Re: [PATCH bpf-next v5 4/5] selftests/bpf: Test forbidden bpf_ksock_send() LSM attach

> diff --git a/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c b/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c
> new file mode 100644
> index 000000000000..5b969e03b6d6
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c
> @@ -0,0 +1,36 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2026 Isovalent */
> +
> +#include "vmlinux.h"
> +#include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_tracing.h>
> +#include "bpf_misc.h"
> +#include "bpf_tracing_net.h"

This isn't a bug, but does ksock_lsm_verifier.c still need bpf_tracing_net.h?
The AF_INET/SOCK_DGRAM constants it provides look like they're only used by
ksock_lsm.c, so the include could probably be dropped here.

> +#include "ksock_common.h"
> +
> +char send_data[11] = "dummy data";
> +
> +SEC("lsm.s/socket_sendmsg")
> +__description("bpf_ksock_send is rejected from socket_sendmsg LSM hook")
> +__failure __msg("calling kernel function bpf_ksock_send is not allowed")
> +int BPF_PROG(ksock_socket_sendmsg, struct socket *sock, struct msghdr *msg,
> +	     int size, int ret)
> +{
> +	struct __ksock_ctx_value *v;
> +	struct bpf_ksock *ks;
> +
> +	v = ksock_ctx_value_lookup();
> +	if (!v)
> +		return ret;
> +
> +	ks = bpf_kptr_xchg(&v->ctx, NULL);
> +	if (!ks)
> +		return ret;
> +
> +	bpf_ksock_send(ks, send_data, sizeof(send_data));
> +	bpf_ksock_release(ks);
> +
> +	return ret;
> +}
> +
> +char __license[] SEC("license") = "GPL";


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31202489240