diff options
| author | Dominik Maier <dmnk@google.com> | 2026-10-23 01:21:20 +0200 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-10-26 12:11:41 -0600 |
| commit | e66907c3ba229399ecfb4ef032b95a4a071c894e (patch) | |
| tree | a556712c56d1ad26da96334bae50da8773e855e0 /io_uring | |
| parent | 70884ea2d636611e547f3da85fbfb8aadfa2ab4d (diff) | |
io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()
When an IORING_OP_SOCKET request is prepared in io_socket_prep(),
sock->type retains creation flags such as SOCK_CLOEXEC and SOCK_NONBLOCK
until __sys_socket_file() masks them off with SOCK_TYPE_MASK during
execution.
However, io_socket_bpf_populate() copies sock->type into
bctx->socket.type without masking off ~SOCK_TYPE_MASK. As a result, a
cBPF filter inspecting bctx->socket.type against socket types such as
SOCK_DGRAM or SOCK_STREAM can be bypassed by ORing SOCK_CLOEXEC or
SOCK_NONBLOCK into the socket type.
Mask sock->type with SOCK_TYPE_MASK when populating bctx->socket.type.
Fixes: cff1c26b4223 ("io_uring/net: allow filtering on IORING_OP_SOCKET data")
Assisted-by: ARTIST LLM
Signed-off-by: Dominik Maier <dmnk@google.com>
Link: https://patch.msgid.link/20261022232120.2537530-1-dmnk@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/net.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/net.c b/io_uring/net.c index e332b3a2ad3e..e0f27093b385 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -1734,7 +1734,7 @@ void io_socket_bpf_populate(struct io_uring_bpf_ctx *bctx, struct io_kiocb *req) struct io_socket *sock = io_kiocb_to_cmd(req, struct io_socket); bctx->socket.family = sock->domain; - bctx->socket.type = sock->type; + bctx->socket.type = sock->type & SOCK_TYPE_MASK; bctx->socket.protocol = sock->protocol; } |