From nobody Sat Jun 13 23:21:57 2026 Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C2C9B1624C0 for ; Sat, 13 Jun 2026 16:25:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781367920; cv=none; b=MVdVoQM7qhtRQsgiGqi5RtefT95jY+4TC/ia8jnTxG2ODNFusL/KAHpc4ImCgbb2p0zOv8flJEJX8VHZ04pCGOfEsulkumXIAqU1s6bZP+m47IFx+VjuK2t/wtLUR6yoaEAJ85V71jV0hsHXwtE2Ohi51Ok/8qyPeOd/HkTUBJE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781367920; c=relaxed/simple; bh=Eal2czQ95OzT7W6wIkz0a5NNDrThTK5VqMCa1pr5ZC4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jR6GVOHIMHO2R6UM2/bTBY4Z0g8TkRFR7iflPPMjFqMqdrTmWZMvaIQJp/JX4FaAOVFOSa3u+nFke00u2SGpZja0iL/wJKfxqBIG8fOROR4Vj/7kRzSFEm8tSHu1YaWw/Fmicmqj5U0DNEX8Vl+CJoGfnypFiinPWBRGrVhSXfM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=v65xRIoT; arc=none smtp.client-ip=91.218.175.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="v65xRIoT" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1781367914; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=B8tNNOKX9vfVW0agW6GrP6/656hRhnEOUOOBtzzI4Vk=; b=v65xRIoTDffq84H+qFuzsYjKkb5yJ2o2dSOm5M9Nzop343f3yvyHeL7X1rUSy4i841CgNa fqodtywTbu4Ibxv6bXrsWrdA5X1sSWodtrMrf2DUdzd/ptqSPkYDUN1vYfI2GsVReOfjYz HYTk9I/BG3rXCqchxpqB4g30VFM3kII= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , John Fastabend , Stanislav Fomichev , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Shuah Khan , Leon Hwang , Ihor Solodrai , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-patches-bot@fb.com, Feng Zhou Subject: [PATCH bpf-next v4 1/2] bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket Date: Sun, 14 Jun 2026 00:24:42 +0800 Message-ID: <20260613162443.60515-2-leon.hwang@linux.dev> In-Reply-To: <20260613162443.60515-1-leon.hwang@linux.dev> References: <20260613162443.60515-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" When TCP over IPv4 via INET6 API, bpf_get/setsockopt with ipv4 will fail, because sk->sk_family is AF_INET6. With ipv6 will success, not take effect, because inet_csk(sk)->icsk_af_ops is ipv6_mapped and use ip_queue_xmit, inet_sk(sk)->tos. To relax this restriction, allow getting/setting tos for those possible ipv4-mapped ipv6 sockets. Fixes: ee7f1e1302f5 ("bpf: Change bpf_setsockopt(SOL_IP) to reuse do_ip_set= sockopt()") Signed-off-by: Feng Zhou Signed-off-by: Leon Hwang --- net/core/filter.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 9590877b0714..57b00c6cc8cc 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -5544,11 +5544,24 @@ static int sol_tcp_sockopt(struct sock *sk, int opt= name, KERNEL_SOCKPTR(optval), *optlen); } =20 +static bool sk_allows_sol_ip_sockopt(struct sock *sk) +{ + switch (sk->sk_family) { + case AF_INET: + return true; + case AF_INET6: + /* Allow getting/setting sockopt for possible ipv4-mapped ipv6 socket. */ + return sk->sk_type !=3D SOCK_RAW && !ipv6_only_sock(sk); + default: + return false; + } +} + static int sol_ip_sockopt(struct sock *sk, int optname, char *optval, int *optlen, bool getopt) { - if (sk->sk_family !=3D AF_INET) + if (!sk_allows_sol_ip_sockopt(sk)) return -EINVAL; =20 switch (optname) { --=20 2.54.0 From nobody Sat Jun 13 23:21:57 2026 Received: from out-174.mta0.migadu.com (out-174.mta0.migadu.com [91.218.175.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36D892652AF for ; Sat, 13 Jun 2026 16:25:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781367928; cv=none; b=EdaFvEoPMmU5LA9MMEku/K9gvKmr74MoxjnQSQ4it37IFiHdgI0myi2u9YwL+kNzaZLzPJGxzOGiVNlZD3oVjYZX2Mfnb+hjr9xx2GRyQblr8KUtXV9Zsb0GvWcMyuFCJSaAsplzfyBjXom8Caetw+HiIrojXjlurUghtLgcxuo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781367928; c=relaxed/simple; bh=Tgz5fbE2F6BnrKPj3NravBmADjbAGqgeaiswNj+n42M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Rs9+3o6MW3UwF5ix3vK+ykt85bqgPTP63kutb7iQSizxGDcffMQjFf7H6NVigaDc81xKEuApM6cIQ5fKDA06/wFL/00kojEsWdKVCBE30NL9KzFV3OlW/QQzBbMd9LAGxtKKEE6hywoMCihssskHNGOBkLj0LtD8FrYh0a5NrlQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=wB6dZb11; arc=none smtp.client-ip=91.218.175.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="wB6dZb11" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1781367924; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=eEq9q/jnE/hhTQbdBCDPVl5f7XKJflv20xFeGiECkR8=; b=wB6dZb11onUfE5CbpWiuuTENg6gLRBjGR9qbtHQnN9+ooSJWpO6sETM7nzLgMTKdc/GO8L MeVZNzfyjm6oZLJpN4KvYTFiM0lDYNo+WKYssAPgKZytPo/kbs4NePf8JueA7ObEsnZk1Y 95gvVjyOEhLk093WNd1ndDfG7pFFhLQ= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , John Fastabend , Stanislav Fomichev , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Shuah Khan , Leon Hwang , Ihor Solodrai , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next v4 2/2] selftests/bpf: Add test to verify the fix for bpf_setsockopt() helper Date: Sun, 14 Jun 2026 00:24:43 +0800 Message-ID: <20260613162443.60515-3-leon.hwang@linux.dev> In-Reply-To: <20260613162443.60515-1-leon.hwang@linux.dev> References: <20260613162443.60515-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Verify the fix by: 1. Attach cgroup sockops prog. 2. Build a tcp connection using ipv4 addr in ipv6 socket. 3. Verify the return value of bpf_setsockopt() helper. Assisted-by: Codex:gpt-5.5-xhigh Signed-off-by: Leon Hwang --- .../selftests/bpf/prog_tests/setget_sockopt.c | 78 +++++++++++++++++++ .../selftests/bpf/progs/setget_sockopt.c | 23 ++++++ 2 files changed, 101 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/setget_sockopt.c b/tool= s/testing/selftests/bpf/prog_tests/setget_sockopt.c index 77fe1bfb7504..4e91d9b615ce 100644 --- a/tools/testing/selftests/bpf/prog_tests/setget_sockopt.c +++ b/tools/testing/selftests/bpf/prog_tests/setget_sockopt.c @@ -199,6 +199,83 @@ static void test_nonstandard_opt(int family) bpf_link__destroy(getsockopt_link); } =20 +static int connect_to_v4mapped_v6_fd(int server_fd) +{ + struct sockaddr_storage addr; + struct sockaddr_in *addr4 =3D (void *)&addr; + socklen_t addrlen =3D sizeof(addr); + struct sockaddr_in6 addr6 =3D {}; + int fd =3D -1, v6only =3D 0, err; + + err =3D getsockname(server_fd, (struct sockaddr *)&addr, &addrlen); + if (!ASSERT_OK(err, "getsockname")) + return -1; + + fd =3D socket(AF_INET6, SOCK_STREAM, 0); + if (!ASSERT_GE(fd, 0, "socket")) + return -1; + + err =3D settimeo(fd, 0); + if (!ASSERT_OK(err, "settimeo")) + goto err_out; + + err =3D setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &v6only, sizeof(v6only)= ); + if (!ASSERT_OK(err, "clear_v6only")) + goto err_out; + + addr6.sin6_family =3D AF_INET6; + addr6.sin6_port =3D addr4->sin_port; + addr6.sin6_addr.s6_addr[10] =3D 0xff; + addr6.sin6_addr.s6_addr[11] =3D 0xff; + memcpy(&addr6.sin6_addr.s6_addr[12], &addr4->sin_addr, sizeof(addr4->sin_= addr)); + + err =3D connect(fd, (struct sockaddr *)&addr6, sizeof(addr6)); + if (!ASSERT_OK(err, "connect")) + goto err_out; + + return fd; + +err_out: + close(fd); + return -1; +} + +static void test_v4mapped_v6_ip_tos(void) +{ + struct setget_sockopt__bss *bss =3D skel->bss; + int sfd =3D -1, fd =3D -1, got =3D 0, exp =3D 0x1c; + socklen_t optlen; + + memset(bss, 0, sizeof(*bss)); + bss->v4mapped_v6_ip_tos_enable =3D 1; + bss->v4mapped_v6_ip_tos_ret =3D -1; + bss->v4mapped_v6_ip_tos_val =3D exp; + + sfd =3D start_server(AF_INET, SOCK_STREAM, addr4_str, 0, 0); + if (!ASSERT_GE(sfd, 0, "start_server")) + goto err_out; + + fd =3D connect_to_v4mapped_v6_fd(sfd); + if (!ASSERT_GE(fd, 0, "connect_to_v4mapped_v6_fd")) + goto err_out; + + ASSERT_GT(bss->v4mapped_v6_ip_tos_cnt, 0, "v4mapped_v6_ip_tos_cnt"); + ASSERT_EQ(bss->v4mapped_v6_ip_tos_ret, 0, "v4mapped_v6_ip_tos_ret"); + + optlen =3D sizeof(got); + if (!ASSERT_OK(getsockopt(fd, SOL_IP, IP_TOS, &got, &optlen), "getsockopt= _ip_tos")) + goto err_out; + + ASSERT_EQ(got, exp, "ip_tos"); + +err_out: + bss->v4mapped_v6_ip_tos_enable =3D 0; + if (fd >=3D 0) + close(fd); + if (sfd >=3D 0) + close(sfd); +} + void test_setget_sockopt(void) { cg_fd =3D test__join_cgroup(CG_NAME); @@ -238,6 +315,7 @@ void test_setget_sockopt(void) test_ktls(AF_INET); test_nonstandard_opt(AF_INET); test_nonstandard_opt(AF_INET6); + test_v4mapped_v6_ip_tos(); =20 done: setget_sockopt__destroy(skel); diff --git a/tools/testing/selftests/bpf/progs/setget_sockopt.c b/tools/tes= ting/selftests/bpf/progs/setget_sockopt.c index d330b1511979..636a7cd8e2fa 100644 --- a/tools/testing/selftests/bpf/progs/setget_sockopt.c +++ b/tools/testing/selftests/bpf/progs/setget_sockopt.c @@ -387,6 +387,24 @@ int _getsockopt(struct bpf_sockopt *ctx) return 1; } =20 +int v4mapped_v6_ip_tos_enable; +int v4mapped_v6_ip_tos_ret; +int v4mapped_v6_ip_tos_cnt; +int v4mapped_v6_ip_tos_val; + +static void test_v4mapped_v6_ip_tos(struct bpf_sock_ops *skops) +{ + int tos =3D v4mapped_v6_ip_tos_val; + + if (!v4mapped_v6_ip_tos_enable || skops->op !=3D BPF_SOCK_OPS_TCP_CONNECT= _CB) + return; + if (skops->family !=3D AF_INET6) + return; + + v4mapped_v6_ip_tos_cnt++; + v4mapped_v6_ip_tos_ret =3D bpf_setsockopt(skops, IPPROTO_IP, IP_TOS, &tos= , sizeof(tos)); +} + SEC("sockops") int skops_sockopt(struct bpf_sock_ops *skops) { @@ -401,6 +419,11 @@ int skops_sockopt(struct bpf_sock_ops *skops) if (!sk) return 1; =20 + if (v4mapped_v6_ip_tos_enable) { + test_v4mapped_v6_ip_tos(skops); + return 1; + } + switch (skops->op) { case BPF_SOCK_OPS_TCP_LISTEN_CB: nr_listen +=3D !(bpf_test_sockopt(skops, sk) || --=20 2.54.0