->nsproxy;
 }

 __bpf_kfunc_start_defs();

 /**
  * bpf_ksock_create() - Create a BPF kernel socket.
  *
  * Allocates and creates a kernel socket.
  *
  * The returned context must either be stored in a map as a kptr, or
  * freed with bpf_ksock_release().
  *
  * This function may sleep (sock_create), so it can only be used
  * in sleepable BPF programs (SYSCALL).
  * It cannot be called from a BPF workqueue callback because that callback
  * does not retain the invoking task's namespace or security context.
  *
  * @opts:	Pointer to struct bpf_ksock_create_opts with socket parameters.
  * @opts__sz:	Size of the opts struct.
  * @err__uninit:	Integer to store error code when NULL is returned.
  */
 __bpf_kfunc struct bpf_ksock *
 bpf_ksock_create(const struct bpf_ksock_create_opts *opts, u32 opts__sz,
 		 int *err__uninit)
 {
 	struct bpf_ksock_create_opts opts_copy;
 	struct bpf_ksock *ks;
 	int err;

 	/*
 	 * sock_create() derives the network namespace, credentials, and cgroup
 	 * from current. Kernel threads, including BPF workqueue callbacks, do
 	 * not carry the context of the task that invoked the BPF program.
 	 */
 	if (!bpf_ksock_has_user_task_context()) {
 		err = -EOPNOTSUPP;
 		goto err_out;
 	}

 	if (!opts || opts__sz != sizeof(struct bpf_ksock_create_opts)) {
 		err = -EINVAL;
 		goto err_out;
 	}

 	opts_copy = (struct bpf_ksock_create_opts){
 		.family = READ_ONCE(opts->family),
 		.type = READ_ONCE(opts->type),
 		.protocol = READ_ONCE(opts->protocol),
 		.reserved = READ_ONCE(opts->reserved),
 	};

 	if (opts_copy.reserved) {
 		err = -EINVAL;
 		goto err_out;
 	}

 	if (opts_copy.family != AF_INET && opts_copy.family != AF_INET6) {
 		err = -EAFNOSUPPORT;
 		goto err_out;
 	}

 	if (opts_copy.type != SOCK_DGRAM) {
 		err = -EPROTONOSUPPORT;
 		goto err_out;
 	}

 	if (opts_copy.protocol != IPPROTO_UDP && opts_copy.protocol != 0) {
 		err = -EPROTONOSUPPORT;
 		goto err_out;
 	}

 	ks = kzalloc_obj(*ks);
 	if (!ks) {
 		err = -ENOMEM;
 		goto err_out;
 	}

 	/*
 	 * Use the normal current-task socket path so LSM/cgroup policy,
 	 * socket labels, and the active netns reference match a socket(2)
 	 * created by the BPF program's caller.
 	 */
 	err = sock_create(opts_copy.family, opts_copy.type, opts_copy.protocol,
 			  &ks->sock);
 	if (err)
 		goto err_free;

 	ks->sock->sk->sk_rcvbuf = SOCK_MIN_RCVBUF;
 	ks->sock->sk->sk_userlocks |= SOCK_RCVBUF_LOCK;

 	refcount_set(&ks->usage, 1);
 	put_unaligned(0, err__uninit);
 	return ks;

 err_free:
 	kfree(ks);
 err_out:
 	put_unaligned(err, err__uninit);
 	return NULL;
 }

 /**
  * bpf_ksock_connect() - Connect a BPF kernel socket to a remote address.
  * @ks:		The BPF kernel socket context.
  * @addr:	Pointer to an IPv4 or IPv6 socket address.
  * @addr__sz:	Size of the address union.
  *
  * Connects the socket to the specified remote address and port.
  *
  * This function may sleep while connecting the socket, so it can only be used
  * in sleepable BPF programs (SYSCALL).
  *
  * Return: 0 on success, negative errno on error.
  */
 __bpf_kfunc int bpf_ksock_connect(struct bpf_ksock *ks,
 				  const union bpf_ksock_addr *addr,
 				  u32 addr__sz)
 {
 	struct sockaddr_storage sa;
 	int addrlen;

 	if (!bpf_ksock_has_user_task_context())
 		return -EOPNOTSUPP;

 	if (!addr || addr__sz != sizeof(*addr))
 		return -EINVAL;

 	/* Kfunc memory arguments may be unaligned. */
 	memcpy(&sa, addr, sizeof(*addr));

 	switch (sa.ss_family) {
 	case AF_INET:
 		addrlen = sizeof(struct sockaddr_in);
 		break;
 	case AF_INET6:
 		addrlen = sizeof(struct sockaddr_in6);
 		break;
 	default:
 		return -EAFNOSUPPORT;
 	}

 	return connect_socket(ks->sock, &sa, addrlen, 0);
 }

 /**
  * bpf_ksock_acquire() - Acquire a reference to a BPF kernel socket.
  * @ks:	The BPF kernel socket context to acquire. Must be a
  *	trusted pointer (e.g. RCU-protected kptr from a map).
  *
  * The acquired context must either be stored in a map as a kptr, or
  * freed with bpf_ksock_release().
  */
 __bpf_kfunc struct bpf_ksock *bpf_ksock_acquire(struct bpf_ksock *ks)
 {
 	if (!refcount_inc_not_zero(&ks->usage))
 		return NULL;
 	return ks;
 }

 /**
  * bpf_ksock_release() - Release a BPF kernel socket.
  * @ks:	The BPF kernel socket context to release.
  *
  * When the final reference is released, the socket is cleaned up via
  * queue_rcu_work() (since sock_release may sleep).
  */
 __bpf_kfunc void bpf_ksock_release(struct bpf_ksock *ks)
 {
 	if (refcount_dec_and_test(&ks->usage)) {
 		INIT_RCU_WORK(&ks->rwork, ksock_release_work_fn);
 		queue_rcu_work(system_dfl_wq, &ks->rwork);
 	}
 }

 __bpf_kfunc void bpf_ksock_release_dtor(void *ks)
 {
 	bpf_ksock_release(ks);
 }
 CFI_NOSEAL(bpf_ksock_release_dtor);

 /**
  * bpf_ksock_send() - Send data through a BPF kernel socket.
  * @ks:		The BPF kernel socket context. Must be an acquired reference.
  * @data:	Pointer to the data to send.
  * @data__sz:	Size of the data to send.
  *
  * Sends data on a connected socket, best-effort and nonblocking. This may sleep
  * (kernel_sendmsg), so it can only be called from sleepable BPF programs.
  *
  * Return: Number of bytes sent on success, negative errno on error.
  */
 __bpf_kfunc int bpf_ksock_send(struct bpf_ksock *ks, const void *data,
 			       u32 data__sz)
 {
 	struct msghdr msg = {
 		.msg_flags = MSG_DONTWAIT,
 	};
 	struct kvec iov = {
 		.iov_base = (void *)data,
 		.iov_len = data__sz,
 	};
 	int ret;

 	if (!bpf_ksock_has_user_task_context())
 		return -EOPNOTSUPP;

 	ret = kernel_sendmsg(ks->sock, &msg, &iov, 1, data__sz);

 	return ret;
 }

 __bpf_kfunc_end_defs();

 BTF_KFUNCS_START(ksock_init_kfunc_btf_ids)
 BTF_ID_FLAGS(func, bpf_ksock_create, KF_ACQUIRE | KF_RET_NULL | KF_SLEEPABLE)
 BTF_ID_FLAGS(func, bpf_ksock_connect, KF_SLEEPABLE)
 BTF_KFUNCS_END(ksock_init_kfunc_btf_ids)

 static const struct btf_kfunc_id_set ksock_init_kfunc_set = {
 	.owner = THIS_MODULE,
 	.set = &ksock_init_kfunc_btf_ids,
 };

 BTF_KFUNCS_START(ksock_kfunc_btf_ids)
 BTF_ID_FLAGS(func, bpf_ksock_release, KF_RELEASE)
 BTF_ID_FLAGS(func, bpf_ksock_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
 BTF_ID_FLAGS(func, bpf_ksock_send, KF_SLEEPABLE)
 BTF_KFUNCS_END(ksock_kfunc_btf_ids)

 #ifdef CONFIG_BPF_LSM
 BTF_ID_LIST_SINGLE(bpf_lsm_socket_sendmsg_id, func, bpf_lsm_socket_sendmsg)
 #endif

 static int bpf_ksock_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)
 {
 	if (!btf_id_set8_contains(&ksock_kfunc_btf_ids, kfunc_id))
 		return 0;

 	if (prog->type == BPF_PROG_TYPE_SYSCALL)
 		return 0;

 #ifdef CONFIG_BPF_LSM
 	if (prog->type == BPF_PROG_TYPE_LSM &&
 	    prog->aux->attach_btf_id != bpf_lsm_socket_sendmsg_id[0])
 		return 0;
 #endif

 	return -EACCES;
 }

 static const struct btf_kfunc_id_set ksock_kfunc_set = {
 	.owner = THIS_MODULE,
 	.set = &ksock_kfunc_btf_ids,
 	.filter = bpf_ksock_kfunc_filter,
 };

 BTF_ID_LIST(bpf_ksock_dtor_ids)
 BTF_ID(struct, bpf_ksock)
 BTF_ID(func, bpf_ksock_release_dtor)

 static int __init bpf_ksock_kfunc_init(void)
 {
 	int ret;
 	const struct btf_id_dtor_kfunc bpf_ksock_dtors[] = {
 		{
 			.btf_id = bpf_ksock_dtor_ids[0],
 			.kfunc_btf_id = bpf_ksock_dtor_ids[1],
 		},
 	};

 	ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL,
 					&ksock_init_kfunc_set);
 	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL,
 					       &ksock_kfunc_set);
 	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LSM,
 					       &ksock_kfunc_set);
 	return ret ?: register_btf_id_dtor_kfuncs(bpf_ksock_dtors,
 						  ARRAY_SIZE(bpf_ksock_dtors),
 						  THIS_MODULE);
 }

 late_initcall(bpf_ksock_kfunc_init);
	// SPDX-License-Identifier: GPL-2.0-only
	/* Copyright (c) 2026 Isovalent */

	#include <linux/bpf.h>
	#include <linux/bpf_ksock.h>
	#include <linux/btf.h>
	#include <linux/btf_ids.h>
	#include <linux/in.h>
	#include <linux/in6.h>
	#include <linux/net.h>
	#include <linux/refcount.h>
	#include <linux/sched.h>
	#include <linux/slab.h>
	#include <linux/socket.h>
	#include <linux/unaligned.h>
	#include <linux/workqueue.h>
	#include <net/sock.h>

	/**
	* struct bpf_ksock - refcounted BPF kernel socket context
	* @sock: The underlying kernel socket.
	* @usage: Reference counter.
	* @rwork: RCU work for deferred cleanup (sock_release may sleep).
	*/
	struct bpf_ksock {
	struct socket *sock;
	refcount_t usage;
	struct rcu_work rwork;
	};

	static void ksock_release_work_fn(struct work_struct *work)
	{
	struct bpf_ksock *ks;

	ks = container_of(to_rcu_work(work), struct bpf_ksock, rwork);
	sock_release(ks->sock);
	kfree(ks);
	}

	static bool bpf_ksock_has_user_task_context(void)
	{
	/*
	* Task work can run from do_exit() after exit_nsproxy_namespaces()
	* cleared current->nsproxy, while current is still not a kthread.
	*/
	return !(current->flags & PF_KTHREAD) && current->nsproxy;
	}

	__bpf_kfunc_start_defs();

	/**
	* bpf_ksock_create() - Create a BPF kernel socket.
	*
	* Allocates and creates a kernel socket.
	*
	* The returned context must either be stored in a map as a kptr, or
	* freed with bpf_ksock_release().
	*
	* This function may sleep (sock_create), so it can only be used
	* in sleepable BPF programs (SYSCALL).
	* It cannot be called from a BPF workqueue callback because that callback
	* does not retain the invoking task's namespace or security context.
	*
	* @opts: Pointer to struct bpf_ksock_create_opts with socket parameters.
	* @opts__sz: Size of the opts struct.
	* @err__uninit: Integer to store error code when NULL is returned.
	*/
	__bpf_kfunc struct bpf_ksock *
	bpf_ksock_create(const struct bpf_ksock_create_opts *opts, u32 opts__sz,
	int *err__uninit)
	{
	struct bpf_ksock_create_opts opts_copy;
	struct bpf_ksock *ks;
	int err;

	/*
	* sock_create() derives the network namespace, credentials, and cgroup
	* from current. Kernel threads, including BPF workqueue callbacks, do
	* not carry the context of the task that invoked the BPF program.
	*/
	if (!bpf_ksock_has_user_task_context()) {
	err = -EOPNOTSUPP;
	goto err_out;
	}

	if (!opts \|\| opts__sz != sizeof(struct bpf_ksock_create_opts)) {
	err = -EINVAL;
	goto err_out;
	}

	opts_copy = (struct bpf_ksock_create_opts){
	.family = READ_ONCE(opts->family),
	.type = READ_ONCE(opts->type),
	.protocol = READ_ONCE(opts->protocol),
	.reserved = READ_ONCE(opts->reserved),
	};

	if (opts_copy.reserved) {
	err = -EINVAL;
	goto err_out;
	}

	if (opts_copy.family != AF_INET && opts_copy.family != AF_INET6) {
	err = -EAFNOSUPPORT;
	goto err_out;
	}

	if (opts_copy.type != SOCK_DGRAM) {
	err = -EPROTONOSUPPORT;
	goto err_out;
	}

	if (opts_copy.protocol != IPPROTO_UDP && opts_copy.protocol != 0) {
	err = -EPROTONOSUPPORT;
	goto err_out;
	}

	ks = kzalloc_obj(*ks);
	if (!ks) {
	err = -ENOMEM;
	goto err_out;
	}

	/*
	* Use the normal current-task socket path so LSM/cgroup policy,
	* socket labels, and the active netns reference match a socket(2)
	* created by the BPF program's caller.
	*/
	err = sock_create(opts_copy.family, opts_copy.type, opts_copy.protocol,
	&ks->sock);
	if (err)
	goto err_free;

	ks->sock->sk->sk_rcvbuf = SOCK_MIN_RCVBUF;
	ks->sock->sk->sk_userlocks \|= SOCK_RCVBUF_LOCK;

	refcount_set(&ks->usage, 1);
	put_unaligned(0, err__uninit);
	return ks;

	err_free:
	kfree(ks);
	err_out:
	put_unaligned(err, err__uninit);
	return NULL;
	}

	/**
	* bpf_ksock_connect() - Connect a BPF kernel socket to a remote address.
	* @ks: The BPF kernel socket context.
	* @addr: Pointer to an IPv4 or IPv6 socket address.
	* @addr__sz: Size of the address union.
	*
	* Connects the socket to the specified remote address and port.
	*
	* This function may sleep while connecting the socket, so it can only be used
	* in sleepable BPF programs (SYSCALL).
	*
	* Return: 0 on success, negative errno on error.
	*/
	__bpf_kfunc int bpf_ksock_connect(struct bpf_ksock *ks,
	const union bpf_ksock_addr *addr,
	u32 addr__sz)
	{
	struct sockaddr_storage sa;
	int addrlen;

	if (!bpf_ksock_has_user_task_context())
	return -EOPNOTSUPP;

	if (!addr \|\| addr__sz != sizeof(*addr))
	return -EINVAL;

	/* Kfunc memory arguments may be unaligned. */
	memcpy(&sa, addr, sizeof(*addr));

	switch (sa.ss_family) {
	case AF_INET:
	addrlen = sizeof(struct sockaddr_in);
	break;
	case AF_INET6:
	addrlen = sizeof(struct sockaddr_in6);
	break;
	default:
	return -EAFNOSUPPORT;
	}

	return connect_socket(ks->sock, &sa, addrlen, 0);
	}

	/**
	* bpf_ksock_acquire() - Acquire a reference to a BPF kernel socket.
	* @ks: The BPF kernel socket context to acquire. Must be a
	* trusted pointer (e.g. RCU-protected kptr from a map).
	*
	* The acquired context must either be stored in a map as a kptr, or
	* freed with bpf_ksock_release().
	*/
	__bpf_kfunc struct bpf_ksock bpf_ksock_acquire(struct bpf_ksock ks)
	{
	if (!refcount_inc_not_zero(&ks->usage))
	return NULL;
	return ks;
	}

	/**
	* bpf_ksock_release() - Release a BPF kernel socket.
	* @ks: The BPF kernel socket context to release.
	*
	* When the final reference is released, the socket is cleaned up via
	* queue_rcu_work() (since sock_release may sleep).
	*/
	__bpf_kfunc void bpf_ksock_release(struct bpf_ksock *ks)
	{
	if (refcount_dec_and_test(&ks->usage)) {
	INIT_RCU_WORK(&ks->rwork, ksock_release_work_fn);
	queue_rcu_work(system_dfl_wq, &ks->rwork);
	}
	}

	__bpf_kfunc void bpf_ksock_release_dtor(void *ks)
	{
	bpf_ksock_release(ks);
	}
	CFI_NOSEAL(bpf_ksock_release_dtor);

	/**
	* bpf_ksock_send() - Send data through a BPF kernel socket.
	* @ks: The BPF kernel socket context. Must be an acquired reference.
	* @data: Pointer to the data to send.
	* @data__sz: Size of the data to send.
	*
	* Sends data on a connected socket, best-effort and nonblocking. This may sleep
	* (kernel_sendmsg), so it can only be called from sleepable BPF programs.
	*
	* Return: Number of bytes sent on success, negative errno on error.
	*/
	__bpf_kfunc int bpf_ksock_send(struct bpf_ksock ks, const void data,
	u32 data__sz)
	{
	struct msghdr msg = {
	.msg_flags = MSG_DONTWAIT,
	};
	struct kvec iov = {
	.iov_base = (void *)data,
	.iov_len = data__sz,
	};
	int ret;

	if (!bpf_ksock_has_user_task_context())
	return -EOPNOTSUPP;

	ret = kernel_sendmsg(ks->sock, &msg, &iov, 1, data__sz);

	return ret;
	}

	__bpf_kfunc_end_defs();

	BTF_KFUNCS_START(ksock_init_kfunc_btf_ids)
	BTF_ID_FLAGS(func, bpf_ksock_create, KF_ACQUIRE \| KF_RET_NULL \| KF_SLEEPABLE)
	BTF_ID_FLAGS(func, bpf_ksock_connect, KF_SLEEPABLE)
	BTF_KFUNCS_END(ksock_init_kfunc_btf_ids)

	static const struct btf_kfunc_id_set ksock_init_kfunc_set = {
	.owner = THIS_MODULE,
	.set = &ksock_init_kfunc_btf_ids,
	};

	BTF_KFUNCS_START(ksock_kfunc_btf_ids)
	BTF_ID_FLAGS(func, bpf_ksock_release, KF_RELEASE)
	BTF_ID_FLAGS(func, bpf_ksock_acquire, KF_ACQUIRE \| KF_RCU \| KF_RET_NULL)
	BTF_ID_FLAGS(func, bpf_ksock_send, KF_SLEEPABLE)
	BTF_KFUNCS_END(ksock_kfunc_btf_ids)

	#ifdef CONFIG_BPF_LSM
	BTF_ID_LIST_SINGLE(bpf_lsm_socket_sendmsg_id, func, bpf_lsm_socket_sendmsg)
	#endif

	static int bpf_ksock_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)
	{
	if (!btf_id_set8_contains(&ksock_kfunc_btf_ids, kfunc_id))
	return 0;

	if (prog->type == BPF_PROG_TYPE_SYSCALL)
	return 0;

	#ifdef CONFIG_BPF_LSM
	if (prog->type == BPF_PROG_TYPE_LSM &&
	prog->aux->attach_btf_id != bpf_lsm_socket_sendmsg_id[0])
	return 0;
	#endif

	return -EACCES;
	}

	static const struct btf_kfunc_id_set ksock_kfunc_set = {
	.owner = THIS_MODULE,
	.set = &ksock_kfunc_btf_ids,
	.filter = bpf_ksock_kfunc_filter,
	};

	BTF_ID_LIST(bpf_ksock_dtor_ids)
	BTF_ID(struct, bpf_ksock)
	BTF_ID(func, bpf_ksock_release_dtor)

	static int __init bpf_ksock_kfunc_init(void)
	{
	int ret;
	const struct btf_id_dtor_kfunc bpf_ksock_dtors[] = {
	{
	.btf_id = bpf_ksock_dtor_ids[0],
	.kfunc_btf_id = bpf_ksock_dtor_ids[1],
	},
	};

	ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL,
	&ksock_init_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL,
	&ksock_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LSM,
	&ksock_kfunc_set);
	return ret ?: register_btf_id_dtor_kfuncs(bpf_ksock_dtors,
	ARRAY_SIZE(bpf_ksock_dtors),
	THIS_MODULE);
	}

	late_initcall(bpf_ksock_kfunc_init);