Re: [PATCH bpf-next 3/3] bpf: Fix ksock build with BPF_LSM=y and SECURITY_NETWORK=n

[Mahe Tardy]

On Mon, Oct 19, 2026 at 05:10:06PM -0400, Sasha Levin wrote:
> bpf_ksock.c references bpf_lsm_socket_sendmsg() whenever
> CONFIG_BPF_LSM=y, but the socket LSM hooks, and with them the BPF LSM
> socket_sendmsg hook, only exist with CONFIG_SECURITY_NETWORK=y. Without
> it resolve_btfids warns:
> 
>   WARN: resolve_btfids: unresolved symbol bpf_lsm_socket_sendmsg
> 
> and since commit 201a454df948 ("resolve_btfids: Fix the --fatal_warnings
> exit status") that fails the build with CONFIG_WERROR=y.
> 
> Only reference the hook with CONFIG_SECURITY_NETWORK=y, and use
> BTF_ID_UNUSED otherwise. The ID stays zero, as it was when unresolved,
> so bpf_ksock_kfunc_filter() keeps allowing LSM programs: none can be
> attached to socket_sendmsg without CONFIG_SECURITY_NETWORK.
> 
> Fixes: 7ae4eb14c5f9 ("bpf: Add ksock kfuncs")
> Assisted-by: LLM
> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

Acked-by: Mahe Tardy <mahe.tardy@xxxxxxxxx>

Makes sense, thanks for fixing this warning.

> ---
>  net/core/bpf_ksock.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/bpf_ksock.c b/net/core/bpf_ksock.c
> index 7bf796193ab61..48a2e2327acef 100644
> --- a/net/core/bpf_ksock.c
> +++ b/net/core/bpf_ksock.c
> @@ -258,7 +258,12 @@ BTF_ID_FLAGS(func, bpf_ksock_send, KF_SLEEPABLE)
>  BTF_KFUNCS_END(ksock_kfunc_btf_ids)
>  
>  #ifdef CONFIG_BPF_LSM
> -BTF_ID_LIST_SINGLE(bpf_lsm_socket_sendmsg_id, func, bpf_lsm_socket_sendmsg)
> +BTF_ID_LIST(bpf_lsm_socket_sendmsg_id)
> +#ifdef CONFIG_SECURITY_NETWORK
> +BTF_ID(func, bpf_lsm_socket_sendmsg)
> +#else
> +BTF_ID_UNUSED
> +#endif
>  #endif
>  
>  static int bpf_ksock_kfunc_filter(const struct bpf_prog *prog, u32 kfunc_id)
> -- 
> 2.53.0
>