From nobody Sun Feb 8 18:48:59 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50A263346BC; Mon, 20 Oct 2025 21:26:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760995600; cv=none; b=XsQ2XeaU2l+MWxq8yhSxlWHdqrXVaSetqAL2BxeKli+Tv6kRti7IWfO+o6fRUcP1aim3+omRXckcyAmvvYWa9dhV4x5W0uAsnfoER/egK5F+YiXFgd68jGvG1Q4i4XsIMEif+0ywzsNv78LvN7QvNr5AMw0FNtr3kLDal3VNA9k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760995600; c=relaxed/simple; bh=oDFsq+yPcHCa/fvTPPasjIVx6L9+9p2F6yJKxmOzzBw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=BWReNVYQRbPb6fbz8QBYy2YV6rsv9QxKyNBXzz4ik9eWKzAAnS2J9rdoWJBb7CB8YwLQ0IXTL+jxj5YPWSFlB/nM3XKFyrYLAgCnHv1uk/JK6UOHqRtd+SxVN5Sf1GYB5sGGWn76QDDn+s/ZtjlQV8oenTzVpG+ArV/bD50lR3A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=brj7LxBr; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="brj7LxBr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 06461C19424; Mon, 20 Oct 2025 21:26:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1760995600; bh=oDFsq+yPcHCa/fvTPPasjIVx6L9+9p2F6yJKxmOzzBw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=brj7LxBrmRWpHKET2z5+SyswA62H0JXAWN2zExl/+vXYD4YkUv3nZK0JBdb46qvFs 96P5pDz8wvMGlAU1cSEfiI5fGaxEwxVu7OBoqNue33pPKUE6zsweFuWoh9frEk9II7 W3hoQdmEtT6D0KWgfq4k/R2kPWE+oVo6pTyTBpwxF04tvB7PRcCSjGDRlkiCQEf5zK bHqIJVC5q9qP19RxGqSLwH8cXbS+SyKKfplMD/b1VnvDzW1/7Jf8gZkAR8dxyZYeYa tP4vs340FmTqav1qKAF92rsVzI2WsMFMjiz/LHv65BwEnT+Cc+yGVpH1w0tihoJafJ W2poMa47yn0cQ== From: Kees Cook To: Jakub Kicinski Cc: Kees Cook , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , "David S. Miller" , David Ahern , Eric Dumazet , Paolo Abeni , Simon Horman , bpf@vger.kernel.org, netdev@vger.kernel.org, "Gustavo A. R. Silva" , Kuniyuki Iwashima , Willem de Bruijn , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v3 7/9] bpf: Convert cgroup sockaddr filters to use sockaddr_unspec consistently Date: Mon, 20 Oct 2025 14:26:36 -0700 Message-Id: <20251020212639.1223484-7-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20251020212125.make.115-kees@kernel.org> References: <20251020212125.make.115-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5097; i=kees@kernel.org; h=from:subject; bh=oDFsq+yPcHCa/fvTPPasjIVx6L9+9p2F6yJKxmOzzBw=; b=owGbwMvMwCVmps19z/KJym7G02pJDBnfVvI+Vun9G/S+NPl0xatLF73Pr4r5ZWjwOWzLLNU5D lmbNFz+dJSyMIhxMciKKbIE2bnHuXi8bQ93n6sIM4eVCWQIAxenAEzk5COGf/bN0mGixrnGwdPT pc/l7tA+8sxuhfZ/y91aPq7z2JVenGX4p8DF1xlrMZuBl3HK9tOfdev4H132rmfST8ux+D1DQcS VEQA= X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Update BPF cgroup sockaddr filtering infrastructure to use sockaddr_unspec consistently throughout the call chain, removing redundant explicit casts from callers. Signed-off-by: Kees Cook --- Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: John Fastabend Cc: Andrii Nakryiko Cc: Martin KaFai Lau Cc: Eduard Zingerman Cc: Song Liu Cc: Yonghong Song Cc: KP Singh Cc: Stanislav Fomichev Cc: Hao Luo Cc: Jiri Olsa Cc: "David S. Miller" Cc: David Ahern Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Cc: --- include/linux/bpf-cgroup.h | 17 ++++++++++------- kernel/bpf/cgroup.c | 4 ++-- net/ipv4/af_inet.c | 4 ++-- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index a7fb4f46974f..f9db69cef833 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -120,7 +120,7 @@ int __cgroup_bpf_run_filter_sk(struct sock *sk, enum cgroup_bpf_attach_type atype); =20 int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, - struct sockaddr *uaddr, + struct sockaddr_unspec *uaddr, int *uaddrlen, enum cgroup_bpf_attach_type atype, void *t_ctx, @@ -238,8 +238,9 @@ static inline bool cgroup_bpf_sock_enabled(struct sock = *sk, ({ \ int __ret =3D 0; \ if (cgroup_bpf_enabled(atype)) \ - __ret =3D __cgroup_bpf_run_filter_sock_addr(sk, (struct sockaddr *)uaddr= , uaddrlen, \ - atype, NULL, NULL); \ + __ret =3D __cgroup_bpf_run_filter_sock_addr(sk, \ + (struct sockaddr_unspec *)uaddr, uaddrlen, \ + atype, NULL, NULL); \ __ret; \ }) =20 @@ -248,8 +249,9 @@ static inline bool cgroup_bpf_sock_enabled(struct sock = *sk, int __ret =3D 0; \ if (cgroup_bpf_enabled(atype)) { \ lock_sock(sk); \ - __ret =3D __cgroup_bpf_run_filter_sock_addr(sk, (struct sockaddr *)uaddr= , uaddrlen, \ - atype, t_ctx, NULL); \ + __ret =3D __cgroup_bpf_run_filter_sock_addr(sk, \ + (struct sockaddr_unspec *)uaddr, uaddrlen, \ + atype, t_ctx, NULL); \ release_sock(sk); \ } \ __ret; \ @@ -266,8 +268,9 @@ static inline bool cgroup_bpf_sock_enabled(struct sock = *sk, int __ret =3D 0; \ if (cgroup_bpf_enabled(atype)) { \ lock_sock(sk); \ - __ret =3D __cgroup_bpf_run_filter_sock_addr(sk, (struct sockaddr *)uaddr= , uaddrlen, \ - atype, NULL, &__flags); \ + __ret =3D __cgroup_bpf_run_filter_sock_addr(sk, \ + (struct sockaddr_unspec *)uaddr, uaddrlen, \ + atype, NULL, &__flags); \ release_sock(sk); \ if (__flags & BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE) \ *bind_flags |=3D BIND_NO_CAP_NET_BIND_SERVICE; \ diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 248f517d66d0..af8b070e71ba 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -1665,7 +1665,7 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); * returned value !=3D 1 during execution. In all other cases, 0 is return= ed. */ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, - struct sockaddr *uaddr, + struct sockaddr_unspec *uaddr, int *uaddrlen, enum cgroup_bpf_attach_type atype, void *t_ctx, @@ -1673,7 +1673,7 @@ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, { struct bpf_sock_addr_kern ctx =3D { .sk =3D sk, - .uaddr =3D uaddr, + .uaddr =3D (struct sockaddr *)uaddr, .t_ctx =3D t_ctx, }; struct sockaddr_storage unspec; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 74a71f3c9ada..07b164f8529d 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -813,7 +813,7 @@ int inet_getname(struct socket *sock, struct sockaddr *= uaddr, } sin->sin_port =3D inet->inet_dport; sin->sin_addr.s_addr =3D inet->inet_daddr; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, &sin_addr_len, + BPF_CGROUP_RUN_SA_PROG(sk, sin, &sin_addr_len, CGROUP_INET4_GETPEERNAME); } else { __be32 addr =3D inet->inet_rcv_saddr; @@ -821,7 +821,7 @@ int inet_getname(struct socket *sock, struct sockaddr *= uaddr, addr =3D inet->inet_saddr; sin->sin_port =3D inet->inet_sport; sin->sin_addr.s_addr =3D addr; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, &sin_addr_len, + BPF_CGROUP_RUN_SA_PROG(sk, sin, &sin_addr_len, CGROUP_INET4_GETSOCKNAME); } release_sock(sk); --=20 2.34.1